dgit.raspbian.org Git - crowdsec.git/log

Merge version 1.0.9-1+rpi1 and 1.0.9-2 to produce 1.0.9-2+rpi1

Merge crowdsec (1.0.9-1+rpi1) import into refs/heads/workingbranch

[PATCH] remove broken scenario `ban-report-ssh_bf_report` (#181)

* remove broken scenario

* Update index

Co-authored-by: GitHub Action <action@github.com>
Gbp-Pq: Name 0008-hub-disable-broken-scenario.patch

Automatically enable the online hub

By default, crowdsec comes with an offline copy of the hub (see
README.Debian). When running `cscli hub update`, ensure switching from
this offline copy to the online hub.

To ensure cscli doesn't disable anything that was configured (due to
symlinks from /etc/crowdsec becoming dangling all of a sudden), copy the
offline hub in the live directory (/var/lib/crowdsec/hub), and let
further operations (`cscli hub upgrade`, or `cscli <type> install`)
update the live directory as required.

Signed-off-by: Cyril Brulebois <cyril@debamax.com>
Gbp-Pq: Name 0007-automatically-enable-online-hub.patch

Prefer `systemctl restart crowdsec` to `systemctl reload crowdsec`

As of version 1.0.8, reloading doesn't work due to failures to reopen
the database:
https://github.com/crowdsecurity/crowdsec/issues/656

Until this is fixed, advertise `systemctl restart crowdsec` instead.

Signed-off-by: Cyril Brulebois <cyril@debamax.com>
Gbp-Pq: Name 0006-prefer-systemctl-restart.patch

Adjust default config

Let's have all hub-related data under /var/lib/crowdsec/hub instead of
the default /etc/crowdsec/hub directory.

Signed-off-by: Cyril Brulebois <cyril@debamax.com>
Gbp-Pq: Name 0005-adjust-config.patch

Disable geoip-enrich in the hub files

It would download GeoLite2*.mmdb files from the network. Let users
enable the hub by themselves if they want to use it.

Gbp-Pq: Name 0004-disable-geoip-enrich.patch

Adjust systemd unit

- Drop PIDFile (that uses an obsolete path, and doesn't seem to be
used at all).
- Adjust paths for the packaged crowdsec binary (/usr/bin).
- Drop commented out ExecStartPost entirely.
- Drop syslog.target dependency, it's socket-activated (thanks to the
systemd-service-file-refers-to-obsolete-target lintian tag).
- Ensure both local and online API credentials have been defined.

Gbp-Pq: Name 0003-adjust-systemd-unit.patch

Use _foreign_keys=1 instead of _fk=1

The _foreign_keys=1 syntax is widely supported but the _fk=1 alias for
it was only added in version 1.8.0 of the sqlite3 driver. Avoid using
the alias for the time being (the freeze is near).

Gbp-Pq: Name 0002-add-compatibility-for-older-sqlite-driver.patch

Use local machineid implementation

Let's avoid a dependency on an extra package (denisbrodbeck/machineid),
since its ID() function is mostly about trying to read from two files.

Signed-off-by: Manuel Sabban <manuel@crowdsec.net>
Signed-off-by: Cyril Brulebois <cyril@debamax.com>
Gbp-Pq: Name 0001-use-a-local-machineid-implementation.patch

crowdsec (1.0.9-1+rpi1) bullseye-staging; urgency=medium

* Disable testsuite (probablly a btrfs related failure).

[dgit import unpatched crowdsec 1.0.9-1+rpi1]

Import crowdsec_1.0.9-1+rpi1.debian.tar.xz

[dgit import tarball crowdsec 1.0.9-1+rpi1 crowdsec_1.0.9-1+rpi1.debian.tar.xz]

Merge crowdsec (1.0.9-2) import into refs/heads/workingbranch

[PATCH] Improve http bad user agent : use regexp (#197)

* switch to regexp with word boundaries to avoid false positives when a legit user agent contains a bad one

Co-authored-by: GitHub Action <action@github.com>
Gbp-Pq: Name 0009-Improve-http-bad-user-agent-use-regexp-197.patch