CyberMind-FR
252341e045
New packages: - secubox-crowdsec-setup: Automated installation script with: - Prerequisites verification (RAM, flash, OpenWrt version) - syslog-ng4 configuration for log forwarding - CAPI registration and hub setup - nftables firewall bouncer configuration - Backup/rollback, repair, and uninstall modes - luci-app-secubox-crowdsec: LuCI dashboard with: - Service status and statistics dashboard - Active decisions (bans) management - Security alerts viewer - Collections and bouncers management - UCI-based settings configuration Enhanced existing packages: - luci-app-crowdsec-dashboard: Added acquisition configuration wizard - secubox-app-crowdsec: Improved defaults and configuration Documentation: - CROWDSEC-OPENWRT-24.md with architecture, installation, and troubleshooting Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
30 lines
1.2 KiB
YAML
30 lines
1.2 KiB
YAML
# OpenWrt Dropbear SSH Acquisition
|
|
# This configuration monitors SSH authentication logs from Dropbear
|
|
#
|
|
# Dropbear logs are typically sent to syslog and can be found in:
|
|
# - /var/log/messages (if syslog is configured to write to file)
|
|
# - Via logread command (OpenWrt default)
|
|
#
|
|
# Required collections:
|
|
# cscli collections install crowdsecurity/linux
|
|
# cscli parsers install crowdsecurity/syslog-logs
|
|
#
|
|
# The crowdsecurity/linux collection includes SSH brute-force detection
|
|
# scenarios that work with Dropbear authentication logs.
|
|
#
|
|
# Example Dropbear log entries that will be parsed:
|
|
# dropbear[1234]: Bad password attempt for 'root' from 192.168.1.100:54321
|
|
# dropbear[1234]: Login attempt for nonexistent user 'admin' from 192.168.1.100:54321
|
|
# dropbear[1234]: Pubkey auth succeeded for 'root' with ssh-ed25519 key
|
|
# dropbear[1234]: Exit (root) from <192.168.1.100:54321>: Disconnect received
|
|
#
|
|
# Note: Since Dropbear logs go to syslog, the openwrt-syslog.yaml
|
|
# acquisition config will capture these logs. This file serves as
|
|
# documentation for Dropbear-specific detection.
|
|
|
|
# If using a dedicated auth log file:
|
|
# filenames:
|
|
# - /var/log/auth.log
|
|
# labels:
|
|
# type: syslog
|