Does this show that my crowdsec set up is active?
reddit / selfhosted

----------------------------------------------------------------------
sean_999 · 2023-12-20 02:45

I have attempted to hook together my NPM docker container with my bare
metal Crowdsec install (using bind mounts).

Does the above output from \`cscli metrics\` indicate that my nginx
bouncer is working?

----------------------------------------------------------------------
CardiologistApart1 · 2023-12-20 03:59

My understanding is that No. Those are some of the security modules
and triggers, but it doesn’t actually say if you reverse proxy is
functioning appropriately.

Try ‘cscli bouncers list’ (without the quotes) and see if your nginx
bouncer will be listed.

If yes, you can try ‘cscli decisions add --ip 1.2.3.4 --duration 5m
--type ban’ (changing the ip to your home ip. This will ban your ip
for 5 minutes and if you try to enter a website protected by your
crowdsec/nginx combo, it will fail, showing that the bouncer is
working.

----------------------------------------------------------------------
Expert_Try_2778 · 2023-12-20 06:57

Use cscli instead of CAPI to list your own decisions. So cscli
decisions list will return banned IPs that have attempted to access
and the relevant reason.

----------------------------------------------------------------------
Eirikr70 · 2023-12-20 08:39

You should try :

* cscli bouncers list (you check the hour of the latest check ; it
should be within the last minute),
* cscli capi status
* cscli lapi status
* cscli alerts list

If everything is ok, then your install works.

----------------------------------------------------------------------
sean_999 · 2023-12-20 12:21

I tried adding my home network public IP address and was still able to
access my sites through NPM.

It shows it is parsing my NPM logs and I bound the LUA scripts to my
NPM container

----------------------------------------------------------------------
CardiologistApart1 · 2023-12-20 13:35

What did you get when you run cscli bouncers list ?

----------------------------------------------------------------------
sean_999 · 2023-12-20 14:05

`─────────────────────────────────────────────────────────────────────
────────────────────────────────────────
 Name               IP Address   Valid   Last API pull          Type
Version   Auth Type
──────────────────────────────────────────────────────────────────────
───────────────────────────────────────
 nginx-1702945660   127.0.0.1    ✔️       2023-12-20T14:04:55Z
crowdsec-nginx-bouncer   v1.0.4    api-key
 nginx-1702952090                ✔️       2023-12-19T02:14:51Z
api-key
──────────────────────────────────────────────────────────────────────
──────────────────────────────────────`

----------------------------------------------------------------------
CardiologistApart1 · 2023-12-20 14:31

Per your logs, it looks like your crowdsec bouncer is installed and
working. When you blocked your home IP address, did you enter the
container/service thru your local LAN or thru a public facing IP? Do
you have any sort of DNS re-write that would cause you to connect thru
lan?

----------------------------------------------------------------------
sean_999 · 2023-12-20 18:12

Not that I know of. I'm guessing it is some weird issue with either
NPM itself or the fact that NPM or running through docker.