Skip to content

Commit 71647e8

Browse files
author
jdv
committed
init
1 parent d520aae commit 71647e8

File tree

2 files changed

+289
-0
lines changed

2 files changed

+289
-0
lines changed

‎crowdsec-docs/unversioned/user_guides/interactive_se_install/01_import_test.mdx‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
**Ceci** est du *MDX importé.*
2+
3+
Est ce qu'il est bien rendu en **HTML** ou pas ?
4+
5+
---
6+
7+
## test 01
8+
9+
blabliblu
10+
11+
### test 01 sub
12+
13+
blobloubla

‎crowdsec-docs/unversioned/user_guides/interactive_se_install/01_install.mdx‎

Lines changed: 276 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
---
2+
id: i_se_install_01
3+
title: Security Engine Installation
4+
---
5+
6+
import Tabs from '@theme/Tabs';
7+
import TabItem from '@theme/TabItem';
8+
import CodeBlock from '@theme/CodeBlock';
9+
10+
import testmdximport from './01_import_test.mdx';
11+
12+
# Interractive Security Engine Installation Guide
13+
14+
Welcome! This interactive guide will help you set up your CrowdSec Security Engine and validate each step to ensure proper operation.
15+
We'll guide you through detecting and remediating malicious behavior in your services' logs, regardless of your chosen implementation (on host, Docker, Kubernetes)
16+
17+
:::info
18+
Note that to go further later you'll be able to enable Application Security and benefit from our ever growing collection of Virtual Patching rules. We'll mention the appropriate dependencies as we go along.
19+
Lastly, note that we'll cover a setup that focuses on an autonomous security engine parsing the logs of any services from local or remote servers.
20+
In appendix we'll cover the possibility to have distributed security engines on each servers, centralizing their alerts on a central security engine.
21+
:::
22+
23+
## Install CrowdSec
24+
25+
The first step is to install the CrowdSec Security Engine somewhere you'll have access to the logs of services you want to protect.
26+
You can choose to install it directly on the host, in a Docker container, or in a Kubernetes cluster.
27+
28+
For a first experience, we recommend installing it on a host machine, as it will allow you to easily access the logs of your services and test the remediation capabilities.
29+
But if you're comfortable with Docker it also is a great way to get started and run CrowdSec in a containerized environment.
30+
31+
### Instructions
32+
33+
/* We'll have to see how precise and embeded we want the various guides to be with this page
34+
If we want full guides in here we'd better be able to embed files or pieces of files rather than copy paste
35+
*/
36+
<Tabs
37+
defaultValue="host"
38+
groupId="install-implementation"
39+
values={[
40+
{label: 'Host', value: 'host'},
41+
{label: 'Docker', value: 'docker'},
42+
{label: 'Kubernetes', value: 'kubernetes'},
43+
]}
44+
>
45+
<TabItem value="host">
46+
<p>Here are the various hosts you can install CrowdSec on:</p>
47+
// mention guide for linux, Windows, macOS, FreeBSD, pfSense, OPNSense with links to the existing docs
48+
<ul>
49+
<li><a href="/u/getting_started/installation/linux.md">Linux</a></li>
50+
<li><a href="/u/getting_started/installation/windows.md">Windows</a></li>
51+
<li><a href="/u/getting_started/installation/macos.md">macOS</a></li>
52+
<li><a href="/u/getting_started/installation/freebsd.md">FreeBSD</a></li>
53+
<li><a href="/u/getting_started/installation/pfsense.md">pfSense</a></li>
54+
<li><a href="/u/getting_started/installation/opnsense.md">OPNSense</a></li>
55+
</ul>
56+
</TabItem>
57+
<TabItem value="docker">
58+
// mention the current guide u/getting_started/installation/docker and this page having all the env variable https://hub.docker.com/r/crowdsecurity/crowdsec
59+
<p>To install CrowdSec in a Docker container, you can follow the instructions in our <a href="/u/getting_started/installation/docker.md">Docker Installation Guide</a>.</p>
60+
<p>For more information on the available environment variables, you can refer to the <a href="https://hub.docker.com/r/crowdsecurity/crowdsec">Docker Hub page</a>.</p>
61+
</TabItem>
62+
<TabItem value="kubernetes">
63+
// mention the current guide u/getting_started/installation/kubernetes and this page having all the env variable https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx
64+
<p>To install CrowdSec in a Kubernetes cluster, you can follow the instructions in our <a href="/u/getting_started/installation/kubernetes.md">Kubernetes Installation Guide</a>.</p>
65+
<p>For more information on the available environment variables, you can refer to the <a href="https://artifacthub.io/packages/helm/crowdsec/crowdsec">Artifact Hub page</a>.</p>
66+
</TabItem>
67+
</Tabs>
68+
69+
### Verification
70+
71+
// dump the content of the testmdximport mdx file here
72+
// this is a test to see if the mdx import works properly
73+
// if it does not work, we can remove this part and just have the testmdximport in the next section
74+
<testmdximport />
75+
76+
### Troubleshooting
77+
78+
79+
80+
81+
## Repository Installation
82+
83+
The CrowdSec repository contains the latest stable version of CrowdSec and is the recommended way to install our packages.
84+
85+
86+
87+
```bash
88+
curl -s https://install.crowdsec.net | sudo sh
89+
```
90+
91+
### Manual Repository Installation
92+
93+
If you prefer to manually add the repository, you can do so by following the instructions below.
94+
95+
<details>
96+
97+
<summary>Manual Repository Installation</summary>
98+
99+
<Tabs
100+
defaultValue="debian"
101+
groupId="manual-repo-install"
102+
values={[
103+
{label: 'Deb', value: 'debian'},
104+
{label: 'RPM', value: 'rpm'},
105+
]}
106+
>
107+
<TabItem value="debian">
108+
<>
109+
<p>Begin by refreshing your package cache by running</p>
110+
<CodeBlock className="language-bash">sudo apt update</CodeBlock>
111+
<p>If you are running Debian, install debian-archive-keyring so that official Debian repositories will be verified (Ubuntu users can skip this)</p>
112+
<CodeBlock className="language-bash">sudo apt install debian-archive-keyring</CodeBlock>
113+
<p>Ensure the required tools (curl, gpg, apt-transport-https) are installed before proceeding:</p>
114+
<CodeBlock className="language-bash">sudo apt install -y curl gnupg apt-transport-https</CodeBlock>
115+
<p>In order to install a deb repo, first you need to install the GPG key that used to sign repository metadata. This will change depending on whether or not your apt version is >= v.1.1. You can check this by running:</p>
116+
<CodeBlock className="language-bash">apt -v</CodeBlock>
117+
<p>For apt version >= v1.1:</p>
118+
<p>(Equivalent to or later than Debian/Raspbian Stretch, Ubuntu Xenial, Linux Mint Sarah, Elementary OS Loki)</p>
119+
> Create the directory to import the GPG key:
120+
>From apt v2.4.0, `/etc/apt/keyrings/` is the designated directory for administrator imported keys. We will be using that for the following instructions, but you can replace `/etc/apt/keyrings/` with any path of your choosing. If you need to create the directory, run:
121+
>
122+
> <CodeBlock className="language-bash">mkdir -p /etc/apt/keyrings/</CodeBlock>
123+
> Then add the GPG key:
124+
>
125+
> <CodeBlock className="language-bash">curl -fsSL https://packagecloud.io/crowdsec/crowdsec/gpgkey | gpg --dearmor > /etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg</CodeBlock>
126+
> Create a file named `/etc/apt/sources.list.d/crowdsec_crowdsec.list` that contains the repository configuration below.
127+
>
128+
> <CodeBlock className="language-bash">deb [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/any any main
129+
deb-src [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/any any main </CodeBlock>
130+
131+
<p>For apt version < v1.1:</p>
132+
<p>(Equivalent to or older than Debian/Raspbian Jessie, Ubuntu Wily, Linux Mint Rosa, Elementary OS Freya)</p>
133+
> Add the GPG key:
134+
>
135+
> <CodeBlock className="language-bash">curl -fsSL https://packagecloud.io/crowdsec/crowdsec/gpgkey | gpg --dearmor > /etc/apt/trusted.gpg.d/crowdsec_crowdsec.gpg</CodeBlock>
136+
> Create a file named `/etc/apt/sources.list.d/crowdsec_crowdsec.list` that contains the repository configuration below.
137+
>
138+
> <CodeBlock className="language-bash">deb https://packagecloud.io/crowdsec/crowdsec/any any main
139+
deb-src https://packagecloud.io/crowdsec/crowdsec/any any main</CodeBlock>
140+
141+
<p>Run this command update your local APT cache:</p>
142+
<CodeBlock className="language-bash">sudo apt update</CodeBlock>
143+
<p>You can now install packages from your repository.</p>
144+
</>
145+
</TabItem>
146+
<TabItem value="rpm">
147+
<>
148+
<p>Install pygpgme, a package which allows yum to handle gpg signatures, and a package called yum-utils which contains the tools you need for installing source RPMs.</p>
149+
<CodeBlock className="language-bash">sudo yum install pygpgme yum-utils</CodeBlock>
150+
<p>You may need to install the EPEL repository for your system to install these packages. If you do not install pygpgme, GPG verification will not work.</p>
151+
<p>Create a file named /etc/yum.repos.d/crowdsec_crowdsec.repo that contains the repository configuration below.</p>
152+
<p>Make sure to replace `el` and `6` in the config below with your Linux distribution and version:</p>
153+
<CodeBlock className="language-bash">
154+
[crowdsec_crowdsec]
155+
name=crowdsec_crowdsec
156+
baseurl=https://packagecloud.io/crowdsec/crowdsec/el/6/$basearch
157+
repo_gpgcheck=1
158+
gpgcheck=1
159+
enabled=1
160+
gpgkey=https://packagecloud.io/crowdsec/crowdsec/gpgkey
161+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-EDE2C695EC9A5A5C.pub.gpg
162+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-C822EDD6B39954A1.pub.gpg
163+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-FED78314A2468CCF.pub.gpg
164+
sslverify=1
165+
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
166+
metadata_expire=3600
167+
168+
[crowdsec_crowdsec-source]
169+
name=crowdsec_crowdsec-source
170+
baseurl=https://packagecloud.io/crowdsec/crowdsec/el/6/SRPMS
171+
repo_gpgcheck=1
172+
gpgcheck=1
173+
enabled=1
174+
gpgkey=https://packagecloud.io/crowdsec/crowdsec/gpgkey
175+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-EDE2C695EC9A5A5C.pub.gpg
176+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-C822EDD6B39954A1.pub.gpg
177+
https://packagecloud.io/crowdsec/crowdsec/gpgkey/crowdsec-crowdsec-FED78314A2468CCF.pub.gpg
178+
sslverify=1
179+
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
180+
metadata_expire=3600
181+
</CodeBlock>
182+
<p>Update your local yum cache by running</p>
183+
<CodeBlock className="language-bash">sudo yum -q makecache -y --disablerepo='*' --enablerepo='crowdsec_crowdsec'</CodeBlock>
184+
<p>You can now install packages from your repository.</p>
185+
</>
186+
</TabItem>
187+
</Tabs>
188+
189+
</details>
190+
191+
### Install Security Engine
192+
193+
Once the repository is added, you can install the Security Engine via:
194+
195+
<Tabs
196+
defaultValue="debian"
197+
groupId="operating-systems"
198+
values={[
199+
{label: 'Debian/Ubuntu', value: 'debian'},
200+
{label: 'EL/Centos7/Amzn Linux 2', value: 'centos7'},
201+
{label: 'EL/Centos Stream 8', value: 'centos8'},
202+
{label: 'SUSE Linux', value: 'suselinux'},
203+
{label: 'OpenWRT', value: 'openwrt'},
204+
{label: 'CloudLinux', value: 'cloudlinux'},
205+
]}>
206+
<TabItem value="debian">
207+
<CodeBlock className="language-bash">apt install crowdsec</CodeBlock>
208+
</TabItem>
209+
210+
<TabItem value="centos7">
211+
<CodeBlock className="language-bash">yum install crowdsec</CodeBlock>
212+
</TabItem>
213+
214+
<TabItem value="centos8">
215+
<CodeBlock className="language-bash">dnf install crowdsec</CodeBlock>
216+
</TabItem>
217+
218+
<TabItem value="suselinux">
219+
<CodeBlock className="language-bash">zypper install crowdsec</CodeBlock>
220+
</TabItem>
221+
222+
<TabItem value="openwrt">
223+
<CodeBlock className="language-bash">opkg install crowdsec</CodeBlock>
224+
</TabItem>
225+
226+
<TabItem value="cloudlinux">
227+
<CodeBlock className="language-bash">yum install crowdsec</CodeBlock>
228+
</TabItem>
229+
</Tabs>
230+
231+
232+
### Install Remediation Component
233+
234+
:::warning
235+
Security Engine by itself is a detection engine, it will not block anything. You need to install a [Remediation Component](/bouncers/intro.md) to enforce decisions
236+
:::
237+
238+
For the quick start guide we will be installing the [iptables](https://en.wikipedia.org/wiki/Iptables) firewall [Remediation Component](/bouncers/intro.md). (This may not be optimal for your environment, please refer to the [Remediation Documentation](/bouncers/intro.md) for more information)
239+
240+
#### IPTables
241+
242+
<Tabs
243+
defaultValue="iptables_debian"
244+
values={[
245+
{ label: 'Debian/Ubuntu', value: 'iptables_debian' ,},
246+
{ label: 'RHEL/Centos/Fedora', value: 'iptables_rhel', },
247+
{ label: 'SUSE Linux', value: 'iptables_suse', },
248+
]
249+
}>
250+
<TabItem value="iptables_debian">
251+
252+
```bash
253+
sudo apt install crowdsec-firewall-bouncer-iptables
254+
```
255+
256+
</TabItem>
257+
<TabItem value="iptables_rhel">
258+
259+
```bash
260+
sudo yum install crowdsec-firewall-bouncer-iptables
261+
```
262+
263+
</TabItem>
264+
265+
<TabItem value="iptables_suse">
266+
267+
```bash
268+
sudo zypper install crowdsec-firewall-bouncer-iptables
269+
```
270+
271+
</TabItem>
272+
</Tabs>
273+
274+
## Next Steps?
275+
276+
Great, you now have CrowdSec installed on your system. Within the [post installation steps](/getting_started/next_steps.md) you will find the next steps to configure and optimize your installation.

0 commit comments

Comments
 (0)