CrowdSec notification plugins

Installing and Using OpenWrt
1

Hi, I have installed and configured CrowdSec using the following packages

crowdsec	1.6.0-1
crowdsec-firewall-bouncer	0.0.29-1
luci-app-crowdsec-firewall-bouncer	git-25.130.39098-a843514

on my x86 OpenWRT router

Target Platform	x86/64
Firmware Version	OpenWrt 23.05.5 r24106-10cc5fcd00 / LuCI openwrt-23.05 branch git-25.070.50735-0322352
Kernel Version	5.15.167

I am following both CrowdSec
https://docs.crowdsec.net/docs/notification_plugins/intro
and OpenWRT documentation
https://openwrt.org/docs/guide-user/services/crowdsec
to enable the email notifications.

When I try listing configured plugins I get the following message

# cscli notifications list
FATA[2025-05-15T06:36:02Z] can't build profiles configuration: notification plugin 'email_default' does not exist

According to the CrowdSec config installed with the package, plugins should be located in

# cat /etc/crowdsec/config.yaml
...
config_paths:
  notification_dir: /etc/crowdsec/notifications/
  plugin_dir: /usr/local/lib/crowdsec/plugins
...

but this folder structure was not created during installation.
According to the package info I found online, the crowdsec notification plugins are located in /usr/bin instead.

# ls -la /usr/bin | grep notification
-rwxr-xr-x    1 root     root      10621872 Apr 13 08:50 notification-dummy
-rwxr-xr-x    1 root     root      10774032 Apr 13 08:50 notification-email
-rwxr-xr-x    1 root     root      11165872 Apr 13 08:50 notification-http
-rwxr-xr-x    1 root     root      11288784 Apr 13 08:50 notification-sentinel
-rwxr-xr-x    1 root     root      11260528 Apr 13 08:50 notification-slack
-rwxr-xr-x    1 root     root      11157680 Apr 13 08:50 notification-splunk

I tried symlinking notification plugins from /usr/bin to /usr/local/lib/crowdsec/plugins and adding /usr/bin as my plugin path to the CrowdSec config, but I still can't get the notifications to work.

When researching the issue online, I found one unmerged commit on the github, but it didn't help me finding the answer. There were no open bug reports for crowdsec on the github either, so I am assuming the package was configured and built properly.

I will greatly appreciate any help in starting the email notifications.
Please share if you also know why default plugins location was changed in the openwrt crowdsec package.

2

On openwrt 24.10 and crowdsec 1.6.2, I worked around the issues like this:

mkdir -p /usr/local/lib/crowdsec/plugins
cd /usr/local/lib/crowdsec/plugins
find /usr/bin -iname notification-\* -exec ln -sf {} . \;
service crowdsec restart

Install your template for the notification in /etc/crowdsec/notifications, then you should test the email notification is working, something like:

cscli notifications test email_default

(I did not try it - I have custom notifications for Gotify which are now working great).

In the end, you should enable your favorite notification methods via /etc/crowdsec/profiles.yaml.

3

Thanks for your post @syntaxerrormmm, I already tried symlinking binaries from
/usr/bin/ to /usr/local/lib/crowdsec/plugins, I also tried different symlink names, nothing seems to work.

# ls -la /usr/local/lib/crowdsec/plugins
lrwxr-xr-x    1 root     root            27 Jun  7 09:04 email_default -> /usr/bin/notification-email
lrwxr-xr-x    1 root     root            27 Jun  7 09:01 notification-dummy -> /usr/bin/notification-dummy
lrwxr-xr-x    1 root     root            27 Jun  7 09:01 notification-email -> /usr/bin/notification-email
lrwxr-xr-x    1 root     root            26 Jun  7 09:01 notification-http -> /usr/bin/notification-http
lrwxr-xr-x    1 root     root            30 Jun  7 09:01 notification-sentinel -> /usr/bin/notification-sentinel
lrwxr-xr-x    1 root     root            27 Jun  7 09:01 notification-slack -> /usr/bin/notification-slack
lrwxr-xr-x    1 root     root            28 Jun  7 09:01 notification-splunk -> /usr/bin/notification-splunk

# ls -la /usr/bin/
...
lrwxr-xr-x    1 root     root            27 Jun  7 09:05 email_default -> /usr/bin/notification-email
-rwxr-xr-x    1 root     root      10621872 Apr 13 08:50 notification-dummy
-rwxr-xr-x    1 root     root      10774032 Apr 13 08:50 notification-email
-rwxr-xr-x    1 root     root      11165872 Apr 13 08:50 notification-http
-rwxr-xr-x    1 root     root      11288784 Apr 13 08:50 notification-sentinel
-rwxr-xr-x    1 root     root      11260528 Apr 13 08:50 notification-slack
-rwxr-xr-x    1 root     root      11157680 Apr 13 08:50 notification-splunk
...

Email notifications are enabled in
/etc/crowdsec/profiles.yaml
and configured in
/etc/crowdsec/notifications/email.yaml
still no luck.

I will update OpenWRT to 24.10 on the router and see if it works and if not, I will install crowdsec on a Pi or in a docker container.