crowdsec: version-control Synology syslog pipeline and ban profiles

Since Jul 12 the stack ingests Synology DSM syslog (fids/fids2 -> Log
Center -> 192.168.0.142:5514/udp), but only the published port was in the
working tree and the actual config lived exclusively in the crowdsec-config
named volume -- a volume reset would have silently dropped the Synology
detection and the escalating ban policy.

Moved into the repo and bind-mounted (single source of truth; the shadowed
copies were removed from the volume):
- crowdsec/acquis-synology.yaml -> acquis.d/synology.yaml (syslog listener)
- crowdsec/parsers/famfihome-synology-connection.yaml -> s01-parse/
  (local parser for DSM 7 "Connection" failed sign-ins -> synology-dsm-bf)
- crowdsec/profiles.yaml (escalating ban (count+1)*12h, capped at 168h)

Also commits the previously untracked 5514:514/udp port mapping.

Verified after recreate: syslog listener bound on :514, lines arriving from
192.168.0.234, traefik access.log tail active, local parser loaded, cscli
explain on a DSM sign-in failure still reaches crowdsecurity/synology-dsm-bf,
26 active decisions preserved, both bouncers pulling.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

crowdsec/acquis-synology.yaml

@@ -0,0 +1,13 @@
+# CrowdSec acquisition: Syslog-Listener fuer die Synology-NAS (fids/fids2)
+# Gemountet nach /etc/crowdsec/acquis.d/synology.yaml (siehe docker-compose.yml)
+#
+# Die Synologies senden per DSM "Log Center -> Log Sending" an
+# 192.168.0.142:5514/udp; Docker mappt das auf Port 514 im Container.
+# Das Label "syslog" aktiviert s00-raw/crowdsecurity/syslog-logs; darauf
+# setzen crowdsecurity/synology-dsm (+ der lokale Parser
+# parsers/famfihome-synology-connection.yaml) auf.
+source: syslog
+listen_addr: 0.0.0.0
+listen_port: 514
+labels:
+  type: syslog

crowdsec/parsers/famfihome-synology-connection.yaml

@@ -0,0 +1,24 @@
+# Lokaler CrowdSec-Parser (kein Hub-Item).
+# Gemountet nach /etc/crowdsec/parsers/s01-parse/famfihome-synology-connection.yaml
+# (siehe docker-compose.yml). Ergaenzt crowdsecurity/synology-dsm-logs um das
+# "Connection"-Programm des DSM-7-Log-Centers; speist crowdsecurity/synology-dsm-bf.
+name: famfihome/synology-connection-logs
+description: "Synology Log Center 'Connection' events (DSM 7 sign-in failures)"
+filter: "evt.Parsed.program == 'Connection'"
+onsuccess: next_stage
+pattern_syntax:
+  IPv4_WA: '(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
+  IP_WA: '(?:%{IPV6}|%{IPv4_WA})'
+nodes:
+  - grok:
+      pattern: 'User \[%{DATA:user}\] from \[%{IP_WA:src_ip}\] failed to sign in to \[%{DATA:service}\] via \[%{DATA:method}\]'
+      apply_on: message
+      statics:
+        - meta: log_type
+          value: synology-dsm_failed_auth
+        - meta: service
+          value: synology-dsm
+        - meta: source_ip
+          expression: "evt.Parsed.src_ip"
+        - meta: user
+          expression: "evt.Parsed.user"

crowdsec/profiles.yaml

@@ -0,0 +1,30 @@
+name: default_ip_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Ip"
+decisions:
+ - type: ban
+   duration: 12h
+# Escalating ban: 1st 12h; repeat offenders (while still listed) 24h, 36h ...; capped at 168h (7d)
+duration_expr: Sprintf('%dh', min((GetDecisionsCount(Alert.GetValue()) + 1) * 12, 168))
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break
+---
+name: default_range_remediation
+#debug: true
+filters:
+ - Alert.Remediation == true && Alert.GetScope() == "Range"
+decisions:
+ - type: ban
+   duration: 12h
+duration_expr: Sprintf('%dh', min((GetDecisionsCount(Alert.GetValue()) + 1) * 12, 168))
+# notifications:
+#   - slack_default  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
+#   - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
+#   - http_default   # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
+#   - email_default  # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.
+on_success: break

docker-compose.yml

@@ -48,8 +48,16 @@ services:
       - crowdsec-db:/var/lib/crowdsec/data
       - traefik-logs:/var/log/traefik:ro            # liest Traefiks Access-Log
       - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.d/traefik.yaml:ro,Z
+      # Syslog-Quelle Synology (fids/fids2) + lokaler Parser dazu. Beides liegt
+      # im Repo (nicht nur im crowdsec-config-Volume), damit es ein Volume-Reset
+      # ueberlebt.
+      - ./crowdsec/acquis-synology.yaml:/etc/crowdsec/acquis.d/synology.yaml:ro,Z
+      - ./crowdsec/parsers/famfihome-synology-connection.yaml:/etc/crowdsec/parsers/s01-parse/famfihome-synology-connection.yaml:ro,Z
+      # Eskalierende Ban-Dauer ((count+1)*12h, max 168h) - haendisch gepflegt
+      - ./crowdsec/profiles.yaml:/etc/crowdsec/profiles.yaml:ro,Z
     ports:
       - "192.168.0.142:6060:6060"   # Prometheus-Metriken (CrowdSec) fuer 192.168.0.23
+      - "192.168.0.142:5514:514/udp"  # Syslog von den Synologies (DSM Log Center)
 
   # MikroTik-Bouncer: spiegelt CrowdSec-Decisions in eine RouterOS-Firewall-
   # Address-List ("crowdsec") auf der AX3 -> Edge-Drop (alle Ports, auch VPN/SSH).