Hi,
I’m trying to configure crowdsec for the first time on Ubuntu 24.04.1 (ARM), and while there’s no error in the logs, I can’t get an email notification.
remove # and enable debug : #notifications: #- email_default
name: default_ip_remediation
debug: true
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 4h
#duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
notifications:
# - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
# - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
# - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
- email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
on_success: break
vi /etc/crowdsec/notifications/email.yaml
paste the template from here :
Update
smtp host
smtp username
smtp password
port (without quotes, I’ve tried with and crowsec failed to reload, so the file is parsed at least)
Sender name
sender email
receiver emails (one)
I’ve configured and successfully tested msmtprc and I was able to send email on my gmail address, so reaching the SMTP server is OK from this machine.
cscli decisions add do not trigger notifications. You can test it by using the above commands by @verybadsoldier OR if you want the manual decisions you can reinject the alert ID but using test command is the best.
~$ cscli notifications list
────────────────────────────────────────────────
Name Type Profile name
────────────────────────────────────────────────
email_default email default_ip_remediation
────────────────────────────────────────────────
But, there’s no “test” command for notifications
cscli notifications test email_default
To list/inspect/test notification template
Usage:
cscli notifications [command]
Aliases:
notifications, notifications, notification
Available Commands:
inspect Inspect active notifications plugin configuration
list List active notifications plugins
reinject reinject alert into notifications system
Flags:
-h, --help help for notifications
Global Flags:
--color string Output color: yes, no, auto. (default "auto")
-c, --config string path to crowdsec config file (default "/etc/crowdsec/config.yaml")
--debug Set logging to debug.
--error Set logging to error.
--info Set logging to info.
-o, --output string Output format: human, json, raw.
--trace Set logging to trace.
--warning Set logging to warning.
Use "cscli notifications [command] --help" for more information about a command.
I’ve installed CrowdSec from Ubuntu 24.04.1 packges with apt.
apt info crowdsec
Package: crowdsec
Version: 1.6.3
Priority: optional
Section: admin
Maintainer: Crowdsec Team <debian@crowdsec.net>
Installed-Size: 175 MB
Depends: coreutils
Suggests: cron
Download-Size: 40.6 MB
APT-Sources: https://packagecloud.io/crowdsec/crowdsec/any any/main arm64 Packages
Description: Crowdsec - An open-source, lightweight agent to detect and respond to bad behaviors. It also automatically benefits from our global community-wide IP reputation database
I did run the curl one otherwise the apt install crowdsec-firewall-bouncer-nftables would not work. Maybe this messed up things ?
Should I avoid the distro package completely ?
tom@home:~$ which -a cscli
/usr/bin/cscli
/bin/cscli
tom@home:~$ which cscli
/usr/bin/cscli
tom@home:~$
tom@home:~$ /bin/cscli notifications test email_default
To list/inspect/test notification template
Usage:
cscli notifications [command]
Aliases:
notifications, notifications, notification
Available Commands:
inspect Inspect active notifications plugin configuration
list List active notifications plugins
reinject reinject alert into notifications system
Flags:
-h, --help help for notifications
Global Flags:
--color string Output color: yes, no, auto. (default "auto")
-c, --config string path to crowdsec config file (default "/etc/crowdsec/config.yaml")
--debug Set logging to debug.
--error Set logging to error.
--info Set logging to info.
-o, --output string Output format: human, json, raw.
--trace Set logging to trace.
--warning Set logging to warning.
Use "cscli notifications [command] --help" for more information about a command.
version: v1.6.3-4851945a
Codename: alphaga
BuildDate: 2024-09-12_09:37:12
GoVersion: 1.22.6
Platform: docker
libre2: C++
User-Agent: crowdsec/v1.6.3-4851945a-docker
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
75f0aee23bcb:/# cscli notifications -h
To list/inspect/test notification template
Usage:
cscli notifications [command]
Aliases:
notifications, notifications, notification
Available Commands:
inspect Inspect notifications plugin
list list notifications plugins
reinject reinject an alert into profiles to trigger notifications
test send a generic test alert to notification plugin
Flags:
-h, --help help for notifications
Global Flags:
--color string Output color: yes, no, auto (default "auto")
-c, --config string path to crowdsec config file (default "/etc/crowdsec/config.yaml")
--debug Set logging to debug
--error Set logging to error
--info Set logging to info
-o, --output string Output format: human, json, raw
--trace Set logging to trace
--warning Set logging to warning
The distro package is on version 1.4.6 so is very outdated you should install the package from our repository. I believe apt info crowdsec you are showing is not the installed version, apt list --installed | grep crowdsec this might show you the older version that is.
apt info crowdsec
Package: crowdsec
Version: 1.6.3
Priority: optional
Section: admin
Maintainer: Crowdsec Team <debian@crowdsec.net>
Running this command shows it’s 1.4.6, but upgradable to 1.6.3.
apt list --installed | grep crowdsec
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.
crowdsec-firewall-bouncer-nftables/any,now 0.0.30 arm64 [installed]
crowdsec/noble-updates,noble-security,now 1.4.6-6ubuntu0.24.04.1 arm64 [installed,upgradable to: 1.6.3]
Since I’ve run curl -s https://install.crowdsec.net | sh to get apt install crowdsec-firewall-bouncer-nftables to work, I also can get the 1.6.3 version of the package.
Upgrading crowdsec, I can see that it fetches the package from Get:7 https://packagecloud.io/crowdsec/crowdsec/any any/main arm64 crowdsec arm64 1.6.3 [40.6 MB]
I’ll reapply my configuration, and let you know if it works
Just note deploying our version over the debian package comes with conflicts as the way the debian package is designed it uses /usr/share for data items which is not where the main package uses them.
The convert the data items to the correct places I created this helper script
