Secure your Opnsense with Crowdsec

What is Crowdsec?

Source: Lawrence Systems

CrowdSec stands as an open-source Intrusion Prevention System (IPS) designed to safeguard your network from known threats by harnessing a wide array of crowd-sourced threat intelligence. What sets CrowdSec apart is its innovative approach to threat detection, using collective intelligence shared among its users. This unique method empowers CrowdSec to rapidly respond to emerging threats. When deployed on a system within your network, CrowdSec can monitor, alert, and block malicious activities.
Unlike traditional IPS platforms that rely on predefined signatures and rules to identify malicious traffic, CrowdSec employs a distinctive tactic. It calculates a reputation score for IP addresses based on community-driven threat intelligence. IP addresses with unfavorable reputation scores are promptly barred from accessing protected resources. This approach ensures that CrowdSec is swift, efficient, and highly effective in safeguarding various network resources.
CrowdSec comprises two key components: the agent and the bouncer. The agents diligently monitor log files, detecting any signs of malicious activities and sharing pertinent information with the CrowdSec community. The bouncer, on the other hand, acts as a guardian, blocking access to protected resources from undesirable IP addresses. When integrated with firewalls like OPNsense, the bouncer shields the entire network from these malicious entities. Moreover, individual services such as web servers can also benefit from bouncers, tailored to protect specific applications.
Communication within the CrowdSec ecosystem revolves around the Local API (LAPI) and the Central API (CAPI). CrowdSec agents and bouncers interface with the LAPI, which in turn communicates with the CAPI. This intricate network enables the seamless sharing and updating of crowd-sourced intelligence data. In advanced setups, multiple CrowdSec agents and bouncers can operate within a network, all reporting to a centralized local server hosting the CrowdSec LAPI. This sophisticated configuration allows for a robust and collaborative defense mechanism against evolving cyber threats.

What’s the difference between standard Suricata IDS and Crowdsec?

CrowdSec and Suricata are both powerful tools in the realm of cybersecurity, but they serve different purposes and operate in distinct ways:

1. CrowdSec:

• Purpose: CrowdSec is an open-source behavior-based security monitoring and response tool. It is designed to detect and respond to security threats by leveraging crowd wisdom and data collection. CrowdSec focuses on identifying patterns of malicious behavior and responding to these patterns in real-time.
• Detection Approach: CrowdSec uses a crowd-sourced approach, collecting and analyzing data from a large community of users to identify new threats and attack patterns. It calculates reputation scores for IP addresses based on collective intelligence, allowing for adaptive and real-time threat response.
• Use Case: CrowdSec is suitable for detecting various types of threats across different services and applications. It can monitor, alert, and block malicious activities on systems where it is deployed.

2. Suricata:

• Purpose: Suricata is an open-source Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). It is primarily used for network security monitoring and analyzing network traffic in real-time. Suricata is capable of detecting and alerting on a wide range of network threats.
• Detection Approach: Suricata uses signature-based detection, where it matches patterns in network traffic against predefined rules or signatures to identify known threats. It can also perform protocol analysis and detect anomalies in network behavior.
• Use Case: Suricata is typically used at the network perimeter to monitor incoming and outgoing traffic for signs of malicious activity. It is effective for detecting attacks such as port scans, DDoS attacks, and various types of network intrusion attempts.

Key Differences:

• Detection Method: CrowdSec relies on behavior-based analysis and crowd-sourced threat intelligence, whereas Suricata primarily uses signature-based detection along with protocol analysis and anomaly detection.
• Focus: CrowdSec is more focused on behavioral patterns and real-time response, making it adaptable to new and evolving threats. Suricata is focused on network traffic analysis and is well-suited for detecting known threats based on predefined signatures.
• Deployment: CrowdSec can be deployed on individual systems to protect applications, services, and resources. Suricata is commonly deployed at network gateways or intrusion detection points to monitor overall network traffic.

In summary, CrowdSec is geared toward behavior-based threat detection and response, while Suricata is focused on network traffic analysis and detecting known threats based on predefined signatures. The choice between the two would depend on specific security requirements and use-case scenarios.

More: https://www.crowdsec.net/blog/suricata-vs-crowdsec

Things to be aware of…

CrowdSec offers comprehensive network protection against known malicious IP addresses shared by the community, provided you establish the necessary block rules as outlined later in these guidelines. However, the current plugin functionality is limited to monitoring specific malicious activities on the web interface and SSH services of your OPNsense system. With the creation of additional log file parsers for the CrowdSec plugin, it can be expanded to monitor other services running on your OPNsense router. This potential for growth highlights the importance of community contributions to the advancement of CrowdSec, benefiting OPNsense users significantly.

In its basic configuration, the CrowdSec plugin operates as a single server setup, safeguarding services on your OPNsense system and blocking malicious IP addresses sourced from the CrowdSec community. Alternatively, CrowdSec can be configured in a multi-server setup, where multiple CrowdSec agents report to a central local API server. While the local API server can be hosted on the OPNsense machine, offloading it onto another device might be advantageous if your hardware resources are limited and your network processes a substantial volume of logs. This approach helps alleviate the strain on your OPNsense firewall.

INSTALLATION & CONFIGURATION

Step 1 – Register an account at Crowdsec.net

Please create a free account for the Crowdsec at https://crowdsec.net in order to link the Security Engine with your OPNSENSE appliance

Step 2 – Install the Crowdsec plugin on your OPNSENSE

Please go to the Opnsense > System > Firmware > Plugins and choose Crowdsec to install (+)

This will install the three services:
• os-crowdsec, the plugin itself
• crowdsec
• crowdsec-firewall-bouncer

Once installed head over to Opnsense > Services > Crowdsec Settings. On the Settings tab, select the first three checkboxes: IDS, LAPI and IPS. Click Apply.

Please note: The firewall won’t block anything unless you activate the bouncer feature. CrowdSec takes care of generating floating rules to block all incoming malicious IPv4/IPv6 addresses automatically. Additionally, it creates block list aliases for both IPv4 and IPv6, which you can incorporate into your custom firewall rules for specific purposes, if necessary.

Step 3 – Connect OPNSENSE Crowdsec plugin with your network account

Please open your Crowdsec account at https://app.crowdsec.net/ and head over to Security Engines > Connect my Security Engine now

Then look for the Enroll your CrowdSec Security Engine option and copy it’s code to the notepad

Please then go to Opnsense > System > Settings > Administration and enable the SSH connection to your Opnsense.

Connect via SSH to your Opnsense and type 8 for Option8: Shell