37 lines
1.1 KiB
Bash
37 lines
1.1 KiB
Bash
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
main(){
|
|
echo "deb https://packagecloud.io/crowdsec/crowdsec/debian/ $OS_CODE main" | \
|
|
tee /etc/apt/sources.list.d/crowdsec_crowdsec.list
|
|
curl -fsSL "https://packagecloud.io/crowdsec/crowdsec/gpgkey" | \
|
|
gpg --dearmor | tee /etc/apt/trusted.gpg.d/crowdsec_crowdsec-archive-keyring.gpg > /dev/null
|
|
|
|
command="nala"
|
|
command -v $command &>/dev/null || command="apt"
|
|
$command update
|
|
$command install -y crowdsec crowdsec-firewall-bouncer-iptables
|
|
|
|
echo -e "db_config:
|
|
use_wal: true" | tee /etc/crowdsec/config.yaml.local
|
|
|
|
echo -e "name: crowdsecurity/whitelists
|
|
description: "Whitelist events from custom ip addresses"
|
|
whitelist:
|
|
reason: "private ip ranges"
|
|
ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
cidr:
|
|
- "192.168.0.0/16"
|
|
- "10.0.0.0/8"
|
|
- "172.16.0.0/12"
|
|
- "fc00::/7"
|
|
# expression:
|
|
# - "'foo.com' in evt.Meta.source_ip.reverse"
|
|
" | tee /etc/crowdsec/parsers/s02-enrich/custom-whitelists.yaml
|
|
|
|
sed -i -r "s/# - DOCKER-USER/ - DOCKER-USER/g" /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
|
|
|
|
systemctl reload crowdsec
|
|
} |