Installing and configuring CrowdSec

1. Installing #

Linux packages or Docker.

On Linux #

curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec

sudo systemctl status crowdsec
sudo cscli version
sudo cscli collections list
sudo cscli lapi status
sudo cscli capi status

During installation, CrowdSec detects the services present and installs the matching collections. Read the script before running it if your security policy requires it.

Docker #

services:
  crowdsec:
    image: crowdsecurity/crowdsec:v1.8.2
    restart: unless-stopped
    environment:
      COLLECTIONS: "crowdsecurity/linux crowdsecurity/traefik"
      TZ: Europe/Paris
    volumes:
      - ./acquis.d:/etc/crowdsec/acquis.d:ro
      - crowdsec-config:/etc/crowdsec
      - crowdsec-data:/var/lib/crowdsec/data   # mandatory: without this volume, the container refuses to start
      - /var/log/auth.log:/logs/auth.log:ro
volumes:
  crowdsec-config:
  crowdsec-data:

Declare logs in ./acquis.d/ssh.yaml. The path is the one seen inside the container:

filenames:
  - /logs/auth.log
labels:
  type: syslog

docker compose up -d
docker compose exec crowdsec cscli collections list
docker compose exec crowdsec cscli metrics

2. The files #

Where each setting lives.

The tree #

/etc/crowdsec/
├── config.yaml                  # general configuration
├── acquis.yaml et acquis.d/     # which logs to read
├── profiles.yaml                # from alert to decision
├── simulation.yaml              # scenarios in simulation
├── parsers/ scenarios/ collections/ postoverflows/
├── notifications/               # slack.yaml, email.yaml, http.yaml…
├── bouncers/                    # bouncer configuration
├── local_api_credentials.yaml   # LAPI access
└── online_api_credentials.yaml  # CAPI access
/var/lib/crowdsec/data/crowdsec.db  # default SQLite database
/var/log/crowdsec.log and /var/log/crowdsec_api.log

After a change, reload the service: sudo systemctl reload crowdsec.

Declaring logs: acquisition #

Acquisition says which logs to read and with which parser. Prefer one file per source in /etc/crowdsec/acquis.d/.

filenames:
  - /var/log/auth.log
labels:
  type: syslog

The labels.type field points to the right parser. Use syslog for logs in syslog format, otherwise the type stated by the collection (nginx, traefik…). Other sources exist: journalctl, docker, kubernetes, syslog, loki, kafka.

Always check. An undeclared log produces no error: it is simply never analyzed. Check with cscli metrics show acquisition. CrowdSec reads new lines: what existed before startup is not analyzed.

3. Console and several servers #

Supervise and share decisions.

The console #

The app.crowdsec.net console offers a web view of your instances. Get a key from the console, then:

sudo cscli console enroll VOTRE_CLE
# Acceptez l'instance dans la console, puis :
sudo systemctl reload crowdsec

One LAPI for several servers #

On each agent, register with the LAPI, then validate the machine on the LAPI side:

# Sur l'agent
sudo cscli lapi register --url http://10.0.0.10:8080

# Sur le serveur LAPI
sudo cscli machines list
sudo cscli machines validate NOM_DE_LA_MACHINE

On the agent, then disable the local LAPI (api.server.enable: false in config.yaml). For large volumes, replace SQLite with PostgreSQL or MySQL.

Sources #

• CrowdSec : Linux
• CrowdSec : image Docker