il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(crowdsec): optimize whitelist expressions

Browse Source 
update notes:
- add http_status and http_verb for each expressions (actual budget, immich, opencloud)
- fix crowdsec and issues documents
This commit is contained in:
il
2026-05-07 10:32:11 +09:00
parent b404a9e459
commit a05951f883
5 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2
+3 -3
View File
@@ -13,11 +13,11 @@ whitelist:
{% if node['name'] == 'auth' %} {% if node['name'] == 'auth' %}
expression: expression:
# budget local-first sql scrap rule # budget local-first sql scrap rule
- "evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/'" - "evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/data/migrations/'"
# immich thumbnail request 404 error false positive # immich thumbnail request 404 error false positive
- "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'" - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
# opencloud chunk request false positive # opencloud chunk request false positive
- "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'" - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'"
# nextcloud thumbnail/preview request error false positive # nextcloud thumbnail/preview request error false positive
- "evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/index.php/core/preview?'" - "evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/index.php/core/preview?'"
{% endif %} {% endif %}
docs/issues/crowdsec/260321_actual_budget.md
+2 -1
View File
@@ -21,13 +21,14 @@
## Timeline ## Timeline
- 2026-03-21: Release actual budget - 2026-03-21: Release actual budget
- 2026-03-21: Find the false positive case, and add whitelist - 2026-03-21: Find the false positive case, and add whitelist
- 2026-05-07: Optimize whitelist expression
## Solution ## Solution
- Access to fw - Access to fw
- Check the ban list with `sudo cscli alerts list` - Check the ban list with `sudo cscli alerts list`
- Read the ban case with `sudo cscli alerts inspect $NUMBER` - Read the ban case with `sudo cscli alerts inspect $NUMBER`
- Add expressions on whitelist - Add expressions on whitelist
- evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/' - evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/data/migrations/'
- Delete false positive decision - Delete false positive decision
- Check false positive decision with `sudo cscli decision list` - Check false positive decision with `sudo cscli decision list`
- Delete false positive decision with `sudo cscli decision delete --id $ID` - Delete false positive decision with `sudo cscli decision delete --id $ID`
docs/issues/crowdsec/260321_immich.md
+2 -1
View File
@@ -20,13 +20,14 @@
## Timeline ## Timeline
- 2026-03-21: Release Immich - 2026-03-21: Release Immich
- 2026-03-21: Find the false positive case, and add whitelist - 2026-03-21: Find the false positive case, and add whitelist
- 2026-05-07: Optimize whitelist expression
## Solution ## Solution
- Access to fw - Access to fw
- Check the ban list with `sudo cscli alerts list` - Check the ban list with `sudo cscli alerts list`
- Read the ban case with `sudo cscli alerts inspect $NUMBER` - Read the ban case with `sudo cscli alerts inspect $NUMBER`
- Add expressions on whitelist - Add expressions on whitelist
- evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail' - evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
- Delete false positive decision - Delete false positive decision
- Check false positive decision with `sudo cscli decision list` - Check false positive decision with `sudo cscli decision list`
- Delete false positive decision with `sudo cscli decision delete --id $ID` - Delete false positive decision with `sudo cscli decision delete --id $ID`
docs/issues/crowdsec/260404_opencloud.md
+2 -1
View File
@@ -20,13 +20,14 @@
## Timeline ## Timeline
- 2026-04-04: Release OpenCloud - 2026-04-04: Release OpenCloud
- 2026-04-04: Find the false positive case, and add whitelist - 2026-04-04: Find the false positive case, and add whitelist
- 2026-05-07: Optimize whitelist expression
## Solution ## Solution
- Access to fw - Access to fw
- Check the ban list with `sudo cscli alerts list` - Check the ban list with `sudo cscli alerts list`
- Read the ban case with `sudo cscli alerts inspect $NUMBER` - Read the ban case with `sudo cscli alerts inspect $NUMBER`
- Add expressions on whitelist - Add expressions on whitelist
- evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/' - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'
- Delete false positive decision - Delete false positive decision
- Check false positive decision with `sudo cscli decision list` - Check false positive decision with `sudo cscli decision list`
- Delete false positive decision with `sudo cscli decision delete --id $ID` - Delete false positive decision with `sudo cscli decision delete --id $ID`
docs/services/common/crowdsec.md
+2 -2
View File
@@ -234,9 +234,9 @@ fw@fw:~$ sudo cscli alerts inspect 230 -d
- check the log and analyze and make expression - check the log and analyze and make expression
- e.g. immich - e.g. immich
- evt.Meta.target_fqdn == 'immich.ilnmors.com' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail' - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
- e.g. opencloud - e.g. opencloud
- "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'" - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'"
- free false positive decision - free false positive decision
fw@fw:~$ sudo cscli decision list fw@fw:~$ sudo cscli decision list