# Captcha reCAPTCHA is working - nginx bouncer - parser noch everytime working - i want captcha every time

**URL:** <https://discourse.crowdsec.net/t/captcha-recaptcha-is-working-nginx-bouncer-parser-noch-everytime-working-i-want-captcha-every-time/1991>\
**Category:** Uncategorized\
**Created:** [August 30, 2024, 10:18pm UTC](https://discourse.crowdsec.net/t/captcha-recaptcha-is-working-nginx-bouncer-parser-noch-everytime-working-i-want-captcha-every-time/1991 "2024-08-30T22:18:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![v1net](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/v1net/32/961_2.png) [@v1net](https://discourse.crowdsec.net/u/v1net)\
**Post date:** [August 30, 2024, 10:18pm UTC](https://discourse.crowdsec.net/t/captcha-recaptcha-is-working-nginx-bouncer-parser-noch-everytime-working-i-want-captcha-every-time/1991/1 "2024-08-30T22:18:45Z")

</div>

Hi,  
is there a option to have a captcha every time?

my profiles.yaml looks like this:

name: captcha\_remediation  
filters:

- Alert.Remediation == true && Alert.GetScope() == “Ip” && Alert.GetScenario() contains “http”

## Any scenario with http in its name will trigger a captcha challenge

decisions:

- type: captcha  
duration: 4h  
on\_success: break

* * *

name: default\_ip\_remediation  
filters:

- Alert.Remediation == true && Alert.GetScope() == “Ip”  
decisions:
- type: ban  
duration: 4h  
#duration\_expr: “Sprintf(‘%dh’, (GetDecisionsCount(Alert.GetValue()) + 1) \* 4)”  
on\_success: break

profiles.yaml

```auto
> 
> > 
> > 
> > name: captcha_remediation
> > filters:
> > - Alert.Remediation == true && Alert.GetScope() == "Ip" && Alert.GetScenario() contains "http"
> > ## Any scenario with http in its name will trigger a captcha challenge
> > decisions:
> > - type: captcha
> > duration: 4h
> > on_success: break
> > ---
> > name: default_ip_remediation
> > filters:
> > - Alert.Remediation == true && Alert.GetScope() == "Ip"
> > decisions:
> > - type: ban
> > duration: 4h
> > #duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
> > on_success: break
> > #duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
> > # notifications:
> > # - slack_default # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
> > # - splunk_default # Set the splunk url and token in /etc/crowdsec/notifications/splunk.yaml before enabling this.
> > # - http_default # Set the required http parameters in /etc/crowdsec/notifications/http.yaml before enabling this.
> > # - email_default # Set the required email parameters in /etc/crowdsec/notifications/email.yaml before enabling this.

```

```auto
root@vaultwarden:/etc/crowdsec/bouncers# ls
crowdsec-firewall-bouncer.yaml crowdsec-firewall-bouncer.yaml.id crowdsec-nginx-bouncer.conf

```

captcha is working if i set it manualy  
` cscli decisions add --ip X.X.240.81 --type captcha`

Parser Metrics:  
╭───────────────────────────────────────┬──────┬────────┬──────────╮  
│ Parsers │ Hits │ Parsed │ Unparsed │  
├───────────────────────────────────────┼──────┼────────┼──────────┤  
│ Dominic-Wagner/vaultwarden-logs │ 14 │ - │ 14 │  
│ child-Dominic-Wagner/vaultwarden-logs │ 42 │ - │ 42 │  
│ crowdsecurity/non-syslog │ 14 │ 14 │ - │  
╰───────────────────────────────────────┴──────┴────────┴──────────╯

---

<div class="post-metadata">

**Author:** ![v1net](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/v1net/32/961_2.png) [@v1net](https://discourse.crowdsec.net/u/v1net)\
**Post date:** [August 31, 2024, 12:18am UTC](https://discourse.crowdsec.net/t/captcha-recaptcha-is-working-nginx-bouncer-parser-noch-everytime-working-i-want-captcha-every-time/1991/2 "2024-08-31T00:18:12Z")

</div>

root@vaultwarden:/etc/crowdsec/parsers/s01-parse# cscli explain --file /var/lib/vaultwarden/data/access.log --type vaultwarden  
WARN Line 0/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
WARN Line 1/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
WARN Line 2/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
WARN Line 3/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
WARN Line 4/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
WARN Line 5/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  
line: [2024-08-31 02:10:24.865][vaultwarden::util][WARN] Can’t connect to database, retrying: DieselCon.  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: [CAUSE] BadConnection(  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: “connection to server at "localhost" (::1), port 5432 failed: Connection refused\n\tIs the server running on that host and accepting TCP/IP connections?\nconnection to server at "localhost" (127.0.0.1), port 5432 failed: Connection refused\n\tIs the server running on that host and accepting TCP/IP connections?\n”,  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: )  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: [2024-08-31 02:11:22.129][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.94. Username: [v@bdnej.de](mailto:v@bdnej.de).  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: [2024-08-31 02:11:28.562][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.94. Username: [v@bdnej.de](mailto:v@bdnej.de).  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

---

<div class="post-metadata">

**Author:** ![v1net](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/v1net/32/961_2.png) [@v1net](https://discourse.crowdsec.net/u/v1net)\
**Post date:** [August 31, 2024, 12:23am UTC](https://discourse.crowdsec.net/t/captcha-recaptcha-is-working-nginx-bouncer-parser-noch-everytime-working-i-want-captcha-every-time/1991/3 "2024-08-31T00:23:15Z")

</div>

line: [2024-08-30 22:43:43.350][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 109.40.240.81. Username: [test@test.de](mailto:test@test.de).  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🟢 Dominic-Wagner/vaultwarden-logs (+11 ~2)  
├ s02-enrich  
| ├ 🟢 crowdsecurity/dateparse-enrich (+2 ~2)  
| ├ 🟢 crowdsecurity/geoip-enrich (+13)  
| ├ 🔴 crowdsecurity/http-logs  
| └ 🟢 crowdsecurity/whitelists (unchanged)  
├-------- parser success 🟢  
├ Scenarios  
├ 🟢 Dominic-Wagner/vaultwarden-bf  
└ 🟢 Dominic-Wagner/vaultwarden-bf\_user-enum

line: [2024-08-30 23:45:08.417][vaultwarden::util][WARN] Can’t connect to database, retrying: DieselCon.  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: )  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴

line: [2024-08-31 00:58:28.644][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.83. Username: [v@redbbb.de](mailto:v@redbbb.de).  
├ s00-raw  
| ├ 🔴 crowdsecurity/syslog-logs  
| └ 🟢 crowdsecurity/non-syslog (+5 ~8)  
├ s01-parse  
| ├ 🔴 crowdsecurity/nginx-logs  
| ├ 🔴 crowdsecurity/sshd-logs  
| └ 🔴 Dominic-Wagner/vaultwarden-logs  
└-------- parser failure 🔴