How To Install crowdsec on Kali Linux
Introduction
In this tutorial we learn how to install crowdsec on Kali Linux.
What is crowdsec
crowdsec is:
CrowdSec is a lightweight security engine, able to detect and remedy aggressive network behavior. It can leverage and also enrich a global community-wide IP reputation database, to help fight online cybersec aggressions in a collaborative manner.
CrowdSec can read many log sources, parse and also enrich them, in order to detect specific scenarios, that usually represent malevolent behavior. Parsers, Enrichers, and Scenarios are YAML files that can be shared and downloaded through a specific Hub, as well as be created or adapted locally.
Detection results are available for CrowdSec, its CLI tools and bouncers via an HTTP API. Triggered scenarios lead to an alert, which often results in a decision (e.g. IP banned for 4 hours) that can be consumed by bouncers (software components enforcing a decision, such as an iptables ban, an nginx lua script, or any custom user script).
The CLI allows users to deploy a Metabase Docker image to provide simple-to-deploy dashboards of ongoing activity. The CrowdSec daemon is also instrumented with Prometheus to provide observability.
CrowdSec can be used against live logs (??? la fail2ban??), but can also work on cold logs to help, in a forensic context, to build an analysis for past events.
On top of that, CrowdSec aims at sharing detection signals amongst all participants, to pre-emptively allow users to block likely attackers. To achieve this, minimal meta-information about the attack is shared with the CrowdSec organization for further retribution.
Users can also decide not to take part into the collective effort via the central API, but to register on a local API instead.
There are three methods to install crowdsec on Kali Linux. We can use apt-get, apt and aptitude. In the following sections we will describe each method. You can choose one of them.
Install crowdsec Using apt-get
Update apt database with apt-get using the following command.
sudo apt-get updateAfter updating apt database, We can install crowdsec using apt-get by running the following command:
sudo apt-get -y install crowdsecInstall crowdsec Using apt
Update apt database with apt using the following command.
sudo apt updateAfter updating apt database, We can install crowdsec using apt by running the following command:
sudo apt -y install crowdsecInstall crowdsec Using aptitude
If you want to follow this method, you might need to install aptitude on Kali Linux first since aptitude is usually not installed by default on Kali Linux. Update apt database with aptitude using the following command.
sudo aptitude updateAfter updating apt database, We can install crowdsec using aptitude by running the following command:
sudo aptitude -y install crowdsecHow To Uninstall crowdsec on Kali Linux
To uninstall only the crowdsec package we can use the following command:
sudo apt-get remove crowdsecUninstall crowdsec And Its Dependencies
To uninstall crowdsec and its dependencies that are no longer needed by Kali Linux, we can use the command below:
sudo apt-get -y autoremove crowdsecRemove crowdsec Configurations and Data
To remove crowdsec configuration and data from Kali Linux we can use the following command:
sudo apt-get -y purge crowdsecRemove crowdsec configuration, data, and all of its dependencies
We can use the following command to remove crowdsec configurations, data and all of its dependencies, we can use the following command:
sudo apt-get -y autoremove --purge crowdsecDependencies
crowdsec have the following dependencies:
References
Summary
In this tutorial we learn how to install crowdsec package on Kali Linux using different package management tools: apt, apt-get and aptitude.