netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

security/crowdsec: v1.0 (#3030)

Browse Source
This commit is contained in:
mmetc
2022-07-13 15:20:24 +02:00
committed by GitHub
parent 307b8d995a
commit a427756cf2
9 changed files with 90 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/crowdsec/+POST_INSTALL.post
-7
View File
@@ -1,10 +1,3 @@
#!/bin/sh
# the configuration file used in reconfigure (i.e. settings.json) may eventually
# have credentials, so we create a directory to contain it -- the directory
# permissions will be copied to the file while generating the jinja template.
# shellcheck disable=SC2174
mkdir -p -m 0700 /usr/local/etc/crowdsec/opnsense
configctl crowdsec reconfigure
security/crowdsec/+POST_INSTALL.pre
Executable
+10
View File
@@ -0,0 +1,10 @@
#!/bin/sh
# The configuration file used in reconfigure (i.e. settings.json) may eventually
# have credentials, so we need to restrict its permissions. We do so by pre-creating
# the directory, and the template package will use its permissions while creating the file.
# If we do that in setup.sh, the file already exists with bad permissions.
# shellcheck disable=SC2174
mkdir -p -m 0700 /usr/local/etc/crowdsec/opnsense
security/crowdsec/Makefile
+1 -3
View File
@@ -1,7 +1,5 @@
PLUGIN_NAME= crowdsec
PLUGIN_VERSION= 0.2
PLUGIN_DEVEL= yes
#PLUGIN_REVISION= 1
PLUGIN_VERSION= 1.0
PLUGIN_DEPENDS= crowdsec
PLUGIN_COMMENT= Lightweight and collaborative security engine
PLUGIN_MAINTAINER= marco@crowdsec.net
security/crowdsec/pkg-descr
+5
View File
@@ -8,6 +8,11 @@ WWW: https://crowdsec.net/
Plugin Changelog
================
1.0
* first non-devel release
* changed service restart to reload on hub update; fixed "service oscrowdsec status"
0.2
* first published release
security/crowdsec/src/etc/rc.d/oscrowdsec
+18 -21
View File
@@ -8,6 +8,7 @@
# BEFORE: DAEMON
# KEYWORD: shutdown
# shellcheck disable=SC1091
. /etc/rc.subr
name="oscrowdsec"
@@ -15,7 +16,7 @@ rcvar="oscrowdsec_enable"
load_rc_config $name
: ${oscrowdsec_enable="NO"}
: "${oscrowdsec_enable="NO"}"
oscrowdsec_start () {
@@ -36,13 +37,6 @@ oscrowdsec_start () {
else
service crowdsec_firewall stop || :
fi
# XXX should complain if they were not stopped?
# service crowdsec status
# if [ $? -eq 0 ]; then
# debug "oscrowdsec_start: crowdsec is still running"
# return 0
# fi
}
oscrowdsec_stop () {
@@ -50,8 +44,6 @@ oscrowdsec_stop () {
service crowdsec stop || :
service crowdsec_firewall stop || :
# XXX should complain if they were running and have not been stopped?
}
oscrowdsec_restart () {
@@ -61,23 +53,28 @@ oscrowdsec_restart () {
oscrowdsec_status () {
# return error if at least one program is not running
ret=0
service crowdsec status
ret=$?
if service crowdsec status; then
ret=$?
fi
if service crowdsec_firewall status; then
if [ $ret -eq 0 ]; then
ret=$?
fi
if ! service crowdsec_firewall status; then
ret=1
fi
return $ret
}
oscrowdsec_reload () {
# Here we take it easy. the bouncer does not even support reload
oscrowdsec_restart
if service crowdsec enabled; then
if service crowdsec status >/dev/null 2>&1; then
service crowdsec reload
else
service crowdsec restart
fi
fi
if service crowdsec_firewall enabled; then
# the bouncer does not support reload
service crowdsec_firewall restart
fi
}
case $1 in
security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml
+1 -1
View File
@@ -15,7 +15,7 @@
<label>Enable LAPI</label>
<type>checkbox</type>
<help>Enable/disable the CrowdSec Local API. Keep this enabled unless you
connect to a LAPI on another machine</help>
connect to a LAPI on another machine.</help>
</field>
<!-- firewall_bouncer_enabled -->
security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml
+1 -1
View File
@@ -1,7 +1,7 @@
<model>
<mount>//OPNsense/crowdsec/general</mount>
<description>CrowdSec general configuration</description>
<version>0.2</version>
<version>1.0</version>
<items>
<agent_enabled type="BooleanField">
security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt
+50 -6
View File
@@ -49,6 +49,8 @@
<div class="content-box tab-content">
<div id="introduction" class="tab-pane fade in active">
<h1>Introduction</h1>
<p>This plugin installs a CrowdSec agent/<a href="https://doc.crowdsec.net/docs/next/local_api/intro">LAPI</a>
node, and a <a href="https://docs.crowdsec.net/docs/bouncers/firewall/">Firewall Bouncer</a>.</p>
@@ -63,9 +65,16 @@
<a href="https://doc.crowdsec.net/docs/next/user_guides/multiserver_setup">any other agent</a>
connected to the same LAPI node. Other types of remediation are possible (ex. captcha test for scraping attempts).</p>
We recommend you to <a href="https://app.crowdsec.net/">register to the Console</a>. This helps you manage your instances,
and us to have better overall metrics.
<p>Please refer to the <a href="https://crowdsec.net/blog/category/tutorial/">tutorials</a> to explore
the possibilities.</p>
<p>For the latest plugin documentation, including how to use it with an external LAPI, see <a
href="https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_opnsense">Install
CrowdSec (OPNsense)</a></p>
<p>A few remarks:</p>
<ul>
@@ -85,8 +94,7 @@
like you would on vanilla freebsd, the plugin takes care of that.
</li>
<li>
The parsers, scenarios and all objects from the <a href="https://hub.crowdsec.net/">CrowdSec Hub</a>
are periodically upgraded. The
The parsers, scenarios and all plugins from the Hub are periodically upgraded. The
<a href="https://hub.crowdsec.net/author/crowdsecurity/collections/freebsd">crowdsecurity/freebsd</a> and
<a href="https://hub.crowdsec.net/author/crowdsecurity/collections/opnsense">crowdsecurity/opnsense</a>
collections are installed by default.
@@ -94,10 +102,7 @@
</ul>
<div>
<a class="btn btn-default btn-info" href="https://doc.crowdsec.net/">
crowdsec.net
</a>
<a class="btn btn-default btn-info" href="https://doc.crowdsec.net/">
<a class="btn btn-default btn-info" href="https://doc.crowdsec.net/docs/intro">
Documentation
</a>
<a class="btn btn-default btn-info" href="https://crowdsec.net/blog/">
@@ -111,6 +116,45 @@
</a>
</div>
<h1>Installation</h1>
<p>
On the Settings tab, you can expose CrowdSec to the LAN for other servers by changing `LAPI listen address`.
Otherwise, leave the defualt value.
</p>
<p>
Select the first three checkboxes: IDS, LAPI and IPS. Click Apply. If you need to restart, you can do so
from the <a href="/status_services.php">System > Diagnostics > Services</a> page.
</p>
<h1>Test the plugin</h1>
<p>
A quick way to test that everything is working correctly is to
execute the following command.
</p>
<p>
Your ssh session should freeze and you should be kicked out from
the firewall. You will not be able to connect to it (from the same
IP address) for two minutes.
</p>
<p>
It might be a good idea to have a secondary IP from which you can
connect, should anything go wrong.
</p>
<pre><code>[root@OPNsense ~]# cscli decisions add -t ban -d 2m -i </code></pre>
<p>
This is a more secure way to test than attempting to brute-force
yourself: the default ban period is 4 hours, and Crowdsec reads the
logs from the beginning, so it could ban you even if you failed ssh
login 10 times in 30 seconds two hours before installing it.
</p>
<div>
<a class="btn btn-default btn-info" href="https://github.com/crowdsecurity/crowdsec">
GitHub
security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh
+4 -5
View File
@@ -1,17 +1,16 @@
#!/bin/sh
/usr/local/bin/cscli --error hub update \
&& /usr/local/bin/cscli --error hub upgrade
if [ ! -e "/usr/local/etc/crowdsec/collections/opnsense.yaml" ]; then
/usr/local/bin/cscli --error collections install crowdsecurity/opnsense
fi
/usr/local/bin/cscli --error hub update \
&& /usr/local/bin/cscli --error hub upgrade
if service crowdsec enabled; then
# have to check status explicitly because "restart" can set $? = 0 even when failing
if ! service crowdsec status >/dev/null 2>&1; then
service crowdsec start >/dev/null 2>&1 || :
else
service crowdsec restart >/dev/null 2>&1 || :
service crowdsec reload >/dev/null 2>&1 || :
fi
fi