Crowdsec update on Debian 12 and other questions

crowdsec
1

Hello there !
I installed Crowdsec on my Debian / LAMP server, running Nextcloud. I’ve checked if my questions were answered elsewhere but I can’t seem to find what I need. I am confused about how the whole thing works despite looking at a bunch of tutorials.
I connected the cscli to Crowdsec Hub, added apache2, ssh and nextcloud collections, configured the log files… It was working fine, showing me alerts so something was up. I didn’t use my server for a month and by using today, it’s been up for 4hours and I had no new alerts since then.
Questions :

  1. Is it normal behaviour ? Do alerts take time to show up ?
  2. The Crowdsec Hub is telling me my version is outdated but apt is telling me it’s up to date with version 1.4.6-6~deb12u1 (which is obviously not the latest). What is the solution to update to newest ?
  3. I can see in the acquis.yaml which log files are listed, among them syslog.log and auth.log which are out of date as of Debian 12. Indeed /var/log/crowdsec.log says it doesn’t find them. Debian 12 documentation says syslog and auth logs are only accessible via the journalctl command now. Does Crowdsec automatically checks that ?
  4. The nextcloud collection is installed (appears in cscli collections list), but do I need to install a bouncer dedicated to nextcloud ? I already have a firewall bouncer => can it take malicious IPs threatening Nextcloud and create a firewall rule against them ? Or am I completely missing how Crowdsec works ?

Thanks for your answers
Vincent

2

Update : I searched a bit more and found how to install Crowdsec properly. I did an apt remove --purge crowdsec, used the script provided on install.crowdsec.net and installed crowdsec back again, now I’ve got the newest version.
However after reinstalling the Nextcloud collection, I wanted to intall the nextcloud remediation component, and it seems it doesn’t exist on the Hub. Previously i installed openresty-nextcloud remediation component following that tutorial : Install and secure your NextCloud server with CrowdSec | CrowdSec however I don’t have a docker install and I don’t know if that’s an “official” remediation component. So again my question is : is the firewall remediation component sufficient ?
Hope someone can help me with that

3

Yes as long as you dont have any upstream proxies like Cloudflare for example as the way the “proxy” support works it will negate the firewall remediation.

1 Like