curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec crowdsec-firewall-bouncer-nftables -y
sudo cscli collections install crowdsecurity/sshd crowdsecurity/linux
sudo cscli collections install crowdsecurity/apache2
sudo systemctl enable --now crowdsec
sudo systemctl enable --now crowdsec-firewall-bouncer
sudo systemctl reload crowdsec
sudo systemctl status crowdsec
# 檢查 Bouncer 是否註冊
sudo cscli bouncers list
若未註冊
sudo ufw allow 8080
systemctl enable ufw
sudo ufw disable
sudo ufw enable
api_key: <您的實際_API_Key>
# 刪除現有的 bouncer
sudo cscli bouncers delete my-firewall-bouncer
# 重新創建並獲取新 Key
sudo cscli bouncers add my-firewall-bouncer
複製key (前後不要有空格)
將新生成的 Key 填入配置文件
sudo nano /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
在nano程式搜尋api_key:
api_key: "your_new_key"
# 確保下面一行沒有多餘的字符或錯誤的縮進
然後重啟服務
sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer
# 檢查 Apache 日誌是否被讀取
sudo cscli metrics
sudo cscli decisions list
sudo nft list ruleset | grep -E "fail2ban|crowdsec"
remember kill banned server once a day
sudo cscli decisions delete --all
sudo crontab -e
代碼: 選擇全部
0 12,0 * * * /usr/bin/sudo /usr/bin/cscli decisions delete --all代碼: 選擇全部
0 6,18 * * * root /usr/bin/cscli decisions delete --all