Debian 13.7 crowdsec and fail2ban install note for nginx

[Brave Ye]

sudo apt update && sudo apt install fail2ban -y
curl -s https://install.crowdsec.net | sudo sh
sudo apt update && sudo apt install crowdsec -y
sudo apt install crowdsec-firewall-bouncer-nftables -y
nano /etc/fail2ban/jail.local

Code: Select all

[DEFAULT]
# 💡 白名單：絕對不要封鎖您自己的固定 IP，避免把自己關在外面
ignoreip = 127.0.0.1/8 ::1 123.241.40.195

# 違規處罰：封鎖 1 小時 (1h)，在 10 分鐘 (10m) 內嘗試錯誤達 5 次就封鎖
bantime  = 1h
findtime = 10m
maxretry = 5

# 預設使用 nftables 阻擋所有通訊埠
banaction = nftables-multiport

# -------------------------------------------------------------------------
# 【防禦 1：Nginx 密碼認證暴力破解】
# -------------------------------------------------------------------------
[nginx-http-auth]
enabled = true
port    = http,https
logpath = /var/log/nginx/error.log

# -------------------------------------------------------------------------
# 【防禦 2：網頁惡意探測、漏洞掃描器 (Botsearch)】
# -------------------------------------------------------------------------
# 針對一直嘗試戳敏感檔案（如 .env, wp-login.php, .git）的掃描器直接封鎖
[nginx-botsearch]
enabled = true
port    = http,https
logpath = /var/log/nginx/error.log
maxretry = 2

# -------------------------------------------------------------------------
# 【防禦 3：phpBB 論壇登入暴破】
# -------------------------------------------------------------------------
# 您的 phpBB 位於 /phpBB3/ [1]，當惡意密碼嘗試失敗時，phpBB 會返回特定錯誤
[nginx-phpbb-auth]
enabled  = true
port     = http,https
filter   = nginx-phpbb-auth
logpath  = /var/log/nginx/access.log
maxretry = 5

nano /etc/fail2ban/filter.d/nginx-phpbb-auth.conf

Code: Select all

Definition]
# 匹配 phpBB 登入提交且觸發錯誤重新整理的特徵行為
failregex = ^<HOST> - - \[.*\] "POST /phpBB3/ucp\.php\?mode=login.*HTTP/.*" 200
ignoreregex =

sudo systemctl restart fail2ban

sudo nano /etc/crowdsec/acquis.yaml

Code: Select all

  GNU nano 8.4                                                                 /etc/crowdsec/acquis.yaml                                                                           
filenames:
  - /var/log/nginx/*.log
labels:
  type: nginx

sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/base-http-scenarios

sudo systemctl reload crowdsec
sudo fail2ban-client status nginx-http-auth
sudo fail2ban-client status nginx-botsearch

sudo cscli decisions list
sudo nano /etc/crowdsec/parsers/s02-enrich/whitelists.yaml

Code: Select all

  GNU nano 8.4                                                      /etc/crowdsec/parsers/s02-enrich/whitelists.yaml                                                               
name: crowdsecurity/whitelists
description: "Whitelist events from private ipv4 addresses"
filter: "1==1"
whitelist:
  reason: "private ipv4/ipv6 ip/ranges and my own ip"
  ip: 
    - "::1"
    - "123.241.40.195"
  cidr:
    - "127.0.0.0/8"
    - "192.168.0.0/16"
    - "10.0.0.0/8"
    - "172.16.0.0/12"
    - "127.0.0.1/8"
    - "::1/128"

sudo systemctl restart crowdsec
sudo systemctl status crowdsec
sudo systemctl status crowdsec-firewall-bouncer

sudo systemctl enable fail2ban
sudo systemctl enable crowdsec
sudo systemctl enable crowdsec-firewall-bouncer
檢查 CrowdSec 端的 Bouncer 狀態：
sudo cscli bouncers list
檢查 nftables 規則鏈
sudo nft list ruleset | grep crowdsec