Lutz Finsterle
ecca92f3ed
Since Jul 12 the stack ingests Synology DSM syslog (fids/fids2 -> Log Center -> 192.168.0.142:5514/udp), but only the published port was in the working tree and the actual config lived exclusively in the crowdsec-config named volume -- a volume reset would have silently dropped the Synology detection and the escalating ban policy. Moved into the repo and bind-mounted (single source of truth; the shadowed copies were removed from the volume): - crowdsec/acquis-synology.yaml -> acquis.d/synology.yaml (syslog listener) - crowdsec/parsers/famfihome-synology-connection.yaml -> s01-parse/ (local parser for DSM 7 "Connection" failed sign-ins -> synology-dsm-bf) - crowdsec/profiles.yaml (escalating ban (count+1)*12h, capped at 168h) Also commits the previously untracked 5514:514/udp port mapping. Verified after recreate: syslog listener bound on :514, lines arriving from 192.168.0.234, traefik access.log tail active, local parser loaded, cscli explain on a DSM sign-in failure still reaches crowdsecurity/synology-dsm-bf, 26 active decisions preserved, both bouncers pulling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
1.0 KiB
YAML
25 lines
1.0 KiB
YAML
# Lokaler CrowdSec-Parser (kein Hub-Item).
|
|
# Gemountet nach /etc/crowdsec/parsers/s01-parse/famfihome-synology-connection.yaml
|
|
# (siehe docker-compose.yml). Ergaenzt crowdsecurity/synology-dsm-logs um das
|
|
# "Connection"-Programm des DSM-7-Log-Centers; speist crowdsecurity/synology-dsm-bf.
|
|
name: famfihome/synology-connection-logs
|
|
description: "Synology Log Center 'Connection' events (DSM 7 sign-in failures)"
|
|
filter: "evt.Parsed.program == 'Connection'"
|
|
onsuccess: next_stage
|
|
pattern_syntax:
|
|
IPv4_WA: '(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)'
|
|
IP_WA: '(?:%{IPV6}|%{IPv4_WA})'
|
|
nodes:
|
|
- grok:
|
|
pattern: 'User \[%{DATA:user}\] from \[%{IP_WA:src_ip}\] failed to sign in to \[%{DATA:service}\] via \[%{DATA:method}\]'
|
|
apply_on: message
|
|
statics:
|
|
- meta: log_type
|
|
value: synology-dsm_failed_auth
|
|
- meta: service
|
|
value: synology-dsm
|
|
- meta: source_ip
|
|
expression: "evt.Parsed.src_ip"
|
|
- meta: user
|
|
expression: "evt.Parsed.user"
|