# Http-generic-bf don't work(((

**URL:** <https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829>\
**Category:** Uncategorized\
**Created:** [May 31, 2022, 3:10am UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829 "2022-05-31T03:10:54Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 3:10am UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/1 "2022-05-31T03:10:54Z")

</div>

Hi installed http-generic-bf but it doesn’t work (look through cscli explain --file /var/log/nginx/test.server.test --type nginx and there is no script there(

 ![Screenshot_2](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/a1ae409635ddeff83f55ead3e681bc83510b9c48.png)

 ![Screenshot_3](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/e278b75639a9f424dcef80174b8f5c63ecdde694.png)

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [May 31, 2022, 9:27am UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/2 "2022-05-31T09:27:08Z")

</div>

Hi,

It depend on the logs sample. If there is no log that match the scenario filter, it will not display as a success in the explain command.

[`crowdsecurity/http-crawl-non_statics`](https://hub.crowdsec.net/author/crowdsecurity/configurations/http-crawl-non_statics) as this filter : `filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.static_ressource == 'false' && evt.Parsed.verb in ['GET', 'HEAD']"`.

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 2:10pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/3 "2022-05-31T14:10:01Z")

</div>

> [@fayataf488](#):
>
> http-generic-bf

I wanted to use nginx authorization to protect against brute force, the logs are standard as with nginx authorization errors, each site has its own log. this is a script like and did under nginx auth

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [May 31, 2022, 2:53pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/4 "2022-05-31T14:53:58Z")

</div>

Ah yes didn’t see that you were talking about `http-generic-bf` because of your `cscli explain` command output that didn’t display this scenario.  
It means your logs sample didn’t have the behavior you’re trying to detect. If you generate logs with bad basic authentications you will be able to test this scenario.

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 3:48pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/5 "2022-05-31T15:48:01Z")

</div>

![Снимок экрана 2022-05-31 в 22.38.50](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/473fa8c139b286988fdec45bce26e72c2fbfe947.png)  
here is the basic nginx authorization log, I understand correctly that the http-generic-bf.yaml log is located in /var/log/nginx/test.example.com

filter filter: “evt.Meta.service == ‘http’ && evt.Meta.sub\_type == ‘auth\_fail’”  
looking for in line ‘auth\_fail’???

and this filter says  
filter: “evt.Meta.log\_type == ‘http\_access-log’ && evt.Parsed.verb == ‘POST’ && evt.Meta.http\_status == ‘401’”

look in http\_access-log file, POST method and 401 error code?

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [May 31, 2022, 3:58pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/6 "2022-05-31T15:58:06Z")

</div>

The first scenario is trying to detect authentication failures on basic auth ([see nginx-logs](https://github.com/crowdsecurity/hub/blob/master/parsers/s01-parse/crowdsecurity/nginx-logs.yaml#L35)) when the nginx parser match [this pattern](https://github.com/crowdsecurity/hub/blob/master/parsers/s01-parse/crowdsecurity/nginx-logs.yaml#L29) or [this one](https://github.com/crowdsecurity/hub/blob/master/parsers/s01-parse/crowdsecurity/nginx-logs.yaml#L40) it will apply the meta `evt.Meta.sub_type` =\> `auth_fail`.

The second scenario need `401` and POST http method. Following your log sample you pasted, it seems you don’t have those king of logs.

Could you please paste some logs samples here so we can try to see if there is a behavior that we don’t detect yet.

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 4:08pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/7 "2022-05-31T16:08:52Z")

</div>

site.conf  
#AUTH model  
auth\_basic “Secure Zone”;  
access log error log split

access\_log

8.8.8.8 - fsdgds [01/Jun/2022:00:07:22 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - dsfsdfs [01/Jun/2022:00:07:25 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - dsfdsfds [01/Jun/2022:00:07:27 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - dsfsd [01/Jun/2022:00:07:53 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - dsfsd [01/Jun/2022:00:07:53 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - asdas [01/Jun/2022:00:07:55 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - dfsdafasf [01/Jun/2022:00:07:57 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - adsfadsf [01/Jun/2022:00:08:03 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - sdfasdf [01/Jun/2022:00:08:05 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - asdfasdfasd [01/Jun/2022:00:08:06 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

8.8.8.8 - adsfasdfasdf [01/Jun/2022:00:08:07 +0800] “GET / HTTP/1.1” 401 172 “-” “Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0”

error\_log

2022/06/01 00:07:25 [error] 3723813#3723813: \*271234 user “dsfsdfs” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:07:27 [error] 3723813#3723813: \*271234 user “dsfdsfds” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:07:53 [error] 3723813#3723813: \*271234 user “dsfsd” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:07:53 [error] 3723813#3723813: \*271236 user “dsfsd” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:07:55 [error] 3723813#3723813: \*271236 user “asdas” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:07:57 [error] 3723813#3723813: \*271236 user “dfsdafasf” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:08:03 [error] 3723813#3723813: \*271236 user “adsfadsf” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:08:05 [error] 3723813#3723813: \*271236 user “sdfasdf” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:08:06 [error] 3723813#3723813: \*271236 user “asdfasdfasd” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

2022/06/01 00:08:07 [error] 3723813#3723813: \*271236 user “adsfasdfasdf” was not found in “/etc/nginx/auth/example.conf”, client: 8.8.8.8, server: [test.example.com](http://test.example.com), request: “GET / HTTP/1.1”, host: “[test.example.com](http://test.example.com)”

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 4:32pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/8 "2022-05-31T16:32:54Z")

</div>

/http-generic-bf works like error logs, and if you just log without a password, then /http-generic-bf does not work.

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [May 31, 2022, 4:35pm UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/9 "2022-05-31T16:35:58Z")

</div>

for some reason, the err logs were not added to the acquis.yaml file (((I don’t understand why

---

<div class="post-metadata">

**Author:** ![he2ss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/he2ss/32/95_2.png) [@he2ss](https://discourse.crowdsec.net/u/he2ss)\
**Post date:** [June 1, 2022, 9:30am UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/10 "2022-06-01T09:30:51Z")

</div>

Hi, I just tested with your logs the `cscli explain`and I was able to trigger the scenario:

```auto
line: 2022/06/01 00:08:07 [error] 3723813#3723813: *271236 user "adsfasdfasdf" was not found in "/etc/nginx/auth/example.conf", client: 8.8.8.8, server: test.example.com, request: "GET / HTTP/1.1", host: "test.example.com"
	├ s00-raw
	|	├ 🟢 crowdsecurity/non-syslog (first_parser)
	|	└ 🔴 crowdsecurity/syslog-logs
	├ s01-parse
	|	└ 🟢 crowdsecurity/nginx-logs (+19 ~3)
	├ s02-enrich
	|	├ 🟢 crowdsecurity/dateparse-enrich (+2 ~1)
	|	├ 🟢 crowdsecurity/geoip-enrich (+13)
	|	├ 🔴 crowdsecurity/http-logs
	|	└ 🟢 crowdsecurity/whitelists (+2)
	├-------- parser success 🟢
	├ Scenarios
		├ 🟢 crowdsecurity/http-crawl-non_statics
		└ 🟢 crowdsecurity/http-generic-bf

```

---

<div class="post-metadata">

**Author:** ![fayataf488](https://avatars.discourse-cdn.com/v4/letter/f/a4c791/32.png) [@fayataf488](https://discourse.crowdsec.net/u/fayataf488)\
**Post date:** [June 2, 2022, 2:23am UTC](https://discourse.crowdsec.net/t/http-generic-bf-dont-work/829/11 "2022-06-02T02:23:21Z")

</div>

It also worked for me when I added error logs