Stephane de Labrusse stephdl

Crowdsec protect your network with NethServer8 (NS8 == centos9 stream)

Crowdsec is a new project to protect against brute force Crowdsec's architecture allows distributed setups, as most components communicate via HTTP API.

When doing such, a few considerations must be kept in mind to understand the role of each component:

The agent is in charge of processing the logs, matching them against scenarios, and sending the resulting alerts to the local API (container)
The local API (LAPI from now on) receives the alerts and converts them into decisions based on your profile (container)
The bouncer(s) query the LAPI to receive the decisions to be applied (can be installed by .deb .rpm and openwrt package)

intro: https://docs.crowdsec.net/docs/intro


	PHP logo
	PHP Version 8.4.11
	System Linux webserver 5.14.0-570.30.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jul 30 15:58:22 UTC 2025 x86_64
	Build Date Aug 12 2025 22:29:13
	Build System Linux - Docker
	Build Provider https://github.com/docker-library/php
	Configure Command './configure' '--build=x86_64-linux-gnu' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--enable-option-checking=fatal' '--with-mhash' '--with-pic' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-sodium=shared' '--with-pdo-sqlite=/usr' '--with-sqlite3=/usr' '--with-curl' '--with-iconv' '--with-openssl' '--with-readline' '--with-zlib' '--disable-phpdbg' '--with-pear' '--with-libdir=lib/x86_64-linux-gnu' '--disable-cgi' '--enable-fpm' '--with-fpm-user=www-data' '--with-fpm-group=www-data' 'build_alias=x86_64-linux-gnu' 'PHP_UNAME=Linux - Docker' 'PHP_BUILD_PROVIDER=https://github.com/docker-library/php'
	Server API FPM/FastCGI
	Virtual Directory Support disabled


	PHP logo
	PHP Version 8.4.6
	System Linux webserver 5.14.0-570.30.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jul 30 15:58:22 UTC 2025 x86_64
	Build Date May 5 2025 21:21:05
	Build System Linux 21fb9428df78 6.1.0-23-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.99-1 (2024-07-15) x86_64 GNU/Linux
	Configure Command '/bitnami/blacksmith-sandox/php-8.4.6/configure' '--prefix=/opt/bitnami/php' '--with-zlib-dir' '--with-zlib' '--with-libxml-dir=/usr' '--enable-soap' '--disable-rpath' '--enable-inline-optimization' '--with-bz2' '--enable-sockets' '--enable-pcntl' '--enable-exif' '--enable-bcmath' '--with-pdo-mysql=mysqlnd' '--with-mysqli=mysqlnd' '--with-png-dir=/usr' '--with-openssl' '--with-libdir=/lib/x86_64-linux-gnu' '--enable-ftp' '--enable-calendar' '--with-gettext' '--with-xmlrpc' '--with-xsl' '--enable-fpm' '--with-fpm-user=daemon' '--with-fpm-group=daemon' '--enable-mbstring' '--enable-cgi' '--enable-ctype' '--enable-session' '--enable-mysqlnd' '--enable-intl' '--with-iconv' '--with-pdo_sqlite' '--with-sqlite3'

	How to set up password-less SSH login for a Dropbear client
	Caveat Lector: This blog post was published 8 years ago. Depending on the content, it may no longer be applicable or relevant.
	Dropbear is a replacement for OpenSSH for environments with low memory and processor resources. With OpenSSH, you can use the well-known ssh-keyen command to create a private/public keypair for the client. In Dropbear, it is a bit different. Here are the commands on the client:

	mkdir ~/.ssh
	chmod 700 ~/.ssh/
	dropbearkey -t rsa -f ~/.ssh/id_dropbear
	Both private and public keys will be in ~/.ssh/id_dropbear, however, in a binary format.

	To output the public key to stdout in the usual SSH-compatible format, use:

	cd /tmp
	echo "[+] backing up db"
	mariabackup --backup --target-dir=/tmp/backupSQL --user=backup --password=backup

	ndays=7

	MM=`date --date="$ndays days ago" +%b`
	DD=`date --date="$ndays days ago" +%d`

	echo "[+] listing files in ftp"

	Les tests sur le serveur soyoustart on été faits en mode rescue
	mac du serveur : link/ether 02:00:00:4c:f1:72
	addresse IP failover du serveur inet 135.125.117.41/32
	mac de mon laptop distant : link/ether c6:1b:b1:a0:42:b1
	adresse LAN IP de mon laptop : inet 192.168.12.25/24
	adresse IP publique de mon ldaptop : Pub 90.1.234.244

	En mode rescue j'ai crée un bridge provisoire comme la documentation le demande a
	https://docs.ovh.com/gb/en/dedicated/network-bridging/#troubleshooting_1

	J'ai suivi le debug de https://docs.ovh.com/fr/dedicated/network-bridging/#resolution-des-defauts

	nous venons d'essayer pour la troisième fois de changer la mac address (une fois nous meme, une fois avec le support OVH)
	voir https://gist.github.com/stephdl/41e2d2baa51425b604f33a8adeeabc03

	╰─➤ ssh [email protected] 255 ↵
	[email protected]'s password:

	The programs included with the Debian GNU/Linux system are free software;
	the exact distribution terms for each program are described in the

	╰─➤ diff beforeTlsFix afterTlsFix
	0a1,2
	> [root@ns7loc14 ~]# tlspolicy 20200510
	> -bash: tlspolicy: command not found
	10a13,22
	> \| TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
	> \| TLS_DHE_RSA_WITH_AES_128_CBC_SHA - strong
	> \| TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 - strong
	> \| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 - strong
	> \| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong

	[root@ns7loc13 ~]# yum install netherver-squid http://packages.nethserver.org/nethserver/7.8.2003/autobuild/x86_64/Packages/nethserver-squidguard-2.0.0-1.2.pr34.g1d6b7e5.ns7.noarch.rpm -y
	Loaded plugins: changelog, fastestmirror, nethserver_events
	Determining fastest mirrors
	epel/x86_64/metalink \| 20 kB 00:00:00
	* ce-base: mirror.vorboss.net
	* ce-extras: mirror.vorboss.net
	* ce-sclo-rh: mirror.vorboss.net
	* ce-sclo-sclo: mirror.vorboss.net
	* ce-updates: mirror.vorboss.net
	* epel: mirrors.ircam.fr