Isolate client machines

crowdsec
1

Hello,

I’ve configured several CrowdSec machines (server 1, server 2…), and they are linked together via the API.

However, when I run the following command on server 1:

cscli decisions list --machine

I see the decisions of all the servers. I want this to be impossible and for it to return only the decisions of server 1 and not the others. The idea is to ensure the confidentiality of each client.

Thanks

2

The --machine flag just adds the machine ID to the output table it does not do any filtering you can do this by running cscli decisions list --machine | grep <machineid>

3

In fact, I have several customers connected to my central API. I would not like my customer 1 to be able to execute commands that can see the decision of neighboring machines; I want to have some segmentation.

4

cscli can only be ran as root / sudo privileges so you can restrict access to user accounts.

Unfortunately there is no client side segmentation unless you put a reverse proxy infront of the LAPI and match on the decisions route to block the access. (You can only just allow or deny)

5

Okay, thanks for the information