New package: security/pfSense-pkg-crowdsec. Implement #14712

[mmetc]

Hi!

We (CrowdSec) would like to contribute this plugin, which has been requested by our users for a while. Any feedback and suggestion is welcome.

It provides full integration with a crowdsec engine for thread detection and remediation. The engine can be offloaded to a separate machine to spare CPU cycles, or installed within pfsense. The remediation component synchronizes the block lists with a PF table. We tried to follow your practices with regards to development patterns and conventions. The UI may seem a little off mainly for the javascript tables, we can improve that on a later release.

The package brings some dependencies that are currently not built by pfsense:

• crowdsec 1.5.5 (upstream freebsd version -- pfsense is at 1.5.4)
• crowdsec-firewall-bouncer 0.0.28_1 (pfsense is at 0.0.28)
• re2
• abseil

Until the package is accepted in the mainstream repository, it can be tested with our provided binaries - basic documentation here: https://docs.crowdsec.net/docs/next/getting_started/install_crowdsec_pfsense

Since we need to read/write YAML to configure crowdsec, we embedded the symfony/yaml packge. If there is a cleaner solution to provide it as dependency or an alternative package, let us know.

First time contributors here, so please be lenient (with @julienloizelet, he wrote the good parts)

Related issue: https://redmine.pfsense.org/issues/14712

[buixor]

Hello,

Can we do anything to help this move forward?

Thanks,

[pushc6]

Bumping this. Would love to see this be officially added.

[j007bond007]

I'd like to see this added as well please!

[andrebrait]

This is weird.

This PR has been open for so long the package versions are already out of date, and no one got to even look at it?

Even more surprising is the fact it's CrowdSec. It's not a minor project in any shape or form.

Are the (pfSense) maintainers overwhelmed with work from other areas or something?

[mmetc]

Hi @andrebrait

For my part I am committed to keeping this PR up to date and release binaries in https://github.com/crowdsecurity/pfSense-pkg-crowdsec/releases

I will do some backlog work and release a new version when 1.6.3 is out, probably in a couple of weeks

[Enissay]

I hope this will get validated and merged before it turns 1yo!

[j007bond007]

Any updates on this? Seems like it's taking a long time.

[Enissay]

Why not validate this already, it will be a great addition to pfsense!

[Enissay]

This is weird.

This PR has been open for so long the package versions are already out of date, and no one got to even look at it?

Even more surprising is the fact it's CrowdSec. It's not a minor project in any shape or form.

Are the (pfSense) maintainers overwhelmed with work from other areas or something?

Frankly the more time passes, the more this seems to be on purpose. Could it be they are prepping their own CrowdSec alt ? well I really hope so, just get it over with and give us something >_>

[michmoor0725]

Fair to say the Netgate team has been under pressure for quite some time with the MIM project. That said I can't believe this PR can't be merged. There is something else going on we are not privy to.

[h2ogeek]

Great job crowdsec, @pfsense-github team. Could you please review/approve this PR?

[vitormfgoncalves]

I hope this will get validated and merged before it turns 1yo!

Let's hope it doesn't turn 2yo!

[DuvelCorp]

Lets go @pfsense-github we need this!

[Squuiid]

@pfsense-github - can we at least have the goodwill of a response one way or another? Doesn’t take much to just give a quick update. Please.
What’s the holdup here? There is clearly a lot of demand for this.

[h2ogeek]

@pfsense-github team, could you please let us know if Crowdsec is going to be integrated or not? This will bring some clarity to this matter.

[SaltySOMAdmin]

Wild that this is still in limbo. Maybe I need to explore Opnsense but I've been with PFSense for so long.....

[mrkesu]

565 days later and not even a sign of acknowledgement from the team that this PR exists.

What is happening? As a Netgate customer the level of indifference here is actually a bit concerning.

[andrebrait]

What I hope is that they're focusing on getting 2.8 CE out of the door so they can merge new plugins, since they likely won't be able to spend a lot of effort on a release (2.7 CE) that'll be going EOL soon.

It would be good to get a reply with an explanation, though.

[Enissay]

Quite shameful Pfsense, quite shameful!

[autumnwalker]

I would really like to see this added as well.