chore: add crowdsec

2026-06-15 14:46:02 +02:00
parent d552798934
commit bcdee141c1
7 changed files with 224 additions and 278 deletions
@@ -1,22 +0,0 @@
-# Logs nginx depuis le container Docker
-source: docker
-container_name:
-  - monitoring_nginx
-labels:
-  type: nginx
-
---
-# Logs SSH du VPS hôte
-source: file
-filenames:
-  - /var/log/auth.log
-labels:
-  type: syslog
-
---
-# Logs système du VPS hôte
-source: file
-filenames:
-  - /var/log/syslog
-labels:
-  type: syslog
@@ -0,0 +1,16 @@
+mode: iptables
+update_frequency: 10s
+log_mode: stdout
+log_level: info
+api_url: http://127.0.0.1:7777
+api_key: monitoring-bouncer-key-2026
+insecure_skip_verify: false
+disable_ipv6: false
+deny_action: DROP
+deny_log: false
+supported_decisions_types:
+  - ban
+iptables_chains:
+  - INPUT
+  - FORWARD
+  - DOCKER-USER
@@ -18,10 +18,11 @@ services:
        container_name: monitoring_nginx
        restart: unless-stopped
        ports:
-            - "80:80"
-            - "443:443"
-            - "8080:8080"
-            - "8090:8090"
+            - "10.0.0.2:80:80"
+            - "10.0.0.2:443:443"
+            - "10.0.0.2:8080:8080"
+            - "10.0.0.2:8090:8090"
+            - "10.0.0.2:3001:3001"
        volumes:
            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
            - ./nginx/certs:/etc/nginx/certs:ro
@@ -101,6 +102,9 @@ services:
            - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
            - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
            - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+            - crowdsec_logs:/var/log/crowdsec:ro
+            - /var/run/docker.sock:/var/run/docker.sock
+            - /usr/bin/docker:/usr/local/bin/docker:ro
        networks:
            - monitoring_net

@@ -156,6 +160,49 @@ services:
            - wazuh.manager
        networks:
            - monitoring_net
+    uptime-kuma:
+        image: louislam/uptime-kuma:1
+        container_name: uptime-kuma
+        restart: unless-stopped
+        volumes:
+            - uptime_kuma_data:/app/data
+        networks:
+            - monitoring_net
+
+
+    # ─── CrowdSec LAPI ────────────────────────────────────────
+    crowdsec:
+        image: crowdsecurity/crowdsec:latest
+        container_name: crowdsec
+        restart: unless-stopped
+        environment:
+            COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd"
+            GID: "0"
+        volumes:
+            - /var/log:/var/log/host:ro
+            - nginx_logs:/var/log/nginx:ro
+            - crowdsec_data:/var/lib/crowdsec/data
+            - crowdsec_config:/etc/crowdsec
+            - crowdsec_logs:/var/log/crowdsec
+        ports:
+            - "127.0.0.1:7777:8080"
+            - "10.0.0.2:8081:8080"
+        networks:
+            - monitoring_net
+
+    # ─── CrowdSec Firewall Bouncer ────────────────────────────
+    crowdsec-bouncer:
+        image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest
+        container_name: crowdsec-bouncer
+        restart: unless-stopped
+        network_mode: host
+        cap_add:
+            - NET_ADMIN
+            - NET_RAW
+        volumes:
+            - ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro
+        depends_on:
+            - crowdsec
 networks:
    monitoring_net:
        driver: bridge
@@ -177,3 +224,7 @@ volumes:
    beszel_data:
    clamav_data:
    clamav_logs:
+    crowdsec_data:
+    crowdsec_config:
+    crowdsec_logs:
+    uptime_kuma_data:
@@ -0,0 +1,57 @@
+#!/bin/bash
+# Wazuh Active Response -> CrowdSec ban
+
+read INPUT
+
+SRC_IP=$(echo "$INPUT" | python3 -c "
+import sys, json, re
+try:
+    d = json.load(sys.stdin)
+    alert = d.get('parameters', {}).get('alert', {})
+    data = alert.get('data', {})
+    # 1. Try standard srcip field
+    ip = data.get('srcip') or data.get('src_ip') or ''
+    # 2. Fallback: extract first public IP from full_log
+    if not ip:
+        full_log = alert.get('full_log', '')
+        ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log)
+        private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)')
+        for candidate in ips:
+            if not private.match(candidate):
+                ip = candidate
+                break
+    print(ip)
+except:
+    print('')
+" 2>/dev/null)
+
+ACTION=$(echo "$INPUT" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get('command', 'add'))
+except:
+    print('add')
+" 2>/dev/null)
+
+LOG=/var/ossec/logs/active-responses.log
+
+if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then
+    echo "$(date) crowdsec-ban: no IP found" >> "$LOG"
+    exit 0
+fi
+
+# Ne pas bannir les IPs privees / VPN
+if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then
+    echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG"
+    exit 0
+fi
+
+if [ "$ACTION" = "delete" ]; then
+    /usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null
+    echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG"
+else
+    /usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \
+        --duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG"
+    echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG"
+fi
@@ -0,0 +1,24 @@
+<!-- CrowdSec Decoders — format logrus key=value -->
+<decoder name="crowdsec">
+  <prematch>^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d</prematch>
+</decoder>
+
+<decoder name="crowdsec-fields">
+  <parent>crowdsec</parent>
+  <regex>level=(\S+) msg="(\.+)"</regex>
+  <order>status,extra_data</order>
+</decoder>
+
+<decoder name="crowdsec-ban">
+  <parent>crowdsec</parent>
+  <prematch>ban Ip |ban ip |type":"ban</prematch>
+  <regex>(\d+\.\d+\.\d+\.\d+)</regex>
+  <order>srcip</order>
+</decoder>
+
+<decoder name="crowdsec-overflow">
+  <parent>crowdsec</parent>
+  <prematch>overflow from |triggered |New overflow</prematch>
+  <regex>'(\d+\.\d+\.\d+\.\d+)'</regex>
+  <order>srcip</order>
+</decoder>
@@ -517,138 +517,6 @@
    <timeout>21600</timeout>
  </active-response>

-  <!-- ═══════════════════════════════════════════════════════════
-       OWASP — Remontées (non-bloquées, anomaly scoring)
-       ═══════════════════════════════════════════════════════════ -->
-
-  <!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h (soft) -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100320</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100394</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100321</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#3 Command Injection anomaly CRITICAL (100396) → permanent ban -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100396</rules_id>
-    <timeout>0</timeout>
-  </active-response>
-
-  <!-- OWASP#3 LDAP/PHP/Java remontées (100322, 100323) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100322,100323</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#6 RCE/Exploit remontée (100330) → firewall-drop 6h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100330</rules_id>
-    <timeout>21600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100340</rules_id>
-    <timeout>3600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100395</rules_id>
-    <timeout>21600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 Header Injection remontée (100341) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100341</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#1 Path Traversal remontée (100350) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100350</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#1 RFI remontée (100351) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100351</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#1 File Access remontée (100352) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100352</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#8 XXE remontée (100360) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100360</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#9 Scanner remontée (100370) → firewall-drop 30min -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100370</rules_id>
-    <timeout>1800</timeout>
-  </active-response>
-
-  <!-- OWASP SSRF remontée (100380) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100380</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP File Upload remontée (100381) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>local</location>
-    <rules_id>100381</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
  <active-response>
    <disabled>no</disabled>
    <command>host-deny</command>
@@ -892,137 +760,47 @@
    <timeout>21600</timeout>
  </active-response>

-  <!-- ═══════════════════════════════════════════════════════════
-       OWASP — Remontées (location=all)
-       ═══════════════════════════════════════════════════════════ -->
+  <!-- ════════════════════════════════════════════════════════════
+       CROWDSEC ACTIVE RESPONSE
+       ════════════════════════════════════════════════════════════ -->
+  <command>
+    <name>crowdsec-ban</name>
+    <executable>crowdsec-ban.sh</executable>
+    <timeout_allowed>yes</timeout_allowed>
+  </command>

-  <!-- OWASP#3 SQLi remontée (100320) → firewall-drop 2h -->
+  <!-- SSH Brute Force → CrowdSec ban 24h -->
  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100320</rules_id>
-    <timeout>7200</timeout>
+    <command>crowdsec-ban</command>
+    <location>local</location>
+    <rules_id>5712,5720,5763</rules_id>
+    <timeout>86400</timeout>
  </active-response>

-  <!-- OWASP#3 SQLi anomaly (100394) → firewall-drop 4h -->
+  <!-- Attaques web WAF/OWASP → CrowdSec ban 12h -->
  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100394</rules_id>
-    <timeout>14400</timeout>
+    <command>crowdsec-ban</command>
+    <location>local</location>
+    <rules_id>100270,100280,100281</rules_id>
+    <timeout>43200</timeout>
  </active-response>

-  <!-- OWASP#3 Command Injection remontée (100321) → firewall-drop 4h -->
+  <!-- CrowdSec ban détecté dans ses propres logs → ban 24h -->
  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100321</rules_id>
-    <timeout>14400</timeout>
+    <command>crowdsec-ban</command>
+    <location>local</location>
+    <rules_id>100501,100502</rules_id>
+    <timeout>86400</timeout>
  </active-response>

-  <!-- OWASP#3 Command Injection CRITICAL (100396) → permanent -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100396</rules_id>
-    <timeout>0</timeout>
-  </active-response>
+  <!-- ════════════════════════════════════════════════════════════
+       CROWDSEC LOG MONITORING
+       ════════════════════════════════════════════════════════════ -->
+  <localfile>
+    <log_format>syslog</log_format>
+    <location>/var/log/crowdsec/crowdsec.log</location>
+  </localfile>

-  <!-- OWASP#3 LDAP/PHP/Java (100322, 100323) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100322,100323</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#6 RCE/Exploit (100330) → firewall-drop 6h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100330</rules_id>
-    <timeout>21600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 XSS remontée (100340) → firewall-drop 1h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100340</rules_id>
-    <timeout>3600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 XSS anomaly (100395) → firewall-drop 6h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100395</rules_id>
-    <timeout>21600</timeout>
-  </active-response>
-
-  <!-- OWASP#7 Header Injection (100341) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100341</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#1 Path Traversal (100350) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100350</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#1 RFI (100351) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100351</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#1 File Access (100352) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100352</rules_id>
-    <timeout>7200</timeout>
-  </active-response>
-
-  <!-- OWASP#8 XXE (100360) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100360</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP#9 Scanner (100370) → firewall-drop 30min -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100370</rules_id>
-    <timeout>1800</timeout>
-  </active-response>
-
-  <!-- OWASP SSRF (100380) → firewall-drop 4h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100380</rules_id>
-    <timeout>14400</timeout>
-  </active-response>
-
-  <!-- OWASP File Upload (100381) → firewall-drop 2h -->
-  <active-response>
-    <command>firewall-drop</command>
-    <location>all</location>
-    <rules_id>100381</rules_id>
-    <timeout>7200</timeout>
-  </active-response>

  <!-- ═══════════════════════════════════════════════════════════
       LOG ANALYSIS (commandes système)
@@ -0,0 +1,42 @@
+<!-- CrowdSec Rules — IDs 100500-100509 -->
+<group name="crowdsec,">
+
+  <!-- Base: logs CrowdSec/logrus (pattern simple, sans \d) -->
+  <rule id="100500" level="3">
+    <location>/var/log/crowdsec/crowdsec.log</location>
+    <description>CrowdSec: event logged</description>
+  </rule>
+
+  <!-- IP bannie par CrowdSec -->
+  <rule id="100501" level="10">
+    <if_sid>100500</if_sid>
+    <match>ban Ip |ban ip | ban on Ip |Ip ban</match>
+    <description>CrowdSec: IP banned by decision engine</description>
+    <group>crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d,</group>
+  </rule>
+
+  <!-- Nouvelle attaque detectee -->
+  <rule id="100502" level="8">
+    <if_sid>100500</if_sid>
+    <match>overflow from |triggered |New overflow|crowdsecurity/</match>
+    <description>CrowdSec: Attack scenario detected</description>
+    <group>crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d,</group>
+  </rule>
+
+  <!-- Erreur CrowdSec -->
+  <rule id="100503" level="7">
+    <if_sid>100500</if_sid>
+    <match>level=error</match>
+    <description>CrowdSec: Error logged</description>
+    <group>crowdsec_error,</group>
+  </rule>
+
+  <!-- Erreur critique CrowdSec -->
+  <rule id="100504" level="12">
+    <if_sid>100500</if_sid>
+    <match>level=fatal|level=panic</match>
+    <description>CrowdSec: Critical error — service may be down</description>
+    <group>crowdsec_error,</group>
+  </rule>
+
+</group>