# Crowdsec update on Debian 12 and other questions

**URL:** <https://discourse.crowdsec.net/t/crowdsec-update-on-debian-12-and-other-questions/2018>\
**Category:** crowdsec\
**Created:** [September 12, 2024, 8:51pm UTC](https://discourse.crowdsec.net/t/crowdsec-update-on-debian-12-and-other-questions/2018 "2024-09-12T20:51:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VinCoD](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/vincod/32/986_2.png) [@VinCoD](https://discourse.crowdsec.net/u/VinCoD)\
**Post date:** [September 12, 2024, 8:51pm UTC](https://discourse.crowdsec.net/t/crowdsec-update-on-debian-12-and-other-questions/2018/1 "2024-09-12T20:51:48Z")

</div>

Hello there !  
I installed Crowdsec on my Debian / LAMP server, running Nextcloud. I’ve checked if my questions were answered elsewhere but I can’t seem to find what I need. I am confused about how the whole thing works despite looking at a bunch of tutorials.  
I connected the cscli to Crowdsec Hub, added apache2, ssh and nextcloud collections, configured the log files… It was working fine, showing me alerts so something was up. I didn’t use my server for a month and by using today, it’s been up for 4hours and I had no new alerts since then.  
**Questions :**

1. Is it normal behaviour ? Do alerts take time to show up ?
2. The Crowdsec Hub is telling me my version is outdated but apt is telling me it’s up to date with version 1.4.6-6~deb12u1 (which is obviously not the latest). What is the solution to update to newest ?
3. I can see in the acquis.yaml which log files are listed, among them syslog.log and auth.log which are out of date as of Debian 12. Indeed /var/log/crowdsec.log says it doesn’t find them. Debian 12 documentation says syslog and auth logs are only accessible via the journalctl command now. Does Crowdsec automatically checks that ?
4. The nextcloud collection is installed (appears in `cscli collections list`), but do I need to install a bouncer dedicated to nextcloud ? I already have a firewall bouncer =\> can it take malicious IPs threatening Nextcloud and create a firewall rule against them ? Or am I completely missing how Crowdsec works ?

Thanks for your answers  
Vincent

---

<div class="post-metadata">

**Author:** ![VinCoD](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/vincod/32/986_2.png) [@VinCoD](https://discourse.crowdsec.net/u/VinCoD)\
**Post date:** [September 13, 2024, 7:04pm UTC](https://discourse.crowdsec.net/t/crowdsec-update-on-debian-12-and-other-questions/2018/2 "2024-09-13T19:04:31Z")

</div>

Update : I searched a bit more and found how to install Crowdsec properly. I did an `apt remove --purge crowdsec`, used the script provided on [install.crowdsec.net](http://install.crowdsec.net) and installed crowdsec back again, now I’ve got the newest version.  
However after reinstalling the Nextcloud collection, I wanted to intall the nextcloud remediation component, and it seems it doesn’t exist on the Hub. Previously i installed `openresty-nextcloud` remediation component following that tutorial : [Install and secure your NextCloud server with CrowdSec | CrowdSec](https://www.crowdsec.net/blog/install-and-secure-your-nextcloud-server-with-crowdsec) however I don’t have a docker install and I don’t know if that’s an “official” remediation component. So again my question is : is the firewall remediation component sufficient ?  
Hope someone can help me with that

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [September 18, 2024, 10:43am UTC](https://discourse.crowdsec.net/t/crowdsec-update-on-debian-12-and-other-questions/2018/3 "2024-09-18T10:43:34Z")

</div>

> [@VinCoD](#):
>
> is the firewall remediation component sufficient ?

Yes as long as you dont have any upstream proxies like Cloudflare for example as the way the “proxy” support works it will negate the firewall remediation.