root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refine crowdsec geo-allowlist: drop core Eastern Europe, add Russia back

Browse Source 
Excludes Bulgaria, Czechia, Hungary, Moldova, Poland, Romania, Slovakia,
and Ukraine per user request, while keeping the Balkans and Baltics
(several of which, e.g. Estonia, don't fit the same risk profile despite
the old Cold-War grouping). Russia added back to the allowed list per
explicit user request.
This commit is contained in:
Claude
2026-07-20 23:39:58 +00:00
parent 8132f882e1
commit 685099e9d8
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/crowdsec.sh
+12 -7
View File
@@ -201,14 +201,19 @@ labels:
sudo cscli collections install crowdsecurity/geoip-enrich 2>/dev/null || \ sudo cscli collections install crowdsecurity/geoip-enrich 2>/dev/null || \
echo " ⚠ crowdsecurity/geoip-enrich may already be installed" echo " ⚠ crowdsecurity/geoip-enrich may already be installed"
# North America + broad geographic Europe, ISO 3166-1 alpha-2. Russia, # North America + Europe, ISO 3166-1 alpha-2. Belarus and Turkey are
# Belarus, and Turkey are deliberately left out even though they span # left out (common abuse-traffic sources, and not really "Europe" in
# into Europe geographically — they're common abuse-traffic sources # the sense meant here). Core Eastern Europe (Bulgaria, Czechia,
# and almost certainly not what "Europe" means here. To adjust, edit # Hungary, Moldova, Poland, Romania, Slovakia, Ukraine) is left out
# the two lists below and re-run, or hand-edit $GEO_SCENARIO directly # too — the Balkans and Baltics (Albania, Bosnia, Croatia, Estonia,
# (it's plain YAML — no reinstall needed, just restart crowdsec after). # Latvia, Lithuania, Montenegro, North Macedonia, Serbia, Slovenia)
# are kept in deliberately, since several of them (Estonia especially)
# don't fit the same risk profile despite the old Cold-War grouping.
# To adjust, edit the two lists below and re-run, or hand-edit
# $GEO_SCENARIO directly (it's plain YAML — no reinstall needed, just
# restart crowdsec after).
local _GEO_NA="US CA MX" local _GEO_NA="US CA MX"
local _GEO_EU="AD AL AT BA BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MD ME MK MT NL NO PL PT RO RS SE SI SK SM UA VA" local _GEO_EU="AD AL AT BA BE CH CY DE DK EE ES FI FR GB GR HR IE IS IT LI LT LU LV MC ME MK MT NL NO PT RS RU SE SI SM VA"
local _geo_expr_list local _geo_expr_list
_geo_expr_list="$(printf "'%s', " $_GEO_NA $_GEO_EU)" _geo_expr_list="$(printf "'%s', " $_GEO_NA $_GEO_EU)"
_geo_expr_list="${_geo_expr_list%, }" _geo_expr_list="${_geo_expr_list%, }"