Crowdsec packages for OpenWrt

ne20002 · February 27, 2023, 6:54am

Crowdsec 1.4.6 is available in snapshot branch (as soon as it has been build).

spammy · February 27, 2023, 9:03pm

I spent some time playing with crowdsec today but feel there is still a way to go. My questions may be due to my ignorance of the software so apologies in advance if they are not OpenWrt specific:

is the email plugin working? I get the following:

time="27-02-2023 20:29:35" level=fatal msg="api server init: unable to run local API: while loading plugin: open /usr/local/lib/crowdsec/plugins: no such file or directory"

I've managed to expose the LAPI and Prometheus metrics by changing the listen_addr and listen_uri in config.yaml. Are these available in the UCI config?
I've managed to get the agent (1.3.0-3) and bouncer (0.0.25-1) talking to each other by manually registering them as the bouncer did not automatically register. However I'm having trouble downloading a relevant collection/parser/blocklist via the commands at Crowdsec packages for OpenWrt - #21 by erdoukki. Are these still current or is are there other more relevant config I should download?

# cscli collections install crowdsecurity/linux
WARN[27-02-2023 09:03:11 PM] Crowdsec is not the latest version. Current version is 'v1.3.0' and the latest stable version is 'v1.4.6'. Please update it!
WARN[27-02-2023 09:03:11 PM] As a result, you will not be able to use parsers/scenarios/collections added to Crowdsec Hub after CrowdSec v1.4.6
WARN[27-02-2023 09:03:12 PM] crowdsecurity/syslog-logs : overwrite       
WARN[27-02-2023 09:03:12 PM] crowdsecurity/geoip-enrich : overwrite      
INFO[27-02-2023 09:03:12 PM] downloading data 'https://crowdsec-statics-assets.s3-eu-west-1.amazonaws.com/GeoLite2-City.mmdb' in '/srv/crowdsec/data/GeoLite2-City.mmdb'
Killed

And in my crowdsec.log:

time="27-02-2023 21:05:41" level=warning msg="No matching files for pattern /var/log/nginx/*.log" type=file
time="27-02-2023 21:05:41" level=warning msg="No matching files for pattern ./tests/nginx/nginx.log" type=file
time="27-02-2023 21:05:41" level=warning msg="No matching files for pattern /var/log/auth.log" type=file
time="27-02-2023 21:05:41" level=warning msg="No matching files for pattern /var/log/syslog" type=file
time="27-02-2023 21:05:41" level=warning msg="No matching files for pattern /var/log/apache2/*.log" type=file

In particular I can still see arbitrary scans hitting my WAN port (after turning on zone logging in kernel log), and am not sure if crowdsec is parsing them (or even blocking them).

How do I check the contents of @crowdsec-blacklists in the nft firewall rules? I can see the nft tables, but how do I know that the blocklist is actually populated?

lopez67876 · February 28, 2023, 10:54am

https://docs.crowdsec.net/docs/notification_plugins/email/
cscli config y cscli metrics
https://hub.crowdsec.net/
cscli decisions list --all y cscli alerts list --all

spammy · February 28, 2023, 7:40pm

Thanks - I actually used the config from that page with no results. I should have given context:

So was wondering if this was still a known issue.

==========

My question was whether I should be setting them via /etc/config/crowdsec or directly in the yaml (in case they get overwritten). I may just end up using a local config file though.

==========

I presume this is the same list as found via cscli hub list -a? If so I'm not sure how to determine the appropriate collections/config for an OpenWrt install. Is the crowdsecurity/linux collection and crowdsecurity/whitelists parser not the most appropriate? If so, how to download them without hitting the OOM error?

==========

root@router:/# cscli decisions list --all
No active decisions
root@router:/# cscli alerts list
No active alerts

I think I have an "empty" install so just need this final config for it to actually do anything.

Thanks for the help so far!

lopez67876 · March 13, 2023, 6:43pm

This is how I got it working on an openwrt router:

DELETE CURRENT INSTALLATIONS OF CROWDSEC/C.S.BOUNCER AND /srv/crowdsec.
INSTALL crowdsec_1.4.6-1 AND crowdsec-firewall-bouncer_0.0.25-1.
CREATE AN ACCOUNT - https://app.crowdsec.net/signup.
ENTER https://app.crowdsec.net/login.
REGISTER CrowdSec instance " cscli console enroll .............. ".
" service crowdsec reload ".
" cscli bouncers add yourbouncername " AND WRITE DOWN APIkey.
MODIFY /etc/crowdsec/config.yaml with listen_uri: 127.0.0.1:8080
and listen_addr: 127.0.0.1
MODIFY /etc/config/crowdsec with option api_url '0.0.0.0:8080/' and option api_key 'your APIkey'.

config crowdsec 'crowdsec'
	option data_dir '/srv/crowdsec/data'
	option db_path '/srv/crowdsec/data/crowdsec.db'
config bouncer
	option enabled '1'
	option ipv4 '1'
	option ipv6 '0'
	option api_url '0.0.0.0:8080/'
	option api_key 'your APIkey'
	option update_frequency '10s'
	option deny_action 'drop'
	option deny_log '0'
	option log_prefix 'crowdsec: '
	option log_level 'info'
	option filter_input '1'
	option filter_forward '1'
	list interface 'wan'
	list interface 'VPN1'
	list interface 'VPN2'
	.
	.
	.

RESTART DEVICE.

plikmuny · March 15, 2023, 10:20am

it didnt work for me, eventhough i did exactly what you have written here...
probably related to Banip Package ??? because i have it installed along with AdGuardHome...

lopez67876 · March 15, 2023, 3:24pm

I guess something wasn´t right because this morning I was:

After some testing I think I fixed with new cfg:

Captura bien

I have modified first post.
I also use banip, AdGuardHome, nextdns, bcp38 with crowdsec.

johnny71 · May 28, 2023, 6:32pm

Hello,

Do you have the old packages available by chance?
crowdsec_1.4.6-1
crowdsec-firewall-bouncer_0.0.25-1

I'm unable to find them on github. I tried the latest version and it is broke.

Thanks

lopez67876 · May 29, 2023, 6:44am

crowdsec_1.4.6-1_arm_cortex-a9_vfpv3-d16 and crowdsec-firewall-bouncer_0.0.25-1_arm_cortex-a9_vfpv3-d16 is what I have

johnny71 · May 29, 2023, 12:49pm

Bummer I ran into this error when trying to install the older package:

error

Here's more info about my setup:

Model	Raspberry Pi Compute Module 4 Rev 1.0
Architecture	bcm2835 1.5GHz 4 core cortex-a72 (aarch64)
Target Platform	bcm27xx/bcm2711
Firmware Version	OpenWrt 22.03.3 r20028-43d71ad93e / LuCI openwrt-22.03 branch git-22.361.69894-438c598
Kernel Version	5.10.161

lopez67876 · May 29, 2023, 1:34pm

May be this, but I have no idea of this page´s reputation:

johnny71 · May 29, 2023, 2:15pm

Just to clarify I'm not running Raspian, but OpenWRT OS.

lopez67876 · May 29, 2023, 5:58pm

crowdsec-firewall-bouncer_0.0.21-3_aarch64_cortex-a72.ipk
crowdsec_1.3.0-3_aarch64_cortex-a72.ipk

https://downloads.openwrt.org/releases/21.02.7/packages/aarch64_cortex-a72/packages/

all I´ve found

cmonty14 · August 16, 2024, 3:28pm

Hi,
I'm running OpenWrt on this device:

root@rb760igs:~# ubus call system board
{
	"kernel": "5.15.162",
	"hostname": "rb760igs",
	"system": "MediaTek MT7621 ver:1 eco:3",
	"model": "MikroTik RouterBOARD 760iGS",
	"board_name": "mikrotik,routerboard-760igs",
	"rootfs_type": "squashfs",
	"release": {
		"distribution": "OpenWrt",
		"version": "23.05.4",
		"revision": "r24012-d8dd03c46f",
		"target": "ramips/mt7621",
		"description": "OpenWrt 23.05.4 r24012-d8dd03c46f"
	}
}

Due to memory restrictions I already added extroot configuration.

Question:
Should I still install CrowdSec main package on a dedicated device, e.g. Raspi?

Storage is not an issue anymore on my device:

root@rb760igs:~# df -hT
Filesystem           Type            Size      Used Available Use% Mounted on
/dev/root            squashfs        2.8M      2.8M         0 100% /rom
tmpfs                tmpfs         122.2M      5.2M    117.0M   4% /tmp
/dev/sda1            ext4           29.1G    162.3M     27.4G   1% /overlay
overlayfs:/overlay   overlay        29.1G    162.3M     27.4G   1% /
tmpfs                tmpfs         512.0K         0    512.0K   0% /dev
/dev/mtdblock9       jffs2          10.2M      8.2M      2.0M  81% /rwm