mirrors/crowdsec
1
0
Fork 0
mirror of https://github.com/crowdsecurity/crowdsec.git synced 2025-05-12 04:45:52 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix paths in documentation (#490)

Browse source
This commit is contained in:
AlteredCoder 2020-11-30 17:44:30 +01:00 • committed by GitHub
parent b2b60072ea
commit fa11a94e21
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 25 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/v0.3.X/docs/migration.md
View file

@ -2,10 +2,12 @@
!!! warning !!! warning
Migrating to V1.X will impact (any change you made will be lost and must be adapted to the new configuration) : Migrating to V1.X will impact (any change you made will be lost and must be adapted to the new configuration) :
* Database model : your existing database will be lost, a new one will be created in the V1.
* {{v1X.crowdsec.Name}} configuration : - Database model : your existing database will be lost, a new one will be created in the V1.
* `/etc/crowdsec/config/default.yaml` : check [new format](/Crowdsec/v1/references/crowdsec-config/#configuration-format)
* `/etc/crowdsec/config/profiles.yaml` : check [new format](/Crowdsec/v1/references/profiles/#profiles-configurations) - {{v1X.crowdsec.Name}} configuration :
- `/etc/crowdsec/config/default.yaml` : check [new format](/Crowdsec/v1/references/crowdsec-config/#configuration-format)
- `/etc/crowdsec/config/profiles.yaml` : check [new format](/Crowdsec/v1/references/profiles/#profiles-configurations)
To upgrade {{v0X.crowdsec.name}} from v0.X to v1, we'll follow those steps To upgrade {{v0X.crowdsec.name}} from v0.X to v1, we'll follow those steps

12
docs/v1.X/docs/observability/logs.md
View file

@ -10,14 +10,14 @@ By default, logs are written to `/var/log/crowdsec.log`, in text format.
time="12-05-2020 15:34:21" level=info msg="setting loglevel to info" time="12-05-2020 15:34:21" level=info msg="setting loglevel to info"
time="12-05-2020 15:34:21" level=info msg="Crowdsec v0.0.19-9ae496aa9cfd008513976a096accc7cfc43f2d9b" time="12-05-2020 15:34:21" level=info msg="Crowdsec v0.0.19-9ae496aa9cfd008513976a096accc7cfc43f2d9b"
time="12-05-2020 15:34:21" level=warning msg="Loading prometheus collectors" time="12-05-2020 15:34:21" level=warning msg="Loading prometheus collectors"
time="12-05-2020 15:34:23" level=warning msg="no version in /etc/crowdsec/config/parsers/s00-raw/syslog-logs.yaml, assuming '1.0'" time="12-05-2020 15:34:23" level=warning msg="no version in /etc/crowdsec/parsers/s00-raw/syslog-logs.yaml, assuming '1.0'"
time="12-05-2020 15:34:23" level=warning msg="Starting profiling and http server" time="12-05-2020 15:34:23" level=warning msg="Starting profiling and http server"
time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/config/parsers/s00-raw/syslog-logs.yaml, assuming '1.0'" time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/parsers/s00-raw/syslog-logs.yaml, assuming '1.0'"
time="12-05-2020 15:34:24" level=info msg="Node has no name,author or description. Skipping." time="12-05-2020 15:34:24" level=info msg="Node has no name,author or description. Skipping."
time="12-05-2020 15:34:24" level=info msg="Loading 2 parser nodes" file=/etc/crowdsec/config/parsers/s00-raw/syslog-logs.yaml time="12-05-2020 15:34:24" level=info msg="Loading 2 parser nodes" file=/etc/crowdsec/parsers/s00-raw/syslog-logs.yaml
time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/config/parsers/s01-parse/nginx-logs.yaml, assuming '1.0'" time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/parsers/s01-parse/nginx-logs.yaml, assuming '1.0'"
time="12-05-2020 15:34:24" level=info msg="Loading 3 parser nodes" file=/etc/crowdsec/config/parsers/s01-parse/nginx-logs.yaml time="12-05-2020 15:34:24" level=info msg="Loading 3 parser nodes" file=/etc/crowdsec/parsers/s01-parse/nginx-logs.yaml
time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/config/parsers/s01-parse/sshd-logs.yaml, assuming '1.0'" time="12-05-2020 15:34:24" level=warning msg="no version in /etc/crowdsec/parsers/s01-parse/sshd-logs.yaml, assuming '1.0'"
time="13-05-2020 17:42:53" level=warning msg="24 existing LeakyRoutine" time="13-05-2020 17:42:53" level=warning msg="24 existing LeakyRoutine"
time="13-05-2020 18:02:51" level=info msg="Flushed 1 expired entries from Ban Application" time="13-05-2020 18:02:51" level=info msg="Flushed 1 expired entries from Ban Application"
time="13-05-2020 18:12:46" level=info msg="Flushed 1 expired entries from Ban Application" time="13-05-2020 18:12:46" level=info msg="Flushed 1 expired entries from Ban Application"

14
docs/v1.X/docs/user_guide/debugging_configs.md
View file

@ -5,12 +5,12 @@
When trying to debug a parser or a scenario : When trying to debug a parser or a scenario :
- Work on "cold logs" (with the `-file` and `-type` options) rather than live ones - Work on "cold logs" (with the `-file` and `-type` options) rather than live ones
- Use the `/etc/crowdsec/config/user.yaml` configuration files to have logs on stdout - Use the `/etc/crowdsec/user.yaml` configuration files to have logs on stdout
## Using user-mode configuration ## Using user-mode configuration
```bash ```bash
crowdsec -c /etc/crowdsec/config/user.yaml -file mylogs.log.gz -type syslog crowdsec -c /etc/crowdsec/user.yaml -file mylogs.log.gz -type syslog
INFO[05-08-2020 16:15:47] Crowdsec v0.3.0-rc3-7525f11975a0107746213862dc41c69e00122ac7 INFO[05-08-2020 16:15:47] Crowdsec v0.3.0-rc3-7525f11975a0107746213862dc41c69e00122ac7
INFO[05-08-2020 16:15:47] Loading grok library INFO[05-08-2020 16:15:47] Loading grok library
... ...
@ -18,7 +18,7 @@ WARN[05-08-2020 16:16:12] 182.x.x.x triggered a 4h0m0s ip ban remediation for [c
... ...
``` ```
- `/etc/crowdsec/config/user.yaml` disables demonization and push logs to stdout/stderr - `/etc/crowdsec/user.yaml` disables demonization and push logs to stdout/stderr
- `-type` must respect expected log type (ie. `nginx` `syslog` etc.) - `-type` must respect expected log type (ie. `nginx` `syslog` etc.)
- `-file` must point to a flat file or a gzip file - `-file` must point to a flat file or a gzip file
@ -30,14 +30,14 @@ When processing logs like this, {{v1X.crowdsec.name}} runs in "time machine" mod
If you're playing around with parser/scenarios on a live system, you can use the `-t` (lint) option of {{v1X.crowdsec.Name}} to check your configurations validity before restarting/reloading services : If you're playing around with parser/scenarios on a live system, you can use the `-t` (lint) option of {{v1X.crowdsec.Name}} to check your configurations validity before restarting/reloading services :
```bash ```bash
$ emacs /etc/crowdsec/config/scenarios/ssh-bf.yaml $ emacs /etc/crowdsec/scenarios/ssh-bf.yaml
... ...
$ crowdsec -c /etc/crowdsec/config/user.yaml -t $ crowdsec -c /etc/crowdsec/user.yaml -t
INFO[06-08-2020 13:36:04] Crowdsec v0.3.0-rc3-4cffef42732944d4b81b3e62a03d4040ad74f185 INFO[06-08-2020 13:36:04] Crowdsec v0.3.0-rc3-4cffef42732944d4b81b3e62a03d4040ad74f185
... ...
ERRO[06-08-2020 13:36:05] Bad yaml in /etc/crowdsec/config/scenarios/ssh-bf.yaml : yaml: unmarshal errors: ERRO[06-08-2020 13:36:05] Bad yaml in /etc/crowdsec/scenarios/ssh-bf.yaml : yaml: unmarshal errors:
line 2: field typex not found in type leakybucket.BucketFactory line 2: field typex not found in type leakybucket.BucketFactory
FATA[06-08-2020 13:36:05] Failed to load scenarios: Scenario loading failed : bad yaml in /etc/crowdsec/config/scenarios/ssh-bf.yaml : yaml: unmarshal errors: FATA[06-08-2020 13:36:05] Failed to load scenarios: Scenario loading failed : bad yaml in /etc/crowdsec/scenarios/ssh-bf.yaml : yaml: unmarshal errors:
line 2: field typex not found in type leakybucket.BucketFactory line 2: field typex not found in type leakybucket.BucketFactory
``` ```

2
docs/v1.X/docs/write_configurations/parsers.md
View file

@ -47,7 +47,7 @@ May 11 16:23:50 sd-126005 kernel: [47615902.763137] IN=enp1s0 OUT= MAC=00:08:a2:
!!! warning !!! warning
Your yaml file must be in the `config/parsers/s01-parser/` directory. Your yaml file must be in the `config/parsers/s01-parser/` directory.
For example it can be `~/crowdsec-v0.0.19/tests/config/parsers/s01-parser/myparser.yaml`, or `/etc/crowdsec/config/parsers/s01-parser/myparser.yaml`. For example it can be `~/crowdsec-v0.0.19/tests/config/parsers/s01-parser/myparser.yaml`, or `/etc/crowdsec/parsers/s01-parser/myparser.yaml`.
The {{v1X.stage.htmlname}} directory might not exist, don't forget to create it. The {{v1X.stage.htmlname}} directory might not exist, don't forget to create it.

2
docs/v1.X/docs/write_configurations/scenarios.md
View file

@ -315,7 +315,7 @@ INFO[0000] SCENARIOS:
NAME 📦 STATUS VERSION LOCAL PATH NAME 📦 STATUS VERSION LOCAL PATH
---------------------------------------------------------------------------------------------------------------------------------- ----------------------------------------------------------------------------------------------------------------------------------
... ...
mytest.yaml 🚫 enabled,local /etc/crowdsec/config/scenarios/mytest.yaml mytest.yaml 🚫 enabled,local /etc/crowdsec/scenarios/mytest.yaml
... ...
``` ```

4
docs/v1.X/docs/write_configurations/whitelist.md
View file

@ -41,7 +41,7 @@ whitelist:
# Whitelists in parsing # Whitelists in parsing
When a whitelist is present in parsing `/etc/crowdsec/config/parsers/...`, it will be checked/discarded before being poured to any bucket. These whitelists intentionally generate no logs and are useful to discard noisy false positive sources. When a whitelist is present in parsing `/etc/crowdsec/parsers/...`, it will be checked/discarded before being poured to any bucket. These whitelists intentionally generate no logs and are useful to discard noisy false positive sources.
## Whitelist by ip ## Whitelist by ip
@ -152,7 +152,7 @@ A good example is the [crowdsecurity/whitelist-good-actors](https://hub.crowdsec
But let's craft ours based on our previous example ! But let's craft ours based on our previous example !
First of all, install the [crowdsecurity/rdns postoverflow](https://hub.crowdsec.net/author/crowdsecurity/configurations/rdns) : it will be in charge of enriching overflows with reverse dns information of the offending IP. First of all, install the [crowdsecurity/rdns postoverflow](https://hub.crowdsec.net/author/crowdsecurity/configurations/rdns) : it will be in charge of enriching overflows with reverse dns information of the offending IP.
Let's put the following file in `/etc/crowdsec/config/postoverflows/s01-whitelists/mywhitelists.yaml` : Let's put the following file in `/etc/crowdsec/postoverflows/s01-whitelists/mywhitelists.yaml` :
```yaml ```yaml
name: me/my_cool_whitelist name: me/my_cool_whitelist

4
mkdocs.yml
View file

@ -245,8 +245,8 @@ extra:
bin: cscli bin: cscli
user_guide: "[cscli](/Crowdsec/v1/user_guide/cscli/)" user_guide: "[cscli](/Crowdsec/v1/user_guide/cscli/)"
config: config:
crowdsec_dir: "/etc/crowdsec/config/" crowdsec_dir: "/etc/crowdsec/"
acquis_path: "/etc/crowdsec/config/acquis.yaml" acquis_path: "/etc/crowdsec/acquis.yaml"
crowdsec_config_file: "/etc/crowdsec/config.yaml" crowdsec_config_file: "/etc/crowdsec/config.yaml"
bouncers: bouncers:
name: bouncers name: bouncers

2
wizard.sh
View file

@ -21,7 +21,6 @@ CROWDSEC_DB_PATH="${CROWDSEC_DATA_DIR}/crowdsec.db"
CROWDSEC_PATH="/etc/crowdsec" CROWDSEC_PATH="/etc/crowdsec"
CROWDSEC_CONFIG_PATH="${CROWDSEC_PATH}" CROWDSEC_CONFIG_PATH="${CROWDSEC_PATH}"
CROWDSEC_LOG_FILE="/var/log/crowdsec.log" CROWDSEC_LOG_FILE="/var/log/crowdsec.log"
CSCLI_FOLDER="/etc/crowdsec/config/cscli"
CROWDSEC_BIN="./cmd/crowdsec/crowdsec" CROWDSEC_BIN="./cmd/crowdsec/crowdsec"
CSCLI_BIN="./cmd/crowdsec-cli/cscli" CSCLI_BIN="./cmd/crowdsec-cli/cscli"
@ -282,7 +281,6 @@ install_crowdsec() {
mkdir -p "${CROWDSEC_CONFIG_PATH}/postoverflows" || exit mkdir -p "${CROWDSEC_CONFIG_PATH}/postoverflows" || exit
mkdir -p "${CROWDSEC_CONFIG_PATH}/collections" || exit mkdir -p "${CROWDSEC_CONFIG_PATH}/collections" || exit
mkdir -p "${CROWDSEC_CONFIG_PATH}/patterns" || exit mkdir -p "${CROWDSEC_CONFIG_PATH}/patterns" || exit
mkdir -p "${CSCLI_FOLDER}" || exit
#tmp #tmp
mkdir -p /tmp/data mkdir -p /tmp/data