Debian 13.5 crowdsec install note

[Brave Ye]

sudo apt update && sudo apt install curl gnupg apt-transport-https -y
curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec crowdsec-firewall-bouncer-nftables -y

sudo cscli collections install crowdsecurity/sshd crowdsecurity/linux


sudo cscli collections install crowdsecurity/apache2
sudo systemctl enable --now crowdsec
sudo systemctl enable --now crowdsec-firewall-bouncer
sudo systemctl reload crowdsec
sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer
sudo systemctl status crowdsec
# 檢查 Bouncer 是否註冊
sudo cscli bouncers list

# 檢查 Apache 日誌是否被讀取
sudo cscli metrics

sudo cscli decisions list

sudo nft list ruleset | grep -E "fail2ban|crowdsec"

remember kill banned server once a day
sudo cscli decisions delete --all
sudo crontab -e

代碼: 選擇全部

0 12,0 * * * /usr/bin/sudo /usr/bin/cscli decisions delete --all

sudo nano /etc/cron.d/crowdsec-flush

代碼: 選擇全部

0 6,18 * * * root /usr/bin/cscli decisions delete --all