I have CrowdSec running in a docker container, and I already configured the Traefik plugin and it's working. Now I wonder what else should I configure?

I haven't mounted any logs except Traefik's logs into my CrowdSec container. I assume there's some I should mount?

Notable containers I run that might require their own bouncers(?):

1. Cloudflared
2. Authentik
3. Jellyfin
4. Frigate
5. Immich
6. Unifi Controller
7. Traefik (already configured)
8. *Arr stack / Sabnzbd.
9. Kavita

How do I see what traffic is blocked outbound by IP?

Hi,

I'm kinda new to Crowdsec having just installed it 2 days ago.

It seems to be working fine so far (has even detected 2 ssh-bf attempts on my machine!), but today I noticed that my community blocklist has changed to lite?

Now I read up on it and it seems like this happens when I'm not actively contributing to the network or abusing it.

But I don't think I'm doing either.

I'm definitely not abusing anything (unless I misconfigured something, please let me know how to check this). And as for sharing, this is the status from sudo cscli capi status:

Loaded credentials from /etc/crowdsec/online_api_credentials.yaml
Trying to authenticate with username <hidden> on https://api.crowdsec.net/
You can successfully interact with Central API (CAPI)
Your instance is enrolled in the console
Sharing signals is enabled
Pulling community blocklist is enabled
Pulling blocklists from the console is enabled

And this is from sudo cscli console status:

╭────────────────────┬───────────┬──────────────────────────────────────────────────────╮
│ Option Name        │ Activated │ Description                                          │
├────────────────────┼───────────┼──────────────────────────────────────────────────────┤
│ custom             │ ✅        │ Forward alerts from custom scenarios to the console  │
│ manual             │ ✅        │ Forward manual decisions to the console              │
│ tainted            │ ✅        │ Forward alerts from tainted scenarios to the console │
│ context            │ ✅        │ Forward context with alerts to the console           │
│ console_management │ ❌        │ Receive decisions from console                       │
╰────────────────────┴───────────┴──────────────────────────────────────────────────────╯

Does something seem out of the odinary? (also, should I enable console_management?)

Another thing, in the console, the status for Last time the console fetched signals for this security engine is now 24 hours+ old.

Could this be affecting things? (other syncs for auth and security engine happen frequently)

I am new to crowdsec, dipping my toes in and just want to make sure I start off correctly.

I am using Windows with Nginx proxy in a docker. Most of my applications run in windows, with the proxy set up in the nginx. So can I install Crowdsec in windows to handle security? or in the docker so it can talk to nginx? or in both places if I want to secure both?

Thanks

hello gentlemen,

I dont know if anyone else is experiencing this, but when i try to access my immich instance from wan (using traefik as proxy, all services running through docker), crowdsec is banning the IP i am becasue of http-probing violation.

Has anyone found a solution to this? Maybe to pass any specific labels for headers to immich docker-compose file?

I try googling it but the solution i found is not applicable to my use case (that guy used cloudflare tunnels).

Any help welcome!

Hi, as the title already states: I have CrowdSec up and running, but I only need the bouncers to be deployed. I am using Nginx as a reverse proxy. However, I can not find any documentation anywhere on how to deploy them with Portainer. Really struggling with this, can anyone help out? CrowdSec seems like a great solution, and I just need this last component set up for it to work.

Hello,

I have a dedicated server where I host mamy wordpress websites. Currently using Cloudpanel on it.

I'm thinking of using Crowdsec, tried installing before, it conflicts with my cloudpanel ports and I was unable to visit the cloudpanel control panel.

What would be the best way to install and use Crowdsec with cloudpanel?

Also, I see there's a wordpress plugin for Crowdsec, do I have to fo any changes there or it will work automatically when I install both crowdsec on my server and wordpress plugin?

Sorry for dumb questions.

Thanks in advance.

Hello, Is Cloudflare worker plan (5$) is enough for worker bouncer or will overflow the limitations, and overcharge the 5$ base price ?

I don't want to be limited to the cscli and crowdsec lists.

Have you some exeperience with this plan?

I tried the free plan and the worker have been rate limited (as it was supposed to) and did 3000 KV read in few minutes.

Thanks.

Hi, testing appsec WAF component I saw that exposes a custom 403 forbbiden page.

When I secure some webpage if I can, I try to hide some information like nginx version or proxy brand.

By the other hand, I like to customize the error pages. So, can I change the crowdsec error pages?

Hello, does somebody know about a good complete guide on how to setup all the above together, i found a guide that excluded the FW bouncer and another that left CS out but so far none with all 3 items together

Thanks

Hi, I'm testing crowdsec for the first time, I have installed, the engine, the collections (linux, ssh, http, modsecurity, apache2... etc), and the bouncers(iptables and just for testing nginx)

I know that nginx bouncer is no sense here but... is just a test.

Ok, I have played a cold log that I brought from an apache2 machine and... I have no evidence of the bouncer's decision. I mean, if I execute... for example

sudo cscli decisions list
sudo cscli alerts list
sudo cscli alerts inspect <ID>
sudo cscli alerts inspect <ID> -d

I can see something like "action ban" or "Remediation : true" but I have no information about what bouncer is used and how it worked(yes, I can see the "action ban" but where? with what directive?).

In fact, I tried the same without installing any bouncer and I receive the same result as before.

It looks like a ghost decision, I would like to install crowdsec in a production environment because looks very well but I have doubts.

Is there another command to get deeper on this topic?

I said "two questions":

Learning about crowdsec I have heard that crowdsec retrieves information about your setup or system and if you decide to not share you'll have a shrunk version of the community's blacklist

Where can I find more information/documentation to confirm or discard this? I have searched but looks like is something said only in forums, nothing official.

I have some external services behind Caddy on opnsense. I wanted to look at banning IP addresses for multiple failed logins and Crowdsec looks like it will fit the bill.

I installed the plugin and configured as per the below (so no separate caddy bouncer which I think does not apply to this method)

https://docs.opnsense.org/manual/how-tos/caddy.html#crowdsec-integration

tested using the decisions command from CLI and it works fine. I can see external addresses hitting the IPV4 blacklist firewall rule into LAN aswell and being blocked there.

I can also see that login attempts are generated in the log files at

/var/log/caddy/access

If I access one of my services via my phone on mobile data and spam it with failed logins it does not ban it, Am I missing a configuration step somewhere?

I subscribe to this block list which contains the IP 139.144.52.241.

The way I understand it is that since that IP is already part of my blocklist and decisions, it would just auto block and not generate a new decision and alert for it. However, in my console, it has the standard 4 hour ban and an alert generated for the event, hitting the http-probing scenario

EDIT: I set the API listen ip to 0.0.0.0 in the crowdsec config files and that seemed to work. I have Crowdsec running on baremetal and Caddy in a container

I have Caddy (with https://github.com/hslatman/caddy-crowdsec-bouncer) and Crowdsec running on the same network in Docker. I haven't been able to the two to communicate with each other and I'm not sure where the problem is. Does anyone know what the issue is?

The following lines show up continuously in the Caddy logs in Portainer.

WRN ts=1731971780.0233498 logger=crowdsec msg=failed to send metrics: Post "http://0.0.0.0:8080/v1/usage-metrics": dial tcp 0.0.0.0:8080: connect: connection refused instance_id=3b161d6d address=http://0.0.0.0:8080/

ERR ts=1731971780.0328426 logger=crowdsec msg=auth-api: auth with api key failed return nil response, error: dial tcp 0.0.0.0:8080: connect: connection refused instance_id=3b161d6d address=http://0.0.0.0:8080/ error=auth-api: auth with api key failed return nil response, error: dial tcp 0.0.0.0:8080: connect: connection refused

ERR ts=1731971780.032932 logger=crowdsec msg=failed to connect to LAPI, retrying in 10s: Get "http://0.0.0.0:8080/v1/decisions/stream?startup=true": dial tcp 0.0.0.0:8080: connect: connection refused instance_id=3b161d6d address=http://0.0.0.0:8080/ error=failed to connect to LAPI, retrying in 10s: Get "http://0.0.0.0:8080/v1/decisions/stream?startup=true": dial tcp 0.0.0.0:8080: connect: connection refused

Here is the stack I used to build it

services:
  caddy:
    image: xcaddy
    container_name: caddy
    restart: always
    security_opt:
      - no-new-privileges=true
    cap_add:
      - NET_ADMIN
    environment:
      CROWDSEC_API_KEY: ${CROWDSEC_API_KEY}
      PUID: "1000"
      PGID: "1000"
    ports:
      - 80:80
      - 443:443
    networks:
      - webproxy
      - crowdsec
    volumes:
      - ${PWD}/caddy/Caddyfile:/etc/caddy/Caddyfile
      - ${PWD}/caddy/data:/data
      - logs:/var/log/caddy
      - caddy-config:/config

  crowdsec:
    image: docker.io/crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    security_opt:
      - no-new-privileges=true
    environment:
      PUID: "1000"
      PGID: "1000"
      COLLECTIONS: crowdsecurity/caddy crowdsecurity/http-cve crowdsecurity/whitelist-good-actors
      BOUNCER_KEY_CADDY: ${CROWDSEC_API_KEY}
    ports:
          - 8080:8080
    networks:
      - crowdsec
    depends_on:
      - 'caddy'
    volumes:
      - crowdsec-db:/var/lib/crowdsec/db
      - ${PWD}/crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - logs:/var/log/caddy:ro

networks:
  crowdsec:
    driver: bridge
  webproxy:
    name: caddy_default
    external: true

volumes:
  logs:
  crowdsec-db:
  caddy-config:

I've just installed hoarder and my PC keeps getting blocked by http-crawl-non_statics ...

For other services I found a collection to help preventing false positive. But in this case there is none. How do I help myself (setting up a costum collection) ?

What is the best practice?

Just wanted to make sure I'm not reading this incorrectly, but it seems the Parser doesn't match the "default-host_access.log" for the official Crowdsec NPM parser (pattern on line 20).

The logs in default-host_access.log most notably have a double dash after the remote host - -

example: 179.43.191.98 - - [11/Nov/2024:03:11:54 -0800] "GET / HTTP/1.1" 404 150 "-" "-"

I asked chatgpt and it seems this grok pattern would work better

%{IPORHOST:remote_addr} - - \[%{HTTPDATE:time_local}\] "%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}" %{NUMBER:status} %{NUMBER:body_bytes_sent} "%{NOTDQUOTE:http_referer}" "%{NOTDQUOTE:http_user_agent}"

Is this right, am I mistaken, or is something wrong with my logs (I've used two different images with the same log naming)?

Hey guys,

What would be the use case for the Cloudflare workers bouncer vs Cloudflare bouncer?

I’m currently on the free plan, using Traefik with CS and the CF bouncer, but seeing as how you can get cloudflare workers starting from £5 a month vs the £20 for the pro plan, is the cloudflare worker bouncer designed to be a replacement/alternative?

Is there a way to use CrowdSec with self-hosted SimpleLogin? I can't find anything on Google.

Hi everyone,

I have CrowdSec working with my traefik installation. I am wanting to open up my jellyfin instance publicly so that I can share it with friends and family (so in that case VPN isn’t an option).

My jellyfin route is already setup with crowdsec, and I see the logs getting parsed, and can trigger manual bans for testing. Geo blocking is also in place.

I am now wondering if this is enough for security. Should crowdsec also parse the jellyfin authentication logs for extra protection? Or isn’t it enough to have the traefik bouncer running as the middleware?

Thanks!

When implementing and testing CrowdSec, I've run across what appears to be a false-positive, but I'd like to home someone with more experience put some eyes on it to confirm.

My Setup

cloudflare tunnel -> cloudflare docker container -> traefik -> pi running piaware

crowdsec and the traefik bouncer are running as containers on the same network as traefik and cas RO volume access to its access log.

The problem

After a user connects to the piaware page (through the tunnel and proxied through traefik, the client side polls an aircraft.json url as follows:

<IP> - - [26/Oct/2024:20:06:57 +0000] "GET /skyaware/data/aircraft.json?_=1729973114413 HTTP/1.1" 200 18578 "-" "-" 678 "adsb@file" "http://192.168.1.11" 22ms
<IP> - - [26/Oct/2024:20:06:58 +0000] "GET /skyaware/data/aircraft.json?_=1729973114414 HTTP/1.1" 200 18579 "-" "-" 679 "adsb@file" "http://192.168.1.11" 23ms
<IP> - - [26/Oct/2024:20:06:59 +0000] "GET /skyaware/data/aircraft.json?_=1729973114415 HTTP/1.1" 200 18597 "-" "-" 680 "adsb@file" "http://192.168.1.11" 22ms
<IP> - - [26/Oct/2024:20:07:01 +0000] "GET /skyaware/data/aircraft.json?_=1729973114416 HTTP/1.1" 200 18573 "-" "-" 681 "adsb@file" "http://192.168.1.11" 23ms
<IP> - - [26/Oct/2024:20:07:02 +0000] "GET /skyaware/data/aircraft.json?_=1729973114417 HTTP/1.1" 200 18445 "-" "-" 682 "adsb@file" "http://192.168.1.11" 23ms
<IP> - - [26/Oct/2024:20:07:03 +0000] "GET /skyaware/data/aircraft.json?_=1729973114418 HTTP/1.1" 200 18380 "-" "-" 683 "adsb@file" "http://192.168.1.11" 23ms

Note the incrementing data passed along in the GET. After only a few polls, the client is blocked with one or both of the following:

crowdsecurity/http-crawl-non_statics
crowdsecurity/http-probing

I assume this is a false positive due to the nature of the polling. Is there a way to ignore this for the site? I can't whitelist everyone that may try to connect.

Hi,

I try to add crowdsec to my homelab with traefik, but it's not working so I have some questions.

I installed crowdsec and traefik in two container (in the same network). All the logs are good and crowdsec get the log from traefik without any issue (cscli metrics get me all the file). I used a bouncer for traefik (https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin), it seems ok (no problem in the log), but when I try to access my service with crowdsec as a middleware I always get the webpage : "crowdsec access forbidden".

I try to understand why it's not working and I need your help for two things :

- when I go on the webpage of crowdsec, in my security engine, I see no activities (no engine authentication to the CrowdSec API, no security engine's status, ...) since some day ago (I did a lot of change since then), but when I check the capi status (cscli capi status) I get : "INFO You can successfully interact with Central API (CAPI)". I don't know if everything is good, do you know what I can do ?

- I added a bouncer (cscli bouncers add NAME) and I use my key in all the place i need in my container (crowseclapikey in my traefik dynamic config file and in the env of crowdsec), but when I used the bouncer from maxlerebourg (https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin), I see a new bouncer (TRAEFIK) in the list of bouncer (cscli bouncers list) (and a new machines too). I don't know the key of this bouncer, I don't know what I need to do with this (or if I don't need to do something with it), can someone help me on this ?

I used this tuto : https://blog.lrvt.de/configuring-crowdsec-with-traefik/

If somebody have any idea where what I can do to make this work I will be really gratefull, thank you in advance ! (I can give my docker compose file, log, status to help).

Hello everyone! I'm running a Crowdsec installation for 3 services supposedly fine (I get IP bans in the correct scenarios) until I received an error in one of the bouncer logs stating that it couldn't create more new AWS WAF IPSets. I realized I had 100 existing IPSets and that was a current limit that I'd need to increase.

I have 3 EC2 instances. Each instance runs a different service via docker-compose stack. And in each stack there's a crowdsec and crowdsec-awf-waf-bouncer service running.

All three services share the same AWS WAF ACL (crowdsec-<ENV_NAME>) and each service writes a new Group Rule. Here's the example configuration for the bouncer of the service "myservice":

api_key: redacted-api-key
api_url: "http://127.0.0.1:8080/"
update_frequency: 10s
waf_config:
  - web_acl_name: crowdsec-staging
    fallback_action: ban
    rule_group_name: crowdsec-waf-bouncer-ip-set-myservice
    scope: REGIONAL
    capacity: 300
    region: us-east-1
    ipset_prefix: myservice-crowdsec-ipset-a

From https://docs.crowdsec.net/u/bouncers/aws_waf/ for the ipset_prefix parameter it states: "All ipsets are deleted on shutdown."

And I noticed this is not happening. Everytime the docker-compose stack is restarted new IPSets are created and the old ones remain.

I have RTFM and STFW without results. I have no suspicious information from the logs of crowdsec and crowdsec-awf-waf-bouncer that I can use.

I have tried setting IAM AdministratorAccess policy to the EC2's IAM role in case it was lacking an IAM permissions but it seems not to be the case.

Has anyone detected this issue before? What could I be doing wrong?

Thanks in advance for reading.

Crowdsec image: crowdsecurity/crowdsec:v1.6.2
Bouncer image: crowdsecurity/aws-waf-bouncer:v0.1.7

Hello,

I have actual a problem with a IP from my Webhoster.
Crowdsec banned the IP, but I don’t know why?
But my problem is a other problem.
I have created a whitelist “/etc/crowdsec/parsers/s02-enrich/mywhitelists.yaml” and added the following

name: crowdsecurity/whitelists
description: "Whitelist for me"
whitelist:
reason: "Whitelist for working"
ip:
- "IP" # Webhosting

After this I restarted crowdsec and check, if the mywhitelists.yaml will be parsed.
I checked it with “cscli parsers list” and the list will be parsed:

crowdsecurity/whitelists 🏠 enabled,local /etc/crowdsec/parsers/s02-enrich/mywhitelists.yaml

I unban the IP and it works. But after 2 hours the IP is on the banlist again and I have no access to my Webhosting.

Is there a problem with my whitelist or something else?
How can I whitelist my IP?

Thanks,
Robert

My server sometimes freezes and mostly recovers with top showing 'crowdsec' and 'clickhouse-server' (what is that?!) the culprits.

I'm running 6 low traffic WordPress web sites in Docker containers behind Traefik proxy on an AWS Lightsail with 4Gb RAM and 2 vCPUs.

Has anyone else experienced issues like this?

Since Sophos released their Active Threat Response feature I've been adding intelligence feeds to my firewall. I tried to do this with Crowdsec's new integration but no matter what I try it's not connecting to my account at all. I know I can post this over at the Sophos subreddit as well but I was wondering if anyone else here has run into the same issue?

Yes i know i know, there a re some tutorials and even youtube videos about this topic. Also a tutorial from the crowdsec team itself.
BUT all those tutorials are about the lepresidente/nginx-proxy-manager docker image. Sadly, one of the biggest issues is: the nginx web ui isn't working anymore (which is also confirmed from several users). So i still wanrt to use the good old NginxProxyManager/nginx-proxy-manager.

This is my nginx proxy manager docker compose file:

services:
  app:
    container_name: nginx_proxy_manager
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    networks:
      - proxy_network
    environment:
      TZ: "Europe/Berlin"

networks:
  proxy_network:

Which is working flawlessly. The web ui is reachable and about the last couple of month i can add hosts and managed those wiuth this reverse proxy. So far so good.

But now i want to secure the proxy with crowdsec. Is there a tutorial or a good documentation how to do this with NginxProxyManager/nginx-proxy-manager one INSTEAD the lepresidente image? All nginx log files are mounted from the nginx docker container on my host at ~/docker/nginxproxymanager/data/log/*.log. Basically what i want: running npm in docker container. Running crowdsec native on my host (WITHOUT docker).

Hello Everyone!

Has anyone managed to get the Firewall Bouncer to work on OPNsense (24.7.6)? I have the LAPI running on a remote server.

I followed this guide: OPNsense | CrowdSec

But no matter what I do the firewall bouncer is not starting. No error in the log. I have edited the firewall bouncer yaml and changed the LAPI url, registered/validated machine, added the api key etc.

Just curious of someone has gotten it work with remote LAPI. Thanks!

I understand that I can subscribe to 3 blocklists as I am on the community/free licence.

However, none of them are from Crowdsec. All Crowdsec lists are premium.

Do I still get the community "dynamic" blocklist generated by Crowdsec when detecting attacks from other clients? Or is that gone now and just replaced by list I subscribe to?

Anyone solve the issue where crowdsec blocks let's encrypt renewals from happening?

We have crowdsec on three large plesk servers and it's causing issues with sites not getting the updated let's encrypt on renewal.

Thanks,

Apart from the parser entries starting with "crowdsecurity/.....", it also lists "child-crowdsecurity/...."

https://preview.redd.it/zswjb5mgcvtd1.png?width=559&format=png&auto=webp&s=cb4e80ba3a5a347e33b59f62aac49c25e3b41d27

What is the difference?