New to crowdSec, some questions

[thibault]

Hello @thib3113 !

@thib3113

Here is my use case :

• I try to setup a new machine ( 4 ), to run bouncers only
• I run the wizard, but I didn’t need to setup acquisitions ( the machine will only be attacked by internal ips … I doesn’t want to ban them ) ( my router will scan my network for threats )
• I didn’t find an option that will install + startup daemon
• –bininstall seems to doesn’t enable the daemon

Which kind of bouncer are you trying to setup ? Most bouncers should warn you if cscli isn’t present on the machine that it can’t add the API key itself, but it shouldn’t make the install fail

edit: just saw that the custom bouncer doesn’t handle this gracefully, opening an issue to fix it

Plus, if the machine is to run bouncer only, it doesn’t have to have crowdsec running directly. The bouncers communicate via a HTTP rest API to the Local API for this purpose !

see schema :

@thib3113

other thing, I finally suceed to setup the custom bouncer, and I saw lot of ips multiples times … for example, on 900 ips, I’ve only 68 uniq ip … Is it normal ? ( it can be a bug on my script too, but for the moment, its seems I have lot of multiples )

This is weird indeed, can you tell me more about the bouncer ? when the bouncer “polls” the API, it should receive “new” and “expired” decisions, so that you shouldn’t have any multiples