CyberMind-FR
675b2d164e
Portal (luci-app-secubox-portal): - Fix service status showing 0/9 by checking if init scripts exist - Only count installed services in status display - Use pgrep fallback when init script status fails nDPId Dashboard (luci-app-ndpid): - Add default /etc/config/ndpid configuration - Add /etc/init.d/ndpid-compat init script - Enable compat service in postinst for app detection - Fix Makefile to install init script and config CrowdSec Dashboard: - Add CLAUDE.md with OpenWrt-specific guidelines (pgrep without -x) - CSS fixes for hiding LuCI left menu in all views - LAPI repair improvements with retry logic New Packages: - secubox-app-crowdsec: OpenWrt-native CrowdSec package - secubox-app-netifyd: Netifyd DPI integration - luci-app-secubox: Core SecuBox hub - luci-theme-secubox: Custom theme Removed: - luci-app-secubox-crowdsec (replaced by crowdsec-dashboard) - secubox-crowdsec-setup (functionality moved to dashboard) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
# OpenWrt Firewall Logs Acquisition
|
|
# This configuration monitors iptables/nftables firewall logs
|
|
#
|
|
# Required collections:
|
|
# cscli collections install crowdsecurity/iptables
|
|
#
|
|
# The crowdsecurity/iptables collection provides:
|
|
# - crowdsecurity/iptables-logs parser (for -j LOG entries)
|
|
# - crowdsecurity/iptables-scan-multi_ports scenario (port scan detection)
|
|
#
|
|
# To enable firewall logging in OpenWrt, add LOG rules to your firewall config:
|
|
#
|
|
# For nftables (OpenWrt 22.03+):
|
|
# nft add rule inet fw4 input counter log prefix "fw4-INPUT: " drop
|
|
#
|
|
# For iptables (legacy):
|
|
# iptables -A INPUT -j LOG --log-prefix "iptables-INPUT: "
|
|
#
|
|
# Or via /etc/config/firewall:
|
|
# config rule
|
|
# option name 'Log-Dropped'
|
|
# option src 'wan'
|
|
# option dest '*'
|
|
# option proto 'all'
|
|
# option target 'LOG'
|
|
# option log_prefix 'fw-DROP: '
|
|
#
|
|
# Firewall logs are typically written to kernel log (kern.log)
|
|
# or syslog depending on system configuration.
|
|
|
|
# Kernel/firewall log file acquisition
|
|
filenames:
|
|
- /var/log/kern.log
|
|
- /var/log/firewall.log
|
|
labels:
|
|
type: syslog
|
|
---
|
|
# Alternative: If firewall logs go to main syslog
|
|
# The openwrt-syslog.yaml acquisition will capture them
|
|
# as long as the iptables collection parser is installed
|