Fix ASN-exempt fork never actually disabling the hub-original scenarios

"cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum"
was failing silently (stderr suppressed, "|| true" swallowed the non-zero
exit) because these scenarios are members of the crowdsecurity/asterisk
collection, and cscli refuses to remove/disable a collection member
without --force. The un-exempted hub originals kept running side-by-side
with the ASN-exempt local forks the entire time, independently banning the
same traffic with no ASN awareness at all - confirmed live by a ban
showing scenario "crowdsecurity/asterisk_bf" (the hub original) rather
than "local/asterisk_bf" (the fork) for an ASN that had just been exempted.

Fixed in two places:
- crowdsec.sh's initial setup now passes --force and surfaces a clear
  warning (with the manual fix command) if it still fails, instead of
  silently continuing.
- security-dashboard's set-asn-exempt.sh helper now re-asserts the forced
  disable on every ASN-list save, so an install already affected by this
  (from before this fix, or where the step failed for any other reason)
  self-heals the next time the ASN list is edited via the dashboard,
  without needing to re-run the full CrowdSec installer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ho9mZgAkVpdz7S5wJkg8Nf

services/crowdsec.sh

@@ -263,8 +263,24 @@ ASTENUM
 
                 # Disable the hub originals so they don't double-process the
                 # same events alongside the ASN-exempt forks written above.
-                sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum 2>/dev/null || true
-                echo "  ✓ Wrote ASN-exempt local forks; disabled the hub originals"
+                # --force is required: these scenarios came in as part of the
+                # crowdsecurity/asterisk collection, and cscli refuses to
+                # remove/disable a collection member without it. Confirmed
+                # live: without --force this failed silently (stderr
+                # suppressed, "|| true" swallowed the non-zero exit), leaving
+                # the un-exempted hub original running side-by-side with the
+                # ASN-exempt fork the entire time — the fork's exemption
+                # never actually took effect for anyone, since the original
+                # scenario kept independently banning the same traffic with
+                # no ASN awareness at all.
+                if sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force 2>/dev/null; then
+                    echo "  ✓ Wrote ASN-exempt local forks; disabled the hub originals"
+                else
+                    log_warning "Failed to disable the hub-original asterisk_bf/asterisk_user_enum scenarios —"
+                    log_warning "the ASN exemption below will NOT take effect until this is resolved. Run:"
+                    log_warning "  sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force"
+                    log_warning "  sudo systemctl restart crowdsec"
+                fi
                 echo "  ℹ Exempted ASNs: $ASN_LIST — SSH/web/geo-allowlist scenarios are unaffected"
                 echo "  ℹ Edit /etc/crowdsec/scenarios/local-asterisk_*.yaml to add/remove ASNs later"
                 echo "    (then: sudo systemctl restart crowdsec)"

services/security-dashboard.sh

@@ -588,6 +588,19 @@ if [[ "$found" != "1" ]]; then
     exit 1
 fi
 
+# Self-healing: the hub-original crowdsecurity/asterisk_bf /
+# asterisk_user_enum scenarios have no ASN awareness at all, so if they're
+# still enabled alongside the exempt forks above, they independently ban
+# the same traffic regardless of anything just written — the exemption
+# above would silently do nothing. crowdsec.sh's original install is
+# supposed to disable them (--force, since they're crowdsecurity/asterisk
+# collection members), but an install from before that fix shipped (or one
+# where that step failed silently) would still have them active. Re-assert
+# it on every save rather than trusting it was ever done correctly once —
+# confirmed live: an install where this step had silently failed kept
+# banning an exempted ASN under the hub-original scenario name.
+cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force 2>/dev/null || true
+
 if ! systemctl restart crowdsec; then
     echo "Wrote ASN list but failed to restart CrowdSec" >&2
     exit 2