Claude
7cf82d5d28
Provide three tiers of the install script for both 24.04 and 26.04: - Originals (ubuntu-post-install-24.04.sh / -26.04.sh): restored to their true original state, with Keycloak intact, as a fallback baseline. (This reverts the in-place Keycloak removal from the previous commit; the cleanup now lives in the -no-keycloak variants instead.) - -no-keycloak.sh: Keycloak fully removed, Authelia as the SSO/2FA option. - -crowdsec.sh: builds on -no-keycloak and replaces fail2ban entirely with CrowdSec (SSH via auth.log/sshd collection, Caddy via caddy collection + log acquisition, firewall bouncer for enforcement, plus geo-blocking and community IP-reputation blocklists). Add SCRIPT-VARIANTS.md documenting the three tiers and how the Authelia / fail2ban / CrowdSec security layers differ. All variants pass 'bash -n'. https://claude.ai/code/session_017eA2qqq9jfF2tNtpUYL8vK
49 lines
2.1 KiB
Markdown
49 lines
2.1 KiB
Markdown
# Install Script Variants
|
|
|
|
This repo ships the post-install script in three tiers, for both Ubuntu 24.04
|
|
and 26.04. Pick **one** and run it — they are mutually exclusive (each is a
|
|
complete, standalone script).
|
|
|
|
| File | Keycloak | SSO | Intrusion prevention |
|
|
|------|----------|-----|----------------------|
|
|
| `ubuntu-post-install-<ver>.sh` | ✅ included | Keycloak **or** Authelia | fail2ban (SSH + Caddy) |
|
|
| `ubuntu-post-install-<ver>-no-keycloak.sh` | ❌ removed | Authelia | fail2ban (SSH + Caddy) |
|
|
| `ubuntu-post-install-<ver>-crowdsec.sh` | ❌ removed | Authelia | **CrowdSec** (replaces fail2ban) |
|
|
|
|
`<ver>` is `24.04` or `26.04`.
|
|
|
|
## Which one?
|
|
|
|
- **Original (`.sh`)** — unchanged baseline, kept for fallback. Still offers
|
|
Keycloak in the menu.
|
|
- **`-no-keycloak`** — same as original but with Keycloak fully removed.
|
|
Authelia is the SSO + 2FA option. Use this if you never got Keycloak running
|
|
and have standardized on Authelia.
|
|
- **`-crowdsec`** — builds on `-no-keycloak` and swaps fail2ban out for
|
|
[CrowdSec](https://www.crowdsec.net/):
|
|
- SSH brute-force protection (CrowdSec reads `/var/log/auth.log` via the
|
|
`crowdsecurity/sshd` collection)
|
|
- Caddy HTTP auth abuse (the `crowdsecurity/caddy` collection + a log
|
|
acquisition at `/etc/crowdsec/acquis.d/caddy.yaml`)
|
|
- Enforcement via `crowdsec-firewall-bouncer-iptables`
|
|
- **Geo-blocking + community IP-reputation blocklists** — the capability
|
|
that fail2ban and Authelia both lack
|
|
|
|
## Notes on the security layers
|
|
|
|
- **Authelia** handles per-account failed-login *regulation* (lockout). It does
|
|
**not** do geo-blocking.
|
|
- **fail2ban** bans IPs at the firewall based on Caddy log patterns
|
|
(401/403/429). No geo-blocking, not credential-aware.
|
|
- **CrowdSec** covers SSH + Caddy from a single agent, adds geo/ASN enrichment
|
|
and crowd-sourced reputation, and is the modern successor to fail2ban.
|
|
|
|
Useful CrowdSec commands after install:
|
|
|
|
```bash
|
|
sudo cscli metrics # overview / parsing health
|
|
sudo cscli decisions list # current bans
|
|
sudo cscli alerts list # detections
|
|
sudo cscli decisions delete --ip <IP> # unban
|
|
```
|