Crowdsec API Key

[PathfinderNetworks]

Hopefully someone here will know the answer to this- as I cannot seem to locate the information anywhere else. I'm trying to implement CrowdSec on my MeshCentral server. This is a Windows Server 2022 install.
How I do generate the CrowdSec API key? All the documentation I'm seeing is assuming you are running Linux and have installed the CrowdSec application on your Linux box. It lists the Linux commands to run using their client to generate the key.
But how do you do this in Windows and when you don't have CrowdSec applications installed (other than the built-in modules included with MeshCentral)? Are there commands within MeshCentral we can run to generate this key?
Obviously, this is one of those areas where much more documentation needs to be created (or, if there is documentation for it, can someone point me to it?).

[Ylianst]

I have a upcoming YouTube video on exactly this and I recorded the video using CrowdSec on Windows. Open a command shell in administrator mode and type:

cscli bouncers add meshcentral

You should see this:

Then in MeshCentral add this to the "settings" section of the config.json:

    "crowdsec": {
      "url": "http://localhost:8080",
      "apiKey": "288ea8dde8c428cf38dfb825f095182c",
      "fallbackremediation": "bypass"
    }

Let me know if this helps. If you don't have cscli working, let me know.

Once working you can test it like this:

The will cause captcha on incoming connections from 1.2.3.4.

[PathfinderNetworks]

Thanks Ylian,
When I try to run the command on my MeshCentral server I get an error that cscli is not recognized as an internal or external command, operable program or batch file.
In other words, the cscli application is not installed. I searched the entire drive to see if it maybe it was in a specific folder and needed to be run from there but it doesn't exist anywhere on the drive. The only file that is close to that is cscliCommander.js in the \node_modules@crowdsec\express-bouncer\src\nodejs-bouncer\utils folder.

[si458]

Cscli is a crowdsec cli tool

https://docs.crowdsec.net/docs/cscli/cscli/

You need to run the command on your crowdsec server I believe

[PathfinderNetworks]

I guess I don't know enough about CrowdSec to be able to implement this. I was under the impression it is a cloud service and nothing else was needed other than to configure MeshCentral to work with it. If I need a separate server to run CrowdSec on then I'll have to pass on it.

[si458]

I believe you can install the server side of crowdsec on the same machine running mc?

https://docs.crowdsec.net/

But I'm in the same boat sadly I had never heard of crowdsec until somebody mentioned it

[Ylianst]

Same here, I had to go thru a learning phase on how to install it. You will need to install the CrowdSec agent for your OS. Once I got it installed and "cscli" was present, the rest was easy.

Once I announced that MeshCentral has support for CrowdSec, someone who works at CrowdSec contacted me and we have a video chat. It's a French startup that is VC funded, they are going to be at BlackHat in Las Vegas this year. They seem nice and are working a lot on corporate offerings.

One things I noticed is that you can block IP addresses or Usernames, but the ExpressJS bouncer code they have does not support username blocking. At some point, I may add that. I started running CrowdSec on MeshCentral.com a few days back, I will be checking in regularly to see how effective it is. I constantly gets password guessing bots on that server, will be nice to see if that goes down.

[silversword411]

Please do, I'm curious.

I haven't investigated yet but multiple security concerns come to mind when you're installing an agent talking to their servers, and how much data they might collect.

[PathfinderNetworks]

When I get a good amount of free time I'll circle back around to this and see if I can get it set up and working. I was doing a small amount of reading and, from what I can gather, you have to do manual configuring with the Windows version of the agent. This is what they say: "Contrary to Linux, CrowdSec does not yet support the automatic configuration at installation time. If you want to be able to detect something other than RDP or SMB bruteforce, then you will need to customize your acquisition configuration."
Or does the MeshCentral implementation take care of that aspect?