From a427756cf2092a30d67d9d843a45bc8420848088 Mon Sep 17 00:00:00 2001 From: mmetc <92726601+mmetc@users.noreply.github.com> Date: Wed, 13 Jul 2022 15:20:24 +0200 Subject: [PATCH] security/crowdsec: v1.0 (#3030) --- security/crowdsec/+POST_INSTALL.post | 7 --- security/crowdsec/+POST_INSTALL.pre | 10 ++++ security/crowdsec/Makefile | 4 +- security/crowdsec/pkg-descr | 5 ++ security/crowdsec/src/etc/rc.d/oscrowdsec | 39 ++++++------- .../OPNsense/CrowdSec/forms/general.xml | 2 +- .../app/models/OPNsense/CrowdSec/General.xml | 2 +- .../app/views/OPNsense/CrowdSec/general.volt | 56 +++++++++++++++++-- .../scripts/OPNsense/CrowdSec/hub-upgrade.sh | 9 ++- 9 files changed, 90 insertions(+), 44 deletions(-) create mode 100755 security/crowdsec/+POST_INSTALL.pre diff --git a/security/crowdsec/+POST_INSTALL.post b/security/crowdsec/+POST_INSTALL.post index 0c4a006aa..4c5abec40 100755 --- a/security/crowdsec/+POST_INSTALL.post +++ b/security/crowdsec/+POST_INSTALL.post @@ -1,10 +1,3 @@ #!/bin/sh -# the configuration file used in reconfigure (i.e. settings.json) may eventually -# have credentials, so we create a directory to contain it -- the directory -# permissions will be copied to the file while generating the jinja template. - -# shellcheck disable=SC2174 -mkdir -p -m 0700 /usr/local/etc/crowdsec/opnsense - configctl crowdsec reconfigure diff --git a/security/crowdsec/+POST_INSTALL.pre b/security/crowdsec/+POST_INSTALL.pre new file mode 100755 index 000000000..e43e48143 --- /dev/null +++ b/security/crowdsec/+POST_INSTALL.pre @@ -0,0 +1,10 @@ +#!/bin/sh + +# The configuration file used in reconfigure (i.e. settings.json) may eventually +# have credentials, so we need to restrict its permissions. We do so by pre-creating +# the directory, and the template package will use its permissions while creating the file. +# If we do that in setup.sh, the file already exists with bad permissions. + +# shellcheck disable=SC2174 +mkdir -p -m 0700 /usr/local/etc/crowdsec/opnsense + diff --git a/security/crowdsec/Makefile b/security/crowdsec/Makefile index fb0653f19..20e019df1 100644 --- a/security/crowdsec/Makefile +++ b/security/crowdsec/Makefile @@ -1,7 +1,5 @@ PLUGIN_NAME= crowdsec -PLUGIN_VERSION= 0.2 -PLUGIN_DEVEL= yes -#PLUGIN_REVISION= 1 +PLUGIN_VERSION= 1.0 PLUGIN_DEPENDS= crowdsec PLUGIN_COMMENT= Lightweight and collaborative security engine PLUGIN_MAINTAINER= marco@crowdsec.net diff --git a/security/crowdsec/pkg-descr b/security/crowdsec/pkg-descr index cc35c3abe..e7b571f60 100644 --- a/security/crowdsec/pkg-descr +++ b/security/crowdsec/pkg-descr @@ -8,6 +8,11 @@ WWW: https://crowdsec.net/ Plugin Changelog ================ +1.0 + +* first non-devel release +* changed service restart to reload on hub update; fixed "service oscrowdsec status" + 0.2 * first published release diff --git a/security/crowdsec/src/etc/rc.d/oscrowdsec b/security/crowdsec/src/etc/rc.d/oscrowdsec index a64dc0d38..04a7e8c7b 100755 --- a/security/crowdsec/src/etc/rc.d/oscrowdsec +++ b/security/crowdsec/src/etc/rc.d/oscrowdsec @@ -8,6 +8,7 @@ # BEFORE: DAEMON # KEYWORD: shutdown +# shellcheck disable=SC1091 . /etc/rc.subr name="oscrowdsec" @@ -15,7 +16,7 @@ rcvar="oscrowdsec_enable" load_rc_config $name -: ${oscrowdsec_enable="NO"} +: "${oscrowdsec_enable="NO"}" oscrowdsec_start () { @@ -36,13 +37,6 @@ oscrowdsec_start () { else service crowdsec_firewall stop || : fi - -# XXX should complain if they were not stopped? -# service crowdsec status -# if [ $? -eq 0 ]; then -# debug "oscrowdsec_start: crowdsec is still running" -# return 0 -# fi } oscrowdsec_stop () { @@ -50,8 +44,6 @@ oscrowdsec_stop () { service crowdsec stop || : service crowdsec_firewall stop || : - - # XXX should complain if they were running and have not been stopped? } oscrowdsec_restart () { @@ -61,23 +53,28 @@ oscrowdsec_restart () { oscrowdsec_status () { # return error if at least one program is not running - ret=0 + service crowdsec status + ret=$? - if service crowdsec status; then - ret=$? - fi - - if service crowdsec_firewall status; then - if [ $ret -eq 0 ]; then - ret=$? - fi + if ! service crowdsec_firewall status; then + ret=1 fi return $ret } oscrowdsec_reload () { - # Here we take it easy. the bouncer does not even support reload - oscrowdsec_restart + if service crowdsec enabled; then + if service crowdsec status >/dev/null 2>&1; then + service crowdsec reload + else + service crowdsec restart + fi + fi + + if service crowdsec_firewall enabled; then + # the bouncer does not support reload + service crowdsec_firewall restart + fi } case $1 in diff --git a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml index 596c3b3e9..f154c544a 100644 --- a/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml +++ b/security/crowdsec/src/opnsense/mvc/app/controllers/OPNsense/CrowdSec/forms/general.xml @@ -15,7 +15,7 @@ checkbox Enable/disable the CrowdSec Local API. Keep this enabled unless you - connect to a LAPI on another machine + connect to a LAPI on another machine. diff --git a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml index 16d3b3632..d71245d0d 100644 --- a/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml +++ b/security/crowdsec/src/opnsense/mvc/app/models/OPNsense/CrowdSec/General.xml @@ -1,7 +1,7 @@ //OPNsense/crowdsec/general CrowdSec general configuration - 0.2 + 1.0 diff --git a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt index 4952bfb18..3a91e9ade 100644 --- a/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt +++ b/security/crowdsec/src/opnsense/mvc/app/views/OPNsense/CrowdSec/general.volt @@ -49,6 +49,8 @@
+

Introduction

+

This plugin installs a CrowdSec agent/LAPI node, and a Firewall Bouncer.

@@ -63,9 +65,16 @@ any other agent connected to the same LAPI node. Other types of remediation are possible (ex. captcha test for scraping attempts).

+ We recommend you to register to the Console. This helps you manage your instances, + and us to have better overall metrics. +

Please refer to the tutorials to explore the possibilities.

+

For the latest plugin documentation, including how to use it with an external LAPI, see Install + CrowdSec (OPNsense)

+

A few remarks:

    @@ -85,8 +94,7 @@ like you would on vanilla freebsd, the plugin takes care of that.
  • - The parsers, scenarios and all objects from the CrowdSec Hub - are periodically upgraded. The + The parsers, scenarios and all plugins from the Hub are periodically upgraded. The crowdsecurity/freebsd and crowdsecurity/opnsense collections are installed by default. @@ -94,10 +102,7 @@
+

Installation

+ +

+ On the Settings tab, you can expose CrowdSec to the LAN for other servers by changing `LAPI listen address`. + Otherwise, leave the defualt value. +

+ +

+ Select the first three checkboxes: IDS, LAPI and IPS. Click Apply. If you need to restart, you can do so + from the System > Diagnostics > Services page. +

+ +

Test the plugin

+ +

+ A quick way to test that everything is working correctly is to + execute the following command. +

+ +

+ Your ssh session should freeze and you should be kicked out from + the firewall. You will not be able to connect to it (from the same + IP address) for two minutes. +

+ +

+ It might be a good idea to have a secondary IP from which you can + connect, should anything go wrong. +

+ + 
[root@OPNsense ~]# cscli decisions add -t ban -d 2m -i
+ +

+ This is a more secure way to test than attempting to brute-force + yourself: the default ban period is 4 hours, and Crowdsec reads the + logs from the beginning, so it could ban you even if you failed ssh + login 10 times in 30 seconds two hours before installing it. +

+
GitHub diff --git a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh index b57e86bb1..7b14772a9 100755 --- a/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh +++ b/security/crowdsec/src/opnsense/scripts/OPNsense/CrowdSec/hub-upgrade.sh @@ -1,17 +1,16 @@ #!/bin/sh +/usr/local/bin/cscli --error hub update \ + && /usr/local/bin/cscli --error hub upgrade + if [ ! -e "/usr/local/etc/crowdsec/collections/opnsense.yaml" ]; then /usr/local/bin/cscli --error collections install crowdsecurity/opnsense fi -/usr/local/bin/cscli --error hub update \ - && /usr/local/bin/cscli --error hub upgrade - if service crowdsec enabled; then - # have to check status explicitly because "restart" can set $? = 0 even when failing if ! service crowdsec status >/dev/null 2>&1; then service crowdsec start >/dev/null 2>&1 || : else - service crowdsec restart >/dev/null 2>&1 || : + service crowdsec reload >/dev/null 2>&1 || : fi fi