Install with a top-level collection
1 collection include itsudo cscli collections install crowdsecurity/wireguardInstalls 2 parsers and 1 scenario.
View WireGuard - Authentication Detection →Installation
sudo cscli parsers install crowdsecurity/wireguard-logsThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
filter: "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'wireguard:'"#debug: trueonsuccess: next_stagename: crowdsecurity/wireguard-logsdescription: "Parses wireguard log via dyndbg"pattern_syntax:WIREGUARD_INVALID_HANDSHAKE: 'wireguard: wg%{INT}: Packet has unallowed src IP \(%{IP}\) from peer %{INT} \(%{IP:source_ip}:%{INT}\)'WIREGUARD_UNAUTHORIZED_PACKET: 'wireguard: wg%{INT}: Invalid handshake initiation from %{IP:source_ip}:%{INT}'nodes:- grok:name: "WIREGUARD_INVALID_HANDSHAKE"apply_on: messagestatics:- meta: log_typevalue: wireguard_failed_auth- meta: log_subtypevalue: wireguard_invalid_handshake- grok:name: "WIREGUARD_UNAUTHORIZED_PACKET"apply_on: messagestatics:- meta: log_typevalue: wireguard_failed_auth- meta: log_subtypevalue: wireguard_unauthorized_packetstatics:- meta: servicevalue: wireguard- meta: source_ipexpression: "evt.Parsed.source_ip"
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
In order for CrowdSec to detect attacks on Wireguard it needs logs and since Wireguard by default logs close to nothing we need to enable Wireguard's dyndbg logging which sends log messages to the Linux kernel message buffer, kmsg.
These will be picked up by your Linux distro's syslog service (at least on Debian, probably also on most others) and logged in /var/kern.log. On other distros they will be logged to /var/log/messages.
To enable Wireguard's dyndbg logging:
1$ sudo modprobe wireguard2$ echo module wireguard +p | sudo tee /sys/kernel/debug/dynamic_debug/control
More details on what we're looking for, why and other ways to do logging on Wireguard, please go to: https://www.procustodibus.com/blog/2021/03/wireguard-logs/