In this article, I’ll describe how to install the CrowdSec agent and the firewall bouncer directly on Raspberry Pi OS and convert it into a sort of honeypot using endlessh (an ssh tarpit) and a web server which only purpose is for CrowdSec to detect attacks in its logfiles. Raspberry Pi is a perfect device […]
In this tutorial, we will cover installing and securing a Nextcloud instance with the CrowdSec software. Nextcloud is an extensible collaborative drive tool to replace traditional office suites and drives. (GSuite and Microsoft 365). The focus is on privacy with an easily self-hosting tool. CrowdSec is a collaborative security solution based on the principle of analysis and the correlation […]
This article is a direct translation from Florian Burnel’s work on his blog, IT Connect. The original piece can be found here If you want to install CrowdSec on a Microsoft Exchange 2019 server, you can find a tutorial also written by Florian Burnel and translated to English, here. I. Introduction Until today, the CrowdSec agent […]
Introduction Each user who accesses your site is identifiable by an IP address. CrowdSec is an open source tool capable of determining whether this IP is potentially malicious or not. To do so, the CrowdSec agent that you will have installed on your server will analyze different data sources (log files, etc.). According to predefined remediation […]
Introduction In this tutorial, we are going to see how we can write a CrowdSec parser to process Asterisk logs and then how to write a CrowdSec scenario to detect common attacks (user enumeration, brute force …) on this service. Requirements In order to write the CrowdSec parser and scenario, we will need the following: […]
Qualys just published CVE-2021-4034 which is trivial to exploit and impacts a large variety of distributions and versions. In a nutshell, the vulnerability, also called PwnKit, allows for a local escalation of privilege (LPE), due to out-of-band writing, in Polkit’s Pkexec, an alternate solution to the “sudo” privilege management tool. Pkexec is installed by default […]
Introduction Hello again to the readers who have read the first part of the article about how to integrate CrowdSec to Kubernetes and detect attacks. For the others, welcome to part 2, which will cover the remediation part on Kubernetes and, more precisely, on Nginx Ingress Controller. First, you need to have a ready Kubernetes […]
At CrowdSec we want our users to protect themselves regardless of the tech stack they use. The simplest way to do that is to implement threat remediation at the network level, with a firewall bouncer. CrowdSec bouncers can also be set up at the upper levels of an applicative stack: web server, CDN, and in […]
With the Log4j (CVE-2021-44228) exploit storming over the internet, countless java-based services were discovered being not only critically vulnerable but also said to be ridiculously easy to exploit, pushing sysadmins into a rush to identify and correct the vulnerable systems. It is too early to assess the long-term impact of Log4j but the consensus is […]
If you work in Infosec, you had a very lousy weekend. And that’s because of the Log4j zero-day vulnerability (CVE-2021-44228) that was discovered. We had no choice but to roll up our sleeves to help our community before things got messier than they already were. As a result, we have released a scenario that will […]
Introduction The microservice architecture is the most significant security challenge in a Kubernetes (K8s) cluster. Every application you deploy opens a new potential entry for attackers, increasing the attack surface. As deployed applications generate logs and CrowdSec can run in a container… You see where I am going with this. In this blog post, we […]
PHP is used by 79% of the websites for which we know the server-side programming language, according to W3Techs’ usage statistics. It is evident that we needed to provide a PHP bouncer to help you secure your websites. This day has finally come. CrowdSec bouncers can be set up at various levels of your applicative […]
You may have read about our brand new console, which is currently in private beta and provides an easy-to-use web interface to inspect multiple CrowdSec agent signals spread across different networks. Today let’s take a look at it to better understand what it can achieve. To use it, you must first make sure you have […]
This article explains how to make CrowdSec and Docker Compose work together to protect applications exposed in containers. It should allow us to: Automatically ban malevolent IPs from accessing our container services Manually add/remove and inspect ban decisions Monitor CrowdSec’s behavior (via cli and dashboards) Target Architecture The chart below shows a glimpse of how […]
The release of CrowdSec v1.1.x introduces new package repositories for the CrowdSec agent and the bouncers, making the setup process even easier. In addition to that, multiple CrowdSec agents can be connected to the console to get a unified view of the attackers. In this tutorial, we are going to cover the following: CrowdSec setup […]
Since v1.0.x was released, CrowdSec can now secure has implemented a Local API that can be requested by the CrowdSec agent or command line client, but also by remote CrowdSec machines. Let’s deep dive and explore how it works and how to make the most of it. This post is the English version of an […]