Need help to get custom whitelist to work

crowdsec
1

Hey guys,

I need your support to push me in the right direction getting my custom whitelist to work.

Setup:

  • Ubuntu Server with Pangolin and Crowdsec (Crowdsec-Bouncer-Traefik-Plugin) installation as Docker-Images
  • Crowdsec account registered and enrolled with Crowdsec installation
  • Basically installation seems to work but banned IPs from my mobile and cable carrier

Problem:

I cannot get a custom whiteliste YAML-file parsed/recognized by crowdsec :frowning:

Tried to created the file via:

  1. host mount directory /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/01-my-whitelist.yaml
  2. inside crowdsec docker image /etc/crowdsec/parsers/s02-enrich/01-my-whitelist.yaml

I also tried the variant to symlink from docker image to host file.

After restarting the docker images with docker compose down && docker compose up -d --force-recreate the file is ignored and not listed as parser in the result of docker exec crowdsec cscli parsers list.

level=warning msg=“Ignoring file /etc/crowdsec/hub/parsers/s02-enrich/crowdsecurity/01-my-whitelist.yaml of type parsers”

image
image1001×250 5.86 KB

These where the contents of the file I tested with:

name: homelab/ASN-whitelist
description: “Whitelist Trusted ASNs”
whitelist:
reason: “Whitelisted ASN”
expression:

  • evt.Meta.ASNumber in [‘XXX1’, ‘XXX2’]
  • evt.Enriched.ASNumber in [‘XXX1, ‘XXX2’]

name: homelab/ASN-whitelist
description: “Whitelist own ASNs”
whitelist:
reason: “Whitelisted ASN”
cidr:

  • “XXX.XXX.X.X/16”
  • “XXX.XXX.X.X/12”

I am thankful to every idea :slight_smile:

Thx in advance