From bcdee141c1fd0eb6ce7abbfa7285f7546a27c9c9 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Mon, 15 Jun 2026 14:46:02 +0200 Subject: [PATCH] chore: add crowdsec --- monitoring/crowdsec/acquis.yaml | 22 -- .../security/crowdsec/bouncer-monitoring.yaml | 16 + .../security/docker-compose-security.yml | 59 +++- .../wazuh/active-response/crowdsec-ban.sh | 57 ++++ .../decoders/crowdsec-decoder.xml | 24 ++ .../wazuh/config/wazuh_manager/ossec.conf | 282 ++---------------- .../wazuh_manager/rules/crowdsec-rules.xml | 42 +++ 7 files changed, 224 insertions(+), 278 deletions(-) delete mode 100644 monitoring/crowdsec/acquis.yaml create mode 100644 monitoring/security/crowdsec/bouncer-monitoring.yaml create mode 100755 monitoring/security/wazuh/active-response/crowdsec-ban.sh create mode 100644 monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml create mode 100644 monitoring/security/wazuh/config/wazuh_manager/rules/crowdsec-rules.xml diff --git a/monitoring/crowdsec/acquis.yaml b/monitoring/crowdsec/acquis.yaml deleted file mode 100644 index a54e4da8..00000000 --- a/monitoring/crowdsec/acquis.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Logs nginx depuis le container Docker -source: docker -container_name: - - monitoring_nginx -labels: - type: nginx - ---- -# Logs SSH du VPS hôte -source: file -filenames: - - /var/log/auth.log -labels: - type: syslog - ---- -# Logs système du VPS hôte -source: file -filenames: - - /var/log/syslog -labels: - type: syslog diff --git a/monitoring/security/crowdsec/bouncer-monitoring.yaml b/monitoring/security/crowdsec/bouncer-monitoring.yaml new file mode 100644 index 00000000..f53ac873 --- /dev/null +++ b/monitoring/security/crowdsec/bouncer-monitoring.yaml @@ -0,0 +1,16 @@ +mode: iptables +update_frequency: 10s +log_mode: stdout +log_level: info +api_url: http://127.0.0.1:7777 +api_key: monitoring-bouncer-key-2026 +insecure_skip_verify: false +disable_ipv6: false +deny_action: DROP +deny_log: false +supported_decisions_types: + - ban +iptables_chains: + - INPUT + - FORWARD + - DOCKER-USER diff --git a/monitoring/security/docker-compose-security.yml b/monitoring/security/docker-compose-security.yml index fbb0f397..7fdd3cd7 100755 --- a/monitoring/security/docker-compose-security.yml +++ b/monitoring/security/docker-compose-security.yml @@ -18,10 +18,11 @@ services: container_name: monitoring_nginx restart: unless-stopped ports: - - "80:80" - - "443:443" - - "8080:8080" - - "8090:8090" + - "10.0.0.2:80:80" + - "10.0.0.2:443:443" + - "10.0.0.2:8080:8080" + - "10.0.0.2:8090:8090" + - "10.0.0.2:3001:3001" volumes: - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro - ./nginx/certs:/etc/nginx/certs:ro @@ -101,6 +102,9 @@ services: - ./wazuh/certs/root-ca-manager.pem:/etc/ssl/root-ca.pem - ./wazuh/certs/wazuh.manager.pem:/etc/ssl/filebeat.pem - ./wazuh/certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key + - crowdsec_logs:/var/log/crowdsec:ro + - /var/run/docker.sock:/var/run/docker.sock + - /usr/bin/docker:/usr/local/bin/docker:ro networks: - monitoring_net @@ -156,6 +160,49 @@ services: - wazuh.manager networks: - monitoring_net + uptime-kuma: + image: louislam/uptime-kuma:1 + container_name: uptime-kuma + restart: unless-stopped + volumes: + - uptime_kuma_data:/app/data + networks: + - monitoring_net + + + # ─── CrowdSec LAPI ──────────────────────────────────────── + crowdsec: + image: crowdsecurity/crowdsec:latest + container_name: crowdsec + restart: unless-stopped + environment: + COLLECTIONS: "crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd" + GID: "0" + volumes: + - /var/log:/var/log/host:ro + - nginx_logs:/var/log/nginx:ro + - crowdsec_data:/var/lib/crowdsec/data + - crowdsec_config:/etc/crowdsec + - crowdsec_logs:/var/log/crowdsec + ports: + - "127.0.0.1:7777:8080" + - "10.0.0.2:8081:8080" + networks: + - monitoring_net + + # ─── CrowdSec Firewall Bouncer ──────────────────────────── + crowdsec-bouncer: + image: ghcr.io/crowdsecurity/cs-firewall-bouncer:latest + container_name: crowdsec-bouncer + restart: unless-stopped + network_mode: host + cap_add: + - NET_ADMIN + - NET_RAW + volumes: + - ./crowdsec/bouncer-monitoring.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml:ro + depends_on: + - crowdsec networks: monitoring_net: driver: bridge @@ -177,3 +224,7 @@ volumes: beszel_data: clamav_data: clamav_logs: + crowdsec_data: + crowdsec_config: + crowdsec_logs: + uptime_kuma_data: diff --git a/monitoring/security/wazuh/active-response/crowdsec-ban.sh b/monitoring/security/wazuh/active-response/crowdsec-ban.sh new file mode 100755 index 00000000..cedb2c99 --- /dev/null +++ b/monitoring/security/wazuh/active-response/crowdsec-ban.sh @@ -0,0 +1,57 @@ +#!/bin/bash +# Wazuh Active Response -> CrowdSec ban + +read INPUT + +SRC_IP=$(echo "$INPUT" | python3 -c " +import sys, json, re +try: + d = json.load(sys.stdin) + alert = d.get('parameters', {}).get('alert', {}) + data = alert.get('data', {}) + # 1. Try standard srcip field + ip = data.get('srcip') or data.get('src_ip') or '' + # 2. Fallback: extract first public IP from full_log + if not ip: + full_log = alert.get('full_log', '') + ips = re.findall(r'\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b', full_log) + private = re.compile(r'^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)') + for candidate in ips: + if not private.match(candidate): + ip = candidate + break + print(ip) +except: + print('') +" 2>/dev/null) + +ACTION=$(echo "$INPUT" | python3 -c " +import sys, json +try: + d = json.load(sys.stdin) + print(d.get('command', 'add')) +except: + print('add') +" 2>/dev/null) + +LOG=/var/ossec/logs/active-responses.log + +if [ -z "$SRC_IP" ] || [ "$SRC_IP" = "null" ]; then + echo "$(date) crowdsec-ban: no IP found" >> "$LOG" + exit 0 +fi + +# Ne pas bannir les IPs privees / VPN +if echo "$SRC_IP" | grep -qE '^10\.|^192\.168\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^127\.'; then + echo "$(date) crowdsec-ban: skip private IP $SRC_IP" >> "$LOG" + exit 0 +fi + +if [ "$ACTION" = "delete" ]; then + /usr/local/bin/docker exec crowdsec cscli decisions delete --ip "$SRC_IP" 2>/dev/null + echo "$(date) crowdsec-ban: UNBAN $SRC_IP" >> "$LOG" +else + /usr/local/bin/docker exec crowdsec cscli decisions add --ip "$SRC_IP" \ + --duration 24h --reason Wazuh-ActiveResponse --type ban 2>&1 >> "$LOG" + echo "$(date) crowdsec-ban: BAN $SRC_IP" >> "$LOG" +fi diff --git a/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml b/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml new file mode 100644 index 00000000..a3236de3 --- /dev/null +++ b/monitoring/security/wazuh/config/wazuh_manager/decoders/crowdsec-decoder.xml @@ -0,0 +1,24 @@ + + + ^time="20\d\d-\d\d-\d\dT\d\d:\d\d:\d\d + + + + crowdsec + level=(\S+) msg="(\.+)" + status,extra_data + + + + crowdsec + ban Ip |ban ip |type":"ban + (\d+\.\d+\.\d+\.\d+) + srcip + + + + crowdsec + overflow from |triggered |New overflow + '(\d+\.\d+\.\d+\.\d+)' + srcip + diff --git a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf index 11c09c9f..49fb55d2 100755 --- a/monitoring/security/wazuh/config/wazuh_manager/ossec.conf +++ b/monitoring/security/wazuh/config/wazuh_manager/ossec.conf @@ -517,138 +517,6 @@ 21600 - - - - - firewall-drop - local - 100320 - 7200 - - - - - firewall-drop - local - 100394 - 14400 - - - - - firewall-drop - local - 100321 - 14400 - - - - - firewall-drop - local - 100396 - 0 - - - - - firewall-drop - local - 100322,100323 - 7200 - - - - - firewall-drop - local - 100330 - 21600 - - - - - firewall-drop - local - 100340 - 3600 - - - - - firewall-drop - local - 100395 - 21600 - - - - - firewall-drop - local - 100341 - 7200 - - - - - firewall-drop - local - 100350 - 7200 - - - - - firewall-drop - local - 100351 - 14400 - - - - - firewall-drop - local - 100352 - 7200 - - - - - firewall-drop - local - 100360 - 14400 - - - - - firewall-drop - local - 100370 - 1800 - - - - - firewall-drop - local - 100380 - 14400 - - - - - firewall-drop - local - 100381 - 7200 - - no host-deny @@ -892,137 +760,47 @@ 21600 - + + + crowdsec-ban + crowdsec-ban.sh + yes + - + - firewall-drop - all - 100320 - 7200 + crowdsec-ban + local + 5712,5720,5763 + 86400 - + - firewall-drop - all - 100394 - 14400 + crowdsec-ban + local + 100270,100280,100281 + 43200 - + - firewall-drop - all - 100321 - 14400 + crowdsec-ban + local + 100501,100502 + 86400 - - - firewall-drop - all - 100396 - 0 - + + + syslog + /var/log/crowdsec/crowdsec.log + - - - firewall-drop - all - 100322,100323 - 7200 - - - - - firewall-drop - all - 100330 - 21600 - - - - - firewall-drop - all - 100340 - 3600 - - - - - firewall-drop - all - 100395 - 21600 - - - - - firewall-drop - all - 100341 - 7200 - - - - - firewall-drop - all - 100350 - 7200 - - - - - firewall-drop - all - 100351 - 14400 - - - - - firewall-drop - all - 100352 - 7200 - - - - - firewall-drop - all - 100360 - 14400 - - - - - firewall-drop - all - 100370 - 1800 - - - - - firewall-drop - all - 100380 - 14400 - - - - - firewall-drop - all - 100381 - 7200 - + + + + + /var/log/crowdsec/crowdsec.log + CrowdSec: event logged + + + + + 100500 + ban Ip |ban ip | ban on Ip |Ip ban + CrowdSec: IP banned by decision engine + crowdsec_ban,pci_dss_10.6.1,gdpr_IV_35.7.d, + + + + + 100500 + overflow from |triggered |New overflow|crowdsecurity/ + CrowdSec: Attack scenario detected + crowdsec_alert,pci_dss_11.4,gdpr_IV_35.7.d, + + + + + 100500 + level=error + CrowdSec: Error logged + crowdsec_error, + + + + + 100500 + level=fatal|level=panic + CrowdSec: Critical error — service may be down + crowdsec_error, + + +