Crowdsec Mysql bouncer

I am using crowdsec H2 db.
I am not able to find mysql bouncer so it can read mysql logs and do its magic.
Or I am mistaking this should not be bouncer?
Please advice


I think you have confused some of the terms :slight_smile:
A bouncer is a component that will apply a decision (for example, ban this IP for 4h).

If I understand you, you want the mysql collection (CrowdSec Hub) to detect bruteforce attacks against mysql.
You can install it by running cscli collections install crowdsecurity/mysql on the machine where crowdsec is running.

You will also need to update crowdsec acquisition config (in /etc/crowdsec/acquis.yaml) to tell crowdsec to read your mysql logs (there is an example config in the link above).

Finally, you will also want to install a bouncer, in your case i’d recommend the firewall bouncer (Firewall Bouncer | CrowdSec) to block IPs that are trying to attack your mysql.

And I’m not sure what you mean by I am using crowdsec H2 db., are you talking about the metabase dashboard ?

1 Like

Yes metabase, sorry confused :smiley:
Thank you very much for the answer, i am very new to crowdsec but i love it.
Will do all of the things that you wrote.
Thank you !