Crowdsec for use with hostsystem

[gomaaz]

Hello,

I would like to use CrowdSec not only with NPMplus but also for my host system, and I want to add an additional firewall bouncer. However, the bouncers can only be installed using apt. CrowdSec itself is installed via the apt package manager, which is not available in Docker containers.

Thank you for your help!

[Zoey2936]

hello, yes this works, you can either install crowdsec via apt and install the NPMplus collection, then you can use the same guide as you see in this readme but the commands need to be run on yopur system so without docker exec or you install it via docker and connect the firewall bouncer to the docker container

[gomaaz]

thanks

[gomaaz]

hmm

I just installed two bouncers.

• the npmplus from this github page with the given yaml and instructions and
• the firewall bouncer for iptables

I can't view the npmplus bouncer here, is this normal?

by manually test, I achieved blocking my ip for 2 Minutes. It also works on docker (npmplus) proxy hosts.

The logs of /opt/npm/nginx/access.log are not showing up

I wondering if the npm bouncer is running...

[Zoey2936]

where did you put the npmplus.yaml?

[gomaaz]

also the npmplus.yaml contains source: docker entries. Is this still relevant for crowdsec natively installed on the host system?

[Zoey2936]

yes, crowdsec needs to read npmplus docker logs

[gomaaz]

ok....

I forgot to restart the npmplus container...

Now its working and I am immediately blocked for unknown reason 😂

Only nginx-access with all its proxies is blocked, everything else like ssh works...
what is causing this?

[gomaaz]

right here: /opt/crowdsec/conf/acquis.d/npmplus.yaml

yes I isntalled it right from bouncer hub

[Zoey2936]

you need to adjust the path to the path crowdsec uses when installed on the host, it should be somewhere in /etc/crowdsec, there should be somewhere the acquis.d folder in which the npmplus.yaml should be placed

[gomaaz]

ok this looks better now:

I moved
/opt/crowdsec/conf/acquis.d/npmplus.yaml
to
/etc/crowdsec/acquis.d/npmplus.yaml

Got access again on proxies
log paths are also shown now:

I guess its fixed then.

I recommend to mention this in your install guide?...

[Zoey2936]

the guide is written for docker install, which would also work in your case, since the firewall bouncer, even installed on host, can connect to the crowdsec api when running in docker, I don't see a reason to explain a more complicated install

[gomaaz]

anyway, thanks for your support 🙏