Lab 1: Install CrowdSec and detect SSH brute force

What you will learn in this TP

• Start CrowdSec with Docker
• Declare the logs to read
• Read alerts and decisions
• Query the LAPI like a bouncer

Introduction #

What you will learn in this section

• Start CrowdSec with Docker
• Declare the logs to read
• Read alerts and decisions
• Query the LAPI like a bouncer

Context. Your server faces SSH login attempts. You want to see CrowdSec recognize them, without blocking anything yet.

Prerequisites: Docker, Docker Compose  ·  Estimated time: 40 min

Setup #

Guided steps, with their solution.

1. 1. The Compose file

   Why? Volumes keep configuration and database. Without a volume on /var/lib/crowdsec/data, the image refuses to start.

   Create compose.yaml.

2. 2. Declare the logs

   Create one acquisition file per source, then start.

3. 3. Check the installation

   Check collections and the sources being read.

4. 4. Simulate an attack

   Why? Only new lines are analyzed: we add them after startup.

   Add eight failed logins.

5. 5. Query the LAPI

   Create a bouncer key and ask for the status of two addresses.

Difficulty level : ●○○○○ (1/5)