CrowdSec bouncers are written in golang for custom scripts.
The crowdsec-custom-bouncer will periodically fetch new, expired and removed decisions from the CrowdSec Local API and will pass them as arguments to a custom user script.
sudo apt install crowdsec-custom-bouncer
sudo yum install crowdsec-custom-bouncer
First, download the latest
$ tar xzvf crowdsec-custom-bouncer.tgz$ sudo ./install.sh
Run the following commands:
git clone https://github.com/crowdsecurity/crowdsec-custom-bouncer.gitcd crowdsec-custom-bouncer/make releasetar xzvf crowdsec-custom-bouncer.tgzcd crowdsec-custom-bouncer-v*/sudo ./install.sh
Before starting the
crowdsec-custom-bouncer service, please edit the configuration file to add your API URL and key.
The default configuration file is located under :
$ vim /etc/crowdsec/bouncers/crowdsec-custom-bouncer.yaml
bin_path: <absolute_path_to_binary>piddir: /var/run/update_frequency: 10sdaemonize: truelog_mode: filelog_dir: /var/log/log_level: infoapi_url: <API_URL> # when install, default is "localhost:8080"api_key: <API_KEY> # Add your API key generated with `cscli bouncers add --name <bouncer_name>`cache_retention_duration: 10s
cache_retention_duration : The bouncer keeps track of all custom script invocations from the last
cache_retention_duration interval. If a decision is identical to some decision already present in the cache, then the custom script is not invoked. The keys for hashing a decision is it's
captcha etc) and
You can then start the service:
sudo systemctl start crowdsec-custom-bouncer
If you already have
crowdsec-custom-bouncer installed, please download the latest release and run the following commands to upgrade it:
tar xzvf crowdsec-custom-bouncer.tgzcd crowdsec-custom-bouncer-v*/sudo ./upgrade.sh
The custom binary will be called with the following arguments :
<my_custom_binary> add <ip> <duration> <reason> <json_object> # to add an IP address<my_custom_binary> del <ip> <duration> <reason> <json_object> # to del an IP address
ip: ip address to block
duration: duration of the remediation in seconds
reason: reason of the decision
json_object: the serialized decision
⚠️ don't forget to add execution permissions to your binary/script. If it's a script,
the first line must be a shebang (like
custom_binary.sh add 126.96.36.199/32 3600 "test blacklist"custom_binary.sh del 188.8.131.52/32 3600 "test blacklist"