CrowdSec IPS Security Hardening ป้องกันแฮก —

CrowdSec IPS

CrowdSec IPS Security Hardening Crowd-sourced Intrusion Prevention Log Analysis Scenario Bouncer Blocklist Community Brute Force DDoS SQL Injection Firewall Nginx

Installation

=== CrowdSec Installation ===

Debian/Ubuntu

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt install crowdsec
sudo apt install crowdsec-firewall-bouncer-iptables

CentOS/RHEL

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.rpm.sh | sudo bash
sudo yum install crowdsec
sudo yum install crowdsec-firewall-bouncer-iptables
Docker
docker run -d --name crowdsec \
-v /var/log:/var/log:ro \
-v /etc/crowdsec:/etc/crowdsec \
-v crowdsec-db:/var/lib/crowdsec/data \
-e COLLECTIONS="crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd" \

crowdsecurity/crowdsec

Install Collections (Scenarios + Parsers)

sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/sshd
sudo cscli collections install crowdsecurity/http-cve

เนื้อหาเกี่ยวข้อง — ดูเพิ่มเติมเรื่อง Delta Lake Post-mortem Analysis

sudo cscli collections install crowdsecurity/wordpress

Register with Console

sudo cscli console enroll YOUR_ENROLLMENT_KEY

Check Status

sudo cscli metrics
sudo cscli decisions list

แนะนำเพิ่มเติม — บทวิเคราะห์จาก XM Signal

sudo cscli alerts list

Whitelist Trusted IPs

/etc/crowdsec/parsers/s02-enrich/whitelist.yaml

name: my-whitelist

description: Whitelist trusted IPs

whitelist:

reason: "Trusted office IP"

ip:

• "203.0.113.10"
• "10.0.0.0/8"

from dataclasses import dataclass

@dataclass

class CrowdSecCollection:

collection: str

scenarios: int

parsers: int

protects: str

popularity: str

collections = [

CrowdSecCollection("crowdsecurity/linux", 5, 8, "SSH Brute Force Su Abuse", "Very High"),

เนื้อหาเกี่ยวข้อง — บทความที่เกี่ยวข้อง: Shopify Hydrogen Data Pipeline ETL — สร้าง Data

CrowdSecCollection("crowdsecurity/nginx", 8, 4, "HTTP Attacks Scans CVE", "Very High"),

CrowdSecCollection("crowdsecurity/sshd", 3, 2, "SSH Login Failures", "Very High"),

CrowdSecCollection("crowdsecurity/http-cve", 15, 2, "Known CVE Exploits", "High"),

CrowdSecCollection("crowdsecurity/wordpress", 6, 3, "WP Login Xmlrpc Enum", "High"),

CrowdSecCollection("crowdsecurity/postfix", 4, 3, "SMTP Abuse Spam", "Medium"),

]

Scenarios and Bouncers

=== Custom Scenario ===

/etc/crowdsec/scenarios/my-api-bruteforce.yaml

type: leaky

แนะนำเพิ่มเติม — เรียนเทรดกับ iCafeForex

name: my-api-bruteforce

description: "API brute force detection"

filter: "evt.Meta.log_type == 'nginx_access' && evt.Meta.http_path startsWith '/api/login' && evt.Meta.http_status == '401'"

groupby: evt.Meta.source_ip

capacity: 5

leakspeed: 30s

blackhole: 5m

labels:

type: api_abuse

remediation: true

เนื้อหาเกี่ยวข้อง — บทความที่เกี่ยวข้อง: Stencil.js Stream Processing

Bouncer Configuration

/etc/crowdsec/bouncers/cs-firewall-bouncer.yaml

mode: iptables

piddir: /var/run/

update_frequency: 10s

daemonize: true

log_mode: file

log_dir: /var/log/

log_level: info

api_url: http://localhost:8080/

api_key: YOUR_BOUNCER_API_KEY

disable_ipv6: false

deny_action: DROP

deny_log: true

deny_log_prefix: "crowdsec: "

Nginx Bouncer

sudo apt install crowdsec-nginx-bouncer

# Adds lua module to nginx

# Automatically checks decisions before serving

Manual Decision Management

sudo cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"

เนื้อหาเกี่ยวข้อง — ทำความเข้าใจ MLflow Experiment Infrastructure as Code —

sudo cscli decisions delete --ip 1.2.3.4
sudo cscli decisions list --ip 1.2.3.4

@dataclass

class BouncerType:

bouncer: str

blocks_at: str

install: str

latency: str

use_case: str

bouncers = [

BouncerType("cs-firewall-bouncer", "iptables/nftables", "apt install", "0ms (kernel)", "All traffic"),

BouncerType("cs-nginx-bouncer", "Nginx Lua", "apt install", "1-2ms", "Web traffic"),

BouncerType("cs-cloudflare-bouncer", "Cloudflare WAF", "Docker/Binary", "0ms (edge)", "CDN protected"),

BouncerType("cs-traefik-bouncer", "Traefik middleware", "Docker", "1-2ms", "Traefik proxy"),

BouncerType("cs-haproxy-bouncer", "HAProxy", "apt install", "1ms", "Load balancer"),

]

เคล็ดลับ

• Collections: ติดตั้ง Collections ตาม Service ที่ใช้
• Whitelist: Whitelist Office IP และ Monitoring IP เสมอ
• Community: Subscribe Community Blocklist บล็อก Known Bad IP
• Alert: ตั้ง Notification ไป Slack ดู Attack Real-time
• Review: Review Decisions ทุกสัปดาห์ ตรวจ False Positive

CrowdSec คืออะไร

Open Source IPS Crowd-sourced Log Analysis Scenario Bouncer Blocklist Community Brute Force DDoS SQL Injection Firewall Nginx ฟรี