https://wiki.2clever.uk/index.php?action=history&feed=atom&title=SMEServer_Crowdsec 2026-06-28T09:12:38Z Revision history for this page on the wiki MediaWiki 1.43.6 https://wiki.2clever.uk/index.php?title=SMEServer_Crowdsec&diff=113&oldid=prev 2026-06-27T16:53:39Z

<p>Created page with &quot;Copied from; https://wiki.koozali.org/Crowdsec (270626) {{Languages}} &lt;!-- here we define the contrib name variable --&gt; &lt;!-- we get the page title, remove suffix for translated version; if needed you can define there with the value you want--&gt; {{#vardefine:contribname| {{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }} {{#vardefine:smecontribname| smeserver-{{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }} &lt;!-- we define the language --&gt; {{#vardefine:lang| {{lc: {{#ti...&quot;</p> <p><b>New page</b></p><div>Copied from; https://wiki.koozali.org/Crowdsec (270626)<br /> <br /> {{Languages}}<br /> &lt;!-- here we define the contrib name variable --&gt;<br /> &lt;!-- we get the page title, remove suffix for translated version; if needed you can define there with the value you want--&gt;<br /> {{#vardefine:contribname| {{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }}<br /> {{#vardefine:smecontribname| smeserver-{{lc: {{#titleparts: {{BASEPAGENAME}} |1}} }} }}<br /> &lt;!-- we define the language --&gt;<br /> {{#vardefine:lang| {{lc: {{#titleparts: {{PAGENAME}} | | -1}} }} |en }}<br /> {{Infobox contribs<br /> |name={{#var:contribname}}<br /> |image={{#var:contribname}}.jpg<br /> |description_image= {{#var:contribname}} logo<br /> |maintainer= Unnilennium<br /> |licence= <br /> |url= https://app.crowdsec.net<br /> |category= Security<br /> |tags= crowdsec, WAF, log parser<br /> }}<br /> <br /> === Version ===<br /> &lt;!-- keep this first element as is, you can add some if needed --&gt;<br /> {{#smeversion: {{#var:smecontribname}} }}<br /> <br /> === Description ===<br /> Crowdsec turns crowd-powered intelligence into tactical intelligence with actionable blocklists to maximize your SOC efficiency and reduce your costs.<br /> In other words, it helps you defends your servers from major new attacks by sharing with the community.<br /> <br /> For SME, we rely on crowdsec-blocklist-mirror, crowdsec and crowdsec-firewall-bouncer-iptables. crowdsec-custom-bouncer is planned to be used. <br /> <br /> We have added rules for qpsmtpd. Some general whitelists configurable.<br /> <br /> === Installation ===<br /> &lt;tabs container=&quot;&quot; style=&quot;display: inline-block;&quot;&gt;&lt;tab name=&quot;For SME 11&quot;&gt;<br /> First install the external repo <br /> dnf install smeserver-extrarepositories-crowdsec<br /> expand-template /etc/yum.smerepos.d/sme-base.repo<br /> Install<br /> dnf install {{#var:smecontribname}}<br /> <br /> Then you will need to get an ID to register your engine on https://app.crowdsec.net, and execute <br /> cscli console enroll YOURID<br /> &lt;/tab&gt;&lt;/tabs&gt;<br /> <br /> === Configuration ===<br /> you can list the available configuration with the following command :<br /> config show {{#var:contribname}}<br /> <br /> Some of the properties are not shown, but are defaulted in a template or a script. Here a more comprehensive list with default and expected values :<br /> {| class=&quot;wikitable&quot;<br /> !property<br /> !default<br /> !values<br /> !<br /> |-<br /> |IgnoreIP<br /> |<br /> |ip/bitmask,ip/bitmask<br /> |a comma separated list of IP or CIDR networks which will never be blocked by fail2ban. Example: 12.15.22.4,17.20.0.0/16. All your local networks and networks allowed to access the server-manager are already automatically whitelisted<br /> |-<br /> |FilterLocalNetworks<br /> |disabled<br /> |enabled/disabled<br /> |can be enabled or disabled (default is disabled). If set to enabled, local networks won&#039;t be whitelisted, and fail2ban can also ban hosts from the internal networks. Note that networks allowed to access the server-manager are not affected (they will never be blocked)<br /> |-<br /> |FilterAnyLANIP<br /> |disabled<br /> |enabled/disabled<br /> |add a list of common LAN ip to not filter them by default (ie if disabled). 127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12 are not filtered whether or not they are in your networks e-smith db. This is an extra precaution for most user not to shot themselves, but if you know what you do you can enable this filtering (ie remove the default whitelist)<br /> |-<br /> |access<br /> |<br /> |private, public<br /> |should remains empty for localhost only, anyway service is set to only listen on localhost<br /> |-<br /> |status<br /> |enabled<br /> |enabled,disabled<br /> |}<br /> <br /> simply modify value&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> config setprop crowdsec FilterAnyLANIP enabled<br /> &lt;/syntaxhighlight&gt;<br /> you can then issue&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> signal-event smeserver-crowdsec-update<br /> &lt;/syntaxhighlight&gt;<br /> <br /> === CLI usage ===<br /> while you can have a lot of info online on your crowdsec app interface, you have some interesting commands&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> # cscli metrics show acquisition bouncers parsers whitelists<br /> ╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮<br /> │ Acquisition Metrics │<br /> ├─────────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤<br /> │ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │<br /> ├─────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤<br /> │ file:/var/log/audit/audit.log │ 4.86k │ 1.43k │ 3.44k │ - │ - │<br /> │ file:/var/log/dovecot/dovecot.log │ 3 │ 1 │ 2 │ - │ - │<br /> │ file:/var/log/maillog │ 18 │ - │ 18 │ - │ - │<br /> │ file:/var/log/messages │ 1.03k │ - │ 1.03k │ - │ - │<br /> │ file:/var/log/qpsmtpd/qpsmtpd.log │ 314 │ 9 │ 305 │ - │ - │<br /> │ file:/var/log/secure │ 2 │ - │ 2 │ - │ - │<br /> │ file:/var/log/sqpsmtpd/sqpsmtpd.log │ 146 │ 16 │ 130 │ - │ - │<br /> │ file:/var/log/uqpsmtpd/uqpsmtpd.log │ 110 │ 10 │ 100 │ - │ - │<br /> ╰─────────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯<br /> ╭───────────────────────────────────────────────────────────────────────────────────╮<br /> │ Bouncer Metrics (cs-firewall-bouncer-1782358017) since 2026-06-25 05:39:13 +0000 │<br /> │ UTC │<br /> ├────────────────────────────┬──────────────────┬─────────────────┬─────────────────┤<br /> │ Origin │ active_decisions │ dropped │ processed │<br /> │ │ IPs │ bytes │ packets │ bytes │ packets │<br /> ├────────────────────────────┼──────────────────┼───────┼─────────┼───────┼─────────┤<br /> │ CAPI (community blocklist) │ 19.82k │ 8.63k │ 198 │ - │ - │<br /> │ cscli (manual decisions) │ 0 │ 0 │ 0 │ - │ - │<br /> │ lists:firehol_botscout_7d │ 1.07k │ - │ - │ - │ - │<br /> │ lists:firehol_greensnow │ 3.65k │ - │ - │ - │ - │<br /> │ lists:tor-exit-nodes │ 1.44k │ 0 │ 0 │ - │ - │<br /> ├────────────────────────────┼──────────────────┼───────┼─────────┼───────┼─────────┤<br /> │ Total │ 25.98k │ 8.63k │ 198 │ 7.58M │ 38.58k │<br /> ╰────────────────────────────┴──────────────────┴───────┴─────────┴───────┴─────────╯<br /> ╭───────────────────────────────────────────────────────────────────╮<br /> │ Parser Metrics │<br /> ├───────────────────────────────────────┬───────┬────────┬──────────┤<br /> │ Parsers │ Hits │ Parsed │ Unparsed │<br /> ├───────────────────────────────────────┼───────┼────────┼──────────┤<br /> │ child-child-crowdsecurity/auditd-logs │ 4.86k │ 1.43k │ 3.44k │<br /> │ child-crowdsecurity/auditd-logs │ 4.86k │ 1.43k │ 3.44k │<br /> │ child-crowdsecurity/dovecot-logs │ 9 │ 1 │ 8 │<br /> │ child-crowdsecurity/qpsmtpd-logs │ 35 │ 35 │ - │<br /> │ child-crowdsecurity/sshd-logs │ 32 │ - │ 32 │<br /> │ child-crowdsecurity/sshd-success-logs │ 2 │ - │ 2 │<br /> │ child-crowdsecurity/syslog-logs │ 1.05k │ 1.05k │ - │<br /> │ crowdsecurity/auditd-logs │ 4.86k │ 1.43k │ 3.44k │<br /> │ crowdsecurity/dateparse-enrich │ 1.46k │ 1.46k │ - │<br /> │ crowdsecurity/dovecot-logs │ 3 │ 1 │ 2 │<br /> │ crowdsecurity/geoip-enrich │ 1 │ 1 │ - │<br /> │ crowdsecurity/non-syslog │ 5.43k │ 5.43k │ - │<br /> │ crowdsecurity/public-dns-allowlist │ 1.46k │ 1.46k │ - │<br /> │ crowdsecurity/qpsmtpd-logs │ 35 │ 35 │ - │<br /> │ crowdsecurity/qpsmtpd-whitelist │ 35 │ 35 │ - │<br /> │ crowdsecurity/sshd-logs │ 2 │ - │ 2 │<br /> │ crowdsecurity/sshd-success-logs │ 2 │ - │ 2 │<br /> │ crowdsecurity/syslog-logs │ 1.05k │ 1.05k │ - │<br /> │ crowdsecurity/whitelists │ 1.43k │ 1.43k │ - │<br /> ╰───────────────────────────────────────┴───────┴────────┴──────────╯<br /> ╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮<br /> │ Whitelist Metrics │<br /> ├────────────────────────────────────┬───────────────────────────────────────────────────────┬──────┬─────────────┤<br /> │ Whitelist │ Reason │ Hits │ Whitelisted │<br /> ├────────────────────────────────────┼───────────────────────────────────────────────────────┼──────┼─────────────┤<br /> │ crowdsecurity/public-dns-allowlist │ public DNS server │ 1461 │ - │<br /> │ crowdsecurity/qpsmtpd-whitelist │ IP de confiance pour le serveur de messagerie qpsmtpd │ 35 │ - │<br /> │ crowdsecurity/whitelists │ private ipv4/ipv6 ip/ranges │ 1426 │ - │<br /> ╰────────────────────────────────────┴───────────────────────────────────────────────────────┴──────┴─────────────╯<br /> &lt;/syntaxhighlight&gt;&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> # cscli collections list<br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> COLLECTIONS <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> Name 📦 Status Version Local Path <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> crowdsecurity/apache2 ✔️ enabled 0.2 /etc/crowdsec/collections/apache2.yaml <br /> crowdsecurity/auditd ✔️ enabled 0.7 /etc/crowdsec/collections/auditd.yaml <br /> crowdsecurity/base-http-scenarios ✔️ enabled 1.4 /etc/crowdsec/collections/base-http-scenarios.yaml <br /> crowdsecurity/dovecot ✔️ enabled 0.2 /etc/crowdsec/collections/dovecot.yaml <br /> crowdsecurity/http-cve ✔️ enabled 3.0 /etc/crowdsec/collections/http-cve.yaml <br /> crowdsecurity/linux ✔️ enabled 0.4 /etc/crowdsec/collections/linux.yaml <br /> crowdsecurity/mariadb ✔️ enabled 0.2 /etc/crowdsec/collections/mariadb.yaml <br /> crowdsecurity/mysql ✔️ enabled 0.2 /etc/crowdsec/collections/mysql.yaml <br /> crowdsecurity/postfix ✔️ enabled 0.5 /etc/crowdsec/collections/postfix.yaml <br /> crowdsecurity/proftpd ✔️ enabled 0.2 /etc/crowdsec/collections/proftpd.yaml <br /> crowdsecurity/smb ✔️ enabled 0.2 /etc/crowdsec/collections/smb.yaml <br /> crowdsecurity/sshd ✔️ enabled 0.9 /etc/crowdsec/collections/sshd.yaml <br /> crowdsecurity/whitelist-good-actors ✔️ enabled 0.4 /etc/crowdsec/collections/whitelist-good-actors.yaml <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> <br /> &lt;/syntaxhighlight&gt;&lt;syntaxhighlight lang=&quot;bash&quot;&gt;<br /> # cscli parsers list<br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> PARSERS <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> Name 📦 Status Version Local Path <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> crowdsecurity/apache2-logs ✔️ enabled 1.5 /etc/crowdsec/parsers/s01-parse/apache2-logs.yaml <br /> crowdsecurity/auditd-logs ✔️ enabled 0.9 /etc/crowdsec/parsers/s01-parse/auditd-logs.yaml <br /> crowdsecurity/dateparse-enrich ✔️ enabled 0.2 /etc/crowdsec/parsers/s02-enrich/dateparse-enrich.yaml <br /> crowdsecurity/dovecot-logs ✔️ enabled 0.9 /etc/crowdsec/parsers/s01-parse/dovecot-logs.yaml <br /> crowdsecurity/geoip-enrich ✔️ enabled 0.5 /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml <br /> crowdsecurity/http-logs ✔️ enabled 1.3 /etc/crowdsec/parsers/s02-enrich/http-logs.yaml <br /> crowdsecurity/mariadb-logs ✔️ enabled 0.4 /etc/crowdsec/parsers/s01-parse/mariadb-logs.yaml <br /> crowdsecurity/mysql-logs ✔️ enabled 0.4 /etc/crowdsec/parsers/s01-parse/mysql-logs.yaml <br /> crowdsecurity/postfix-logs ✔️ enabled 0.9 /etc/crowdsec/parsers/s01-parse/postfix-logs.yaml <br /> crowdsecurity/postscreen-logs ✔️ enabled 0.3 /etc/crowdsec/parsers/s01-parse/postscreen-logs.yaml <br /> crowdsecurity/proftpd-logs ✔️ enabled 0.3 /etc/crowdsec/parsers/s01-parse/proftpd-logs.yaml <br /> crowdsecurity/public-dns-allowlist ✔️ enabled 0.1 /etc/crowdsec/parsers/s02-enrich/public-dns-allowlist.yaml <br /> crowdsecurity/qpsmtpd-logs 🏠 enabled,local /etc/crowdsec/parsers/s01-parse/qpsmtpd-parser.yaml <br /> crowdsecurity/qpsmtpd-whitelist 🏠 enabled,local /etc/crowdsec/parsers/s02-enrich/qpsmtpd-whitelist.yaml <br /> crowdsecurity/smb-logs ✔️ enabled 0.2 /etc/crowdsec/parsers/s01-parse/smb-logs.yaml <br /> crowdsecurity/sshd-logs ✔️ enabled 3.1 /etc/crowdsec/parsers/s01-parse/sshd-logs.yaml <br /> crowdsecurity/sshd-success-logs ✔️ enabled 0.1 /etc/crowdsec/parsers/s01-parse/sshd-success-logs.yaml <br /> crowdsecurity/syslog-logs ✔️ enabled 1.0 /etc/crowdsec/parsers/s00-raw/syslog-logs.yaml <br /> crowdsecurity/whitelists 🏠 enabled,local /etc/crowdsec/parsers/s02-enrich/whitelists.yaml <br /> ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────<br /> <br /> &lt;/syntaxhighlight&gt;<br /> <br /> === Uninstall ===<br /> dnf remove {{#var:smecontribname}} {{#var:contribname}}<br /> <br /> === Bugs ===<br /> Please raise bugs under the SME-Contribs section in {{BugzillaFileBug|product=|component=|title= bugzilla}}<br /> and select the {{#var:smecontribname}} component or use {{BugzillaFileBug|product=SME%20Contribs|component={{#var:smecontribname}}|title=this link}}<br /> <br /> Below is an overview of the current issues for this contrib:{{#bugzilla:columns=id,product,version,status,summary|sort=id|order=desc|component={{#var:smecontribname}} |noresultsmessage=No open bugs found.}} <br /> <br /> ===Changelog===<br /> Only released version in smecontrib are listed here.<br /> <br /> {{ #smechangelog: {{#var:smecontribname}} }}<br /> <br /> <br /> &lt;!-- list of category you want to see this page in --&gt;<br /> [[Category: Contrib]]<br /> <br /> &lt;!-- Please keep there the template revision number as is --&gt;<br /> [[contribtemplate::2| ]]</div>

Rdswikiadmin