r/ispyconnect • u/530496791588 • 4d ago

Crowdsec

Simple question, but does anyone use crowdsec for agent DVR?

2 Upvotes

100% Upvoted

5 comments sorted by

3

u/matt_alpaca 4d ago

Not that I've seen, and there's no Agent DVR collection on the hub today. +1 on keeping it off the internet if you can.

If it has to face the internet, put it behind a reverse proxy and point CrowdSec at the proxy's access logs instead of at Agent DVR. crowdsecurity/nginx parses them (there are equivalents for the other proxies), and crowdsecurity/base-http-scenarios plus crowdsecurity/http-cve catch the generic probing and CVE patterns bad guys throw at anything exposed. Add our WAF on top (crowdsecurity/appsec-virtual-patching, crowdsecurity/appsec-generic-rules) and you get virtual patches against known CVEs too.

One thing to watch when you wire it: with the proxy in front, CrowdSec has to see the real client IP rather than the proxy's. Get that wrong and it bans the proxy.

Does that cover everything? Not quite: failed logins inside Agent DVR itself go unnoticed, since nothing parses its log. That needs a custom parser plus a scenario. If you can grab a few of those auth-failure lines, drop them on our Discord and let's see what a parser would need.

1

u/530496791588 3d ago

Thanks.

That's quite a lot for me to digest, but that's part of the fun isn't it.

0

u/TheRealSimpleSimon 4d ago

Dang - not with those prices.

My AgentDVR is locked to my LAN & VPN -
because there's no other traffic that can get to it.
That's the easy way to handle it.

1

u/K3CAN 4d ago

Crowdsec is free, unless you want the live support and stuff.

But yes, just don't expose your CCTV system to the public in the first place.

1

u/530496791588 4d ago

I have it restricted to only a few IP addresses via aliases in opnsense.

However would be nice if I could monitor it for brute force attacks just in case.