Enable port access from external

terraform/crowdsec.tf

@@ -160,7 +160,7 @@ resource "helm_release" "crowdsec" {
           enabled = true
         }
 
-        # Monitor NGINX Ingress Controller logs
+        # Monitor NGINX Ingress Controller logs and SSH logs
         acquisition = [
           {
             namespace = "ingress-nginx"
@@ -169,11 +169,29 @@ resource "helm_release" "crowdsec" {
           }
         ]
 
-        # Install NGINX collections
+        # Additional acquisition for host SSH logs and firewall logs
+        additionalAcquisition = [
+          {
+            source    = "file"
+            filenames = ["/var/log/auth.log"]
+            labels = {
+              type = "syslog"
+            }
+          },
+          {
+            source    = "file"
+            filenames = ["/var/log/kern.log", "/var/log/syslog"]
+            labels = {
+              type = "syslog"
+            }
+          }
+        ]
+
+        # Install NGINX, SSH, and iptables/firewall collections
         env = [
           {
             name  = "COLLECTIONS"
-            value = "crowdsecurity/nginx crowdsecurity/base-http-scenarios crowdsecurity/linux"
+            value = "crowdsecurity/nginx crowdsecurity/base-http-scenarios crowdsecurity/linux crowdsecurity/sshd crowdsecurity/iptables crowdsecurity/endlessh"
           }
         ]
 
@@ -262,10 +280,66 @@ resource "null_resource" "crowdsec_bouncer_setup" {
   }
 }
 
+# Setup iptables logging for port scan detection (optional but recommended)
+resource "ssh_resource" "iptables_logging" {
+  depends_on = [helm_release.crowdsec]
+
+  host        = local.ssh_host
+  user        = local.ssh_user
+  port        = local.ssh_port
+  private_key = local.ssh_private_key
+  timeout     = "5m"
+
+  when = "create"
+
+  commands = [
+    "echo 'Setting up iptables logging for CrowdSec...'",
+
+    # Create chain for suspicious activity logging
+    "sudo iptables -N CROWDSEC_SUSPICIOUS 2>/dev/null || true",
+    "sudo iptables -F CROWDSEC_SUSPICIOUS 2>/dev/null || true",
+
+    # IMPORTANT: Exclude local network (192.168.1.0/24) from ALL port scan detection
+    "sudo iptables -I INPUT 1 -s 192.168.1.0/24 -j ACCEPT || true",
+
+    # Track connection attempts for port scan detection (only for external traffic)
+    "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --set --name portscan || true",
+
+    # If more than 10 connection attempts in 60 seconds from external IPs, log it as suspicious
+    "sudo iptables -A INPUT -p tcp -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name portscan -j CROWDSEC_SUSPICIOUS || true",
+
+    # Log suspicious activity
+    "sudo iptables -A CROWDSEC_SUSPICIOUS -j LOG --log-prefix 'iptables_SCAN: ' --log-level 4 --log-tcp-options --log-ip-options || true",
+
+    # Drop the suspicious packets
+    "sudo iptables -A CROWDSEC_SUSPICIOUS -j DROP || true",
+
+    # Log invalid packets from external sources only (often used in attacks)
+    "sudo iptables -A INPUT -m state --state INVALID -j LOG --log-prefix 'iptables_INVALID: ' --log-level 4 || true",
+    "sudo iptables -A INPUT -m state --state INVALID -j DROP || true",
+
+    # Install iptables-persistent to save rules
+    "sudo DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent 2>/dev/null || true",
+
+    # Save the rules
+    "sudo mkdir -p /etc/iptables",
+    "sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null",
+
+    "echo '✅ iptables logging configured!'",
+    "echo 'Port scans and suspicious activity will now be logged and detected by CrowdSec'"
+  ]
+}
+
 output "crowdsec_info" {
   value = <<-EOT
     CrowdSec deployed successfully!
 
+    Monitoring:
+    - ✅ NGINX Ingress (ingress-nginx namespace)
+    - ✅ SSH attempts (port 22422)
+    - ✅ Port scans (iptables logging enabled)
+    - ✅ System logs
+
     Commands:
     - Status: kubectl get pods -n crowdsec
     - Metrics: kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli metrics
@@ -273,6 +347,8 @@ output "crowdsec_info" {
     - Bouncers: kubectl exec -n crowdsec deployment/crowdsec-lapi -- cscli bouncers list
 
     Storage: /mnt/k8s/crowdsec/ on server-3 (192.168.1.2)
-    NGINX Ingress: Monitored in ingress-nginx namespace
+    Web Dashboard: https://app.crowdsec.net
+
+    Quick view: ./view_crowdsec.sh
   EOT
 }