Add support for crowdsec

[StarkZarn]

Summary

I think it would modernize and increase the security of the stack to replace fail2ban with crowdsec. It's and open source replacement that provides crowdsourced threat intelligence and more log parsing support.

Motivation

This would provide additional security, richer data, and stay ahead of the ever-changing security curve.

Additional context

Crowdsec's homepage is https://crowdsec.net/
Github: https://github.com/crowdsecurity/crowdsec/

[klausagnoletti]

I am head of community at CrowdSec. I think it's great that you want integration with CrowdSec :-)

We would love to help out as much as we can.

Please come to our Discord community to discuss this further. Also please elaborate a bit on how it would make sense to integrate as we don't really know that much about mailcow (yet! :-).

[DerLinkman]

Hey :)

Your product sounds cool! But as i´m not the main developer or operator of this project i can´t decide that on my own how and where to implement.

We´ll keep you up to date :)

[vacumet]

I'm writing a blog post how to make this possible (crowdsec installed on the host and reading the logs from nginx, postfix and soon dovecot).
The only thing stopping me from reading the dovecot-logs are somehow related to the tty: yes parameter on the docker container.
The issue is reported at the crowdsec github. After that bug is squashed i will finalize the blogpost at https://blog.vacum.se :)

[andryyy]

Hey, to begin with: we don't use "Fail2ban" but our own interpretation of it. Yes, I see it is a bit confusing. :) Fail2ban would have been too huge for our use case so we simply wrote something similar/more tiny to read a Redis stream of logs for patterns and run actions on hits.

CrowdSec looks very nice, I will check it out for myself, too.
I think it is a tool too powerful to "just attach" to mailcow for people to carry with them and forget they actually have it. It is a tool you should from time to time care about and check some cli commands here and there.

There should be a guide how to protect mailcow with CrowdSec (and at that point thanks to @vacumet ! :)). Perhaps we can tune mailcow at some points to make it easier for CrowdSec to work with mailcow.

Easiest seems to be to read Dockers stdout stream, while that will only work as long as an admin did not setup another Docker log driver.

Or, another approach: Setup journald as log driver for Docker (yeah, not good either) and feed CrowdSec via journald and a filter:

{
  "ipv6":true,
  "fixed-cidr-v6":"fd00:dead:beef:c0::/80",
  "experimental":true,
  "ip6tables":true,
  "log-driver": "journald"
}

crowdsec -type syslog -dsn journalctl://filters=CONTAINER_NAME=CONTAINER_NAME=mailcowdockerized_nginx-mailcow_1&filters=CONTAINER_NAME=CONTAINER_NAME=mailcowdockerized_postfix-mailcow_1&filters=CONTAINER_NAME=mailcowdockerized_dovecot-mailcow_1

It's something.

[vacumet]

Thank you @andryyy
I will try that on my setup. I try not to modify my mailcow setup as local modifications often can cause problems when doing upgrades :)

[vacumet]

The bugfix in crowdsec is done and will be available in a future version: https://github.com/crowdsecurity/crowdsec/pull/1422/files
No need to modify mailcow.
Blog post will be released when the new version of crowdsec is released

[andryyy]

Nice!

[StarkZarn]

The bugfix in crowdsec is done and will be available in a future version: https://github.com/crowdsecurity/crowdsec/pull/1422/files No need to modify mailcow. Blog post will be released when the new version of crowdsec is released

Looks like the last release fixed this. All my logs are being parsed now. 👍

[daygle]

@vacumet Thanks so much for creating that blog about mailcow and crowdsec. I just wanted to reach out to you as I am experiencing differing behaviour when running/setting up.

cscli parsers inspect crowdsecurity/nginx-logs

I only see nginx in the list.

That said when starting I see the other start and appear to be running.

Any suggestions?

[daygle]

Oh hang on, looking further by running 'cscli parsers inspect crowdsecurity/syslog-logs' I see the below:-

@vacumet maybe this is correct? We might need to update the blog?

[williamdes]

I just made CrowdSec work yesterday using https://github.com/docker-mailserver/docker-mailserver
The mail.log file has dovecot and postfix log so that's enough

See docker-compose:
https://github.com/datacenters-network/mails/blob/24a3e3df7f471a90e319b62748c309272735f16c/docker-compose.yml#L261-L284

[daygle]

Thanks @williamdes .

@andryyy and @vacumet are you able to suggest the recommended way to configure mailcow and CrowdSec - @williamdes way is much different to what was documented on the blog.

[williamdes]

Thanks @williamdes .

@andryyy and @vacumet are you able to suggest the recommended way to configure mailcow and CrowdSec - @williamdes way is much different to what was documented on the blog.

And it's very easy, just provide the log file to the CrowdSec instance and

cscli collections install crowdsec/postfix
cscli collections install crowdsec/dovecot

I also mount some custom scenarios and parsers (that I will probably upstream): https://github.com/datacenters-network/mails/tree/24a3e3df7f471a90e319b62748c309272735f16c/crowdsec

[daygle]

@williamdes are you able to document the steps from start to finish? This will help myself and others.