How to: Application Intrusion Detection And Prevention With CrowdSec
#### Why

UFW tells your server what doors to board up so nobody can see them, and what doors to allow authorized users through. PSAD monitors network activity to detect and prevent potential intrusions -- repeated attempts to get in. 

CrowdSec is similar to Fail2Ban in that it monitors the logs of your applications (like SSH and Apache) to detect and prevent potential intrusions. However, CrowdSec is coupled with a community that shares threat intelligence back to CrowdSec to then distribute a Community Blocklist to all users.

#### How It Works

CrowdSec monitors the logs of your applications (like SSH and Apache) to detect and prevent potential intrusions. It will monitor network traffic/logs and prevent intrusions by blocking suspicious activity (e.g. multiple successive failed connections in a short time-span). Once a malicious IP is detected, it will be added to your local decision list and threat information is shared with CrowdSec to update the Community Blocklist on malicious IP addresses. Once an IP address hits a certain threshold of malicious activity, it will be automatically propogated to all other CrowdSec users to proactively block.

#### Goals

- network monitoring for suspicious activity with automatic banning of offending IPs

#### Notes

- As of right now, the only thing running on this server is SSH so we'll want CrowdSec to monitor SSH and ban as necessary.
- As you install other programs, you'll need to install additional collections and configure the appropriate acquisitions.

#### References

- https://www.crowdsec.net/
- [Read how CrowdSec curates the Community Blocklist](https://www.crowdsec.net/our-data)
- [Read what threat intelligence is shared with CrowdSec](https://docs.crowdsec.net/docs/next/central_api/intro#signal-meta-data)
- https://docs.crowdsec.net/

#### Steps

1. Install CrowdSec Security Engine. (IDS)

    On any linux distro (including Debian based systems)
    
    Install the CrowdSec repository:
    ``` bash
    curl -s https://install.crowdsec.net | sudo sh
    ```

    Install the CrowdSec Security Engine:
    ``` bash
    sudo apt install crowdsec
    ```

> [!TIP]
> if `curl | sh` is not your thing, you can find additional install methods [here](https://docs.crowdsec.net/u/getting_started/installation/linux).

By default whilst CrowdSec is installing the Security Engine it will auto-discover your installed applications and install the appropriate parsers and scenarios for them. Since we know most Linux servers are running ssh out of the box CrowdSec will automatically configured this for you.

2. Install a Remediation Component. (IPS)

    CrowdSec by itself is a detection engine, since in most modern infrastructures you may have an upstream firewall or WAF, CrowdSec will not block the IP addresses by itself. You can install a Remediation Component to block the IP addresses detected by CrowdSec.
    ```bash
    sudo apt install crowdsec-firewall-bouncer-iptables
    ```

> [!TIP]
> If your installation of UFW is not using `iptables` as the backend, you can alternatively install `crowdsec-firewall-bouncer-nftables`. There is no difference in the installed binaries, only the configuration file is different.

By default whilst the Remediation Component is installing it will auto-configure the necessary settings to work with the Security Engine if deployed on the same host (and if the security engine is not within a container environment).

3. Check detection and remediation is working as intended:

    CrowdSec package comes with a CLI tool to check the status of the Security Engine and the Remediation Component.

    ```bash
    sudo cscli metrics
    ```

    ```bash
    Acquisition Metrics:
    ╭────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────╮
    │ Source                 │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
    ├────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
    │ file:/var/log/auth.log │ 5          │ 4            │ 1              │ 10                     │ -                 │
    │ file:/var/log/syslog   │ 30         │ -            │ 30             │ -                      │ -                 │
    ╰────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯

    Local API Decisions:
    ╭────────────────────────────────────────────┬────────┬────────┬───────╮
    │ Reason                                     │ Origin │ Action │ Count │
    ├────────────────────────────────────────────┼────────┼────────┼───────┤
    │ crowdsecurity/http-backdoors-attempts      │ CAPI   │ ban    │ 73    │
    │ crowdsecurity/http-bad-user-agent          │ CAPI   │ ban    │ 4836  │
    │ crowdsecurity/http-path-traversal-probing  │ CAPI   │ ban    │ 87    │
    │ crowdsecurity/http-probing                 │ CAPI   │ ban    │ 2010  │