CyberMind-FR
252341e045
New packages: - secubox-crowdsec-setup: Automated installation script with: - Prerequisites verification (RAM, flash, OpenWrt version) - syslog-ng4 configuration for log forwarding - CAPI registration and hub setup - nftables firewall bouncer configuration - Backup/rollback, repair, and uninstall modes - luci-app-secubox-crowdsec: LuCI dashboard with: - Service status and statistics dashboard - Active decisions (bans) management - Security alerts viewer - Collections and bouncers management - UCI-based settings configuration Enhanced existing packages: - luci-app-crowdsec-dashboard: Added acquisition configuration wizard - secubox-app-crowdsec: Improved defaults and configuration Documentation: - CROWDSEC-OPENWRT-24.md with architecture, installation, and troubleshooting Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
29 lines
835 B
YAML
29 lines
835 B
YAML
# OpenWrt System Syslog Acquisition
|
|
# This configuration monitors OpenWrt system logs via syslog
|
|
# For local log files or syslog forwarding scenarios
|
|
#
|
|
# Note: OpenWrt uses logd by default which doesn't write to files.
|
|
# Enable syslog-ng or configure log_file in /etc/config/system
|
|
# to enable file-based log acquisition.
|
|
#
|
|
# Required collections:
|
|
# cscli collections install crowdsecurity/linux
|
|
# cscli parsers install crowdsecurity/syslog-logs
|
|
|
|
# File-based acquisition for syslog (if log_file is configured)
|
|
filenames:
|
|
- /var/log/messages
|
|
- /var/log/syslog
|
|
labels:
|
|
type: syslog
|
|
---
|
|
# Alternative: Syslog service acquisition
|
|
# Uncomment this section if using remote syslog forwarding
|
|
# or if CrowdSec should act as a syslog server
|
|
#
|
|
# source: syslog
|
|
# listen_addr: 127.0.0.1
|
|
# listen_port: 10514
|
|
# labels:
|
|
# type: syslog
|