66 lines
1.6 KiB
Bash
Executable File
66 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
OS_ARCH=$(dpkg --print-architecture) || (echo "Not Debian Based Distro" && exit 1)
|
|
OS_CODE=$(source /etc/os-release && echo "$VERSION_CODENAME")
|
|
|
|
main(){
|
|
echo "deb https://packagecloud.io/crowdsec/crowdsec/debian/ $OS_CODE main" | \
|
|
tee /etc/apt/sources.list.d/crowdsec_crowdsec.list
|
|
curl -fsSL "https://packagecloud.io/crowdsec/crowdsec/gpgkey" | \
|
|
gpg --dearmor | tee /etc/apt/trusted.gpg.d/crowdsec_crowdsec-archive-keyring.gpg > /dev/null
|
|
|
|
command="nala"
|
|
command -v $command &>/dev/null || command="apt"
|
|
$command update
|
|
$command install -y crowdsec crowdsec-firewall-bouncer-iptables
|
|
}
|
|
|
|
setup(){
|
|
echo -e "db_config:
|
|
use_wal: true" | tee /etc/crowdsec/config.yaml.local
|
|
|
|
echo -e "name: crowdsecurity/whitelists
|
|
description: "Whitelist events from custom ip addresses"
|
|
whitelist:
|
|
reason: "private ip ranges"
|
|
ip:
|
|
- "127.0.0.1"
|
|
- "::1"
|
|
cidr:
|
|
- "192.168.0.0/16"
|
|
- "10.0.0.0/8"
|
|
- "172.16.0.0/12"
|
|
- "fc00::/7"
|
|
# expression:
|
|
# - "'foo.com' in evt.Meta.source_ip.reverse"
|
|
" | tee /etc/crowdsec/parsers/s02-enrich/custom-whitelists.yaml
|
|
|
|
sed -i -r "s/# - DOCKER-USER/ - DOCKER-USER/g" /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
|
|
|
|
systemctl reload crowdsec
|
|
}
|
|
|
|
usage(){
|
|
echo "Usage: $0 [OPTIONS]";
|
|
echo "OPTIONS:";
|
|
echo " -i install only";
|
|
}
|
|
|
|
INSTALL_ONLY=0;
|
|
while getopts ":i" OPT; do
|
|
case $OPT in
|
|
i)
|
|
INSTALL_ONLY=1;
|
|
;;
|
|
?)
|
|
echo "Invalid Option: -$OPTARG";
|
|
usage;
|
|
exit 1;;
|
|
esac;
|
|
done;
|
|
|
|
main;
|
|
if [ $INSTALL_ONLY -eq 0 ]; then
|
|
setup;
|
|
fi; |