zine-tw.com

sudo apt update && sudo apt install curl gnupg apt-transport-https -y
curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec crowdsec-firewall-bouncer-nftables -y

sudo cscli collections install crowdsecurity/sshd crowdsecurity/linux


sudo cscli collections install crowdsecurity/apache2
sudo systemctl enable --now crowdsec
sudo systemctl enable --now crowdsec-firewall-bouncer
sudo systemctl reload crowdsec
sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer
sudo systemctl status crowdsec
# 檢查 Bouncer 是否註冊
sudo cscli bouncers list

# 檢查 Apache 日誌是否被讀取
sudo cscli metrics

sudo cscli decisions list

sudo nft list ruleset | grep -E "fail2ban|crowdsec"

remember kill banned server once a day
sudo cscli decisions delete --all
sudo crontab -e sudo nano /etc/cron.d/crowdsec-flush