88670f028f
Measured on the demo box against the same 24h of real traffic. Episode 12 (detection, blocklist, firewall): - crowdsec/ with install notes and the traps: port 8080 clash, empty first blocklist pull, replay forensic-mode dropping events (FIFO workaround), ssh-time-based-bf shipping remediation:false, the AppSec collections that refuse to start without extra rules. - firewall bouncer in nftables mode (input + forward), which blocks Docker-published ports and survives ufw reload; iptables/DOCKER-USER does not. - HARDENING.md episode 12 section with the numbers: fail2ban 4 banned IPs vs CrowdSec 23 detected / 1 blocked, blocklist overlap 50% of IPs but 19% of attempts, and the mode=normal blind spot for key-only root attempts. Episode 13 (AppSec WAF): - caddy/Dockerfile now builds the CrowdSec bouncer and AppSec handler alongside rate-limit, pinned to v0.14.1. - Caddyfile imports a crowdsec snippet (bouncer + appsec) on every site except vpn; compose passes CROWDSEC_BOUNCER_KEY and host.docker.internal. - Measured: virtual patching blocks known CVEs only (7 of 41 probes, near-zero false positives); OWASP CRS raises that to 27 of 41 but breaks git push and wiki editing at default paranoia. Default stays vpatch+generic. fail2ban config unchanged. No secrets or real domains/IPs in tracked files.
12 lines
576 B
YAML
12 lines
576 B
YAML
# episode 12: the keys changed in /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
|
|
# (the package writes the rest, including api_url and api_key).
|
|
#
|
|
# nftables mode instead of the iptables default. The bouncer then owns its
|
|
# own tables (ip crowdsec, ip6 crowdsec6) with hooks on input AND forward at
|
|
# priority -10, so it drops before Docker's FORWARD rules, and `ufw reload`
|
|
# does not touch it. In iptables mode you must add DOCKER-USER to
|
|
# iptables_chains, and every `ufw reload` silently removes the rule again.
|
|
mode: nftables
|
|
nftables_hooks:
|
|
- input
|
|
- forward
|