il/ilnmors-homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(crowdsec): update whitelist.yaml to prevent false positive

Browse Source 
false positive:
- nextcloud chunk problem (crowdsecurity/http-crawl-non_statics)
This commit is contained in:
Il Lee
2026-05-11 19:34:22 +09:00
parent 0f4da0bb53
commit a39122eb4b
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/issues/crowdsec/260502_nextcloud.md
+4 -1
View File
@@ -23,11 +23,14 @@
- 2026-05-03: Make previous expressions annotation
- 2026-05-07: Find the false positive case, which is not on `crowdsecurity/nextcloud-whitelist`
- 2026-05-07: Set whitelist expression
- 2026-05-11: Find the false positive case, which is not on `crowdsec/nextcloud-whitelist`
- 2026-05-11: Set whitelist expression
## Solution
- Install crowdsecurity/nextcloud-whitelist on auth node
- Add expression on whitelist
- evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/index.php/core/preview?'
- evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/index.php/core/preview?'
- evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains 'chunks.mjs'
### Deprecated solution
- Access to fw