SOC/CONFIGS/02-crowdsec.md at main · 0xCyberLiTech/SOC

Configuration CrowdSec — WAF AppSec · bouncer nftables · scénarios custom.

Cybersécurité défensive • Homelab en production • IA locale intégrée

## À propos & Objectifs.

Ce document couvre l'installation et la configuration CrowdSec : collections communautaires, LAPI locale, bouncer nftables kernel-space, AppSec WAF ~180 règles, scénarios custom et whitelist LAN.

📦 Collections installées — linux, nginx, http-cve, sshd, WordPress scan
🔌 LAPI locale — API CrowdSec interrogée par monitoring_gen.py
🛡️ Bouncer nftables — blocage kernel-space, sets IP dynamiques
🔒 AppSec WAF — ~180 règles vpatch CVE, intégration nginx port 7422
📝 Scénarios custom — http-bad-ua, exploit-scan, php-rce, geo-block

Collections installées

cscli collections install \
  crowdsecurity/linux \
  crowdsecurity/nginx \
  crowdsecurity/http-cve \
  crowdsecurity/sshd \
  crowdsecurity/whitelist-good-actors \
  crowdsecurity/iptables \
  crowdsecurity/appsec-generic-rules \
  crowdsecurity/appsec-virtual-patching

Collection	Rôle
`linux`	Détection attaques système génériques
`nginx`	Analyse logs nginx — scans, 4xx excessifs
`http-cve`	CVE web connues (Log4Shell, Spring4Shell…)
`sshd`	Brute force SSH
`whitelist-good-actors`	Crawlers légitimes (Googlebot…)
`iptables`	Intégration nftables
`appsec-generic-rules`	WAF règles génériques
`appsec-virtual-patching`	~180 vpatch CVE actifs

config.yaml — Configuration LAPI

/etc/crowdsec/config.yaml

common:
  daemonize: true
  log_media: file
  log_level: info
  log_dir: /var/log/crowdsec/
  working_dir: /var/lib/crowdsec/data/

config_paths:
  config_dir: /etc/crowdsec/
  data_dir: /var/lib/crowdsec/data/
  simulation_path: /etc/crowdsec/simulation.yaml
  hub_dir: /etc/crowdsec/hub/
  index_path: /etc/crowdsec/hub/.index.json

crowdsec_service:
  acquisition_path: /etc/crowdsec/acquis.yaml
  parser_routines: 1

cscli:
  output: human

db_config:
  type: sqlite
  db_path: /var/lib/crowdsec/data/crowdsec.db
  flush:
    max_items: 5000
    max_age: 7d

api:
  client:
    insecure_skip_verify: false
    credentials_path: /etc/crowdsec/local_api_credentials.yaml
  server:
    log_level: info
    listen_uri: 127.0.0.1:8080
    profiles_path: /etc/crowdsec/profiles.yaml
    online_client:
      credentials_path: /etc/crowdsec/online_api_credentials.yaml

Acquisition — Sources de logs

/etc/crowdsec/acquis.yaml

# Logs nginx
filenames:
  - /var/log/nginx/access.log
  - /var/log/nginx/error.log
labels:
  type: nginx
---
# Logs SSH
filenames:
  - /var/log/auth.log
labels:
  type: syslog
---
# AppSec WAF — écoute sur socket nginx
listen_addr: 127.0.0.1:7422
appsec_config: crowdsecurity/virtual-patching
name: appsec
source: appsec
labels:
  type: appsec

Bouncer nftables

/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

mode: nftables
update_frequency: 10s
log_mode: file
log_dir: /var/log/crowdsec/
log_level: info
api_key: <BOUNCER-API-KEY>          # généré : cscli bouncers add cs-nftables-bouncer
api_url: http://127.0.0.1:8080/

nftables:
  ipv4:
    enabled: true
    set-only: false
    table: crowdsec
    chain: crowdsec-chain
  ipv6:
    enabled: false

Scénarios custom

/etc/crowdsec/scenarios/custom-nginx-404-scan.yaml

type: leaky
name: <GITHUB-USER>/nginx-404-scan
description: "Détection scan 404 intensif — 30 erreurs en 2 min"
filter: "evt.Meta.service == 'nginx' && evt.Meta.http_status == '404'"
groupby: "evt.Meta.source_ip"
capacity: 30
leakspeed: "10s"
blackhole: 5m
labels:
  service: nginx
  type: scan
  remediation: true

/etc/crowdsec/scenarios/custom-nginx-bot-ua.yaml

type: leaky
name: <GITHUB-USER>/nginx-bot-useragent
description: "User-Agent de bot/scanner connu"
filter: >
  evt.Meta.service == 'nginx' &&
  evt.Parsed.http_user_agent contains any ('sqlmap', 'nikto', 'masscan', 'zgrab', 'nuclei')
groupby: "evt.Meta.source_ip"
capacity: 5
leakspeed: "60s"
blackhole: 10m
labels:
  service: nginx
  type: bot
  remediation: true

/etc/crowdsec/scenarios/custom-ssh-slowbrute.yaml

type: leaky
name: <GITHUB-USER>/ssh-slow-bruteforce
description: "Brute force SSH lent — évite les seuils fail2ban"
filter: "evt.Meta.log_type == 'ssh_failed-auth'"
groupby: "evt.Meta.source_ip"
capacity: 10
leakspeed: "120s"
blackhole: 24h
labels:
  service: ssh
  type: bruteforce
  remediation: true

Whitelist LAN

/etc/crowdsec/parsers/s02-enrich/whitelist-lan.yaml

name: crowdsecurity/whitelist-lan
description: "Whitelist LAN — ne jamais bannir le réseau local"
whitelist:
  reason: "LAN réseau local"
  ip:
    - "127.0.0.1"
  cidr:
    - "<LAN-SUBNET>"

Commandes de référence

# État général
cscli decisions list
cscli alerts list
cscli metrics

# Vérifier CAPI (cloud CrowdSec)
cscli capi status

# Bannir / débannir manuellement
cscli decisions add --ip 1.2.3.4 --duration 24h --reason "test"
cscli decisions delete --ip 1.2.3.4

# Inspecter les scénarios déclenchés
cscli scenarios list
cscli collections list

# Logs temps réel
tail -f /var/log/crowdsec/crowdsec.log