Nginx-proxy-manager+crowdsec (Docker) ban only local

Random-Human · February 6, 2024, 2:34pm

Status 200 in all logfiles…

iiAmLoz · February 6, 2024, 2:35pm

Then you need to write a custom scenario as we dont know the difference between a “good” 200 and a “bad” 200 status code

Providing us context of what the application is we can advise

Random-Human · February 6, 2024, 3:01pm

I have a server running at home with an Intel J5005 CPU (https://www.asrock.com/mb/Intel/J5005-ITX/index.de.asp) and Docker with Home Assistant is running on it (Docker).
This allows me to control lights, heating, appliances, etc. by voice. In order to use this, you need an https connection that can be accessed from the Internet. Hence NPM (for ssl). Unfortunately, anyone can access this “open” Home Assistant instance. Although you need a user and password, I still want more security against bot networks, hackers or automated scripts that try to gain access. Hence crowdsec. I can access an instance hosted on the internet by my home server and log in at home using a normal link via duckdns. This should be protected by crowdsec.
If someone enters the wrong password 3 times, they should be banned.

iiAmLoz · February 6, 2024, 3:06pm

Since home-assistant doesnt log the status code somebody has already wrote a parser for HA logs

https://app.crowdsec.net/hub/author/crowdsecurity/collections/home-assistant

Random-Human · February 6, 2024, 4:01pm

Is installed, but no ban. I can see it in app.crowdsec.net.

time="2024-02-06T14:02:01Z" level=info msg="capi metrics: sending"
time="2024-02-06T14:02:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:02:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 1.061891ms \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:03:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:03:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 927.006µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:04:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:04:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 971.808µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:05:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:05:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 929.684µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:06:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:06:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 770.941µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:07:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:07:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 655.555µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:08:05Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:08:05 UTC] \"POST /v1/watchers/login HTTP/1.1 200 85.079889ms \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:08:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:08:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 935.62µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:09:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:09:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 718.297µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:10:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:10:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 814.544µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:11:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:11:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 360.4µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:12:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:12:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 828.244µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:13:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:13:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 393.839µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:14:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:14:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 906.873µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:15:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:15:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 792.739µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:16:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:16:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 818.466µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:17:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:17:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 736.132µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:18:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:18:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 895.644µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:19:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:19:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 910.882µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:20:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:20:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 909.643µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:21:44Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:44 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 77.68907ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:45Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:45 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 80.148657ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:47Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:47 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 57.273726ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:48Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:48 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 80.801386ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:50Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:50 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 79.09474ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:52Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:52 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 76.648831ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:54Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:54 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 41.424487ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:55Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:55 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 63.628548ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:56Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:56 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 73.309099ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:57Z" level=info msg="127.0.0.1 - [Tue, 06 Feb 2024 14:21:57 UTC] \"GET /v1/heartbeat HTTP/1.1 200 385.21µs \"crowdsec/v1.6.0-4192af30\" \""
time="2024-02-06T14:21:58Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:58 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 75.721127ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:21:59Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:21:59 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 79.460863ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:01Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:01 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 38.665765ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:02Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:02 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 45.556413ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:03Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:03 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 39.38893ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:04Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:04 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 79.759498ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:05Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:05 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 78.430724ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:07Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:07 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 79.786577ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:08Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:08 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 77.39168ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:09Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:09 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 78.643328ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:10Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:10 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 43.082529ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:12Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:12 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 73.604555ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:13Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:13 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 75.152942ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:15Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:15 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 78.534567ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:16Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:16 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 44.646199ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:17Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:17 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 83.450341ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:19Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:19 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 75.952942ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:20Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:20 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 74.931665ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:21Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:21 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 82.489856ms \"crowdsec-openresty-bouncer/v1.0.1\" \""
time="2024-02-06T14:22:28Z" level=info msg="172.16.0.4 - [Tue, 06 Feb 2024 14:22:28 UTC] \"GET /v1/decisions?ip=176.6.179.224 HTTP/1.1 200 83.767393ms \"crowdsec-openresty-bouncer/v1.0.1\" \""

Acquisition Metrics:
╭────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────╮
│         Source         │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │
├────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┤
│ file:/var/log/auth.log │ 1          │ -            │ 1              │ -                      │
│ file:/var/log/syslog   │ 52         │ -            │ 52             │ -                      │
╰────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────╯

Parser Metrics:
╭─────────────────────────────────┬──────┬────────┬──────────╮
│             Parsers             │ Hits │ Parsed │ Unparsed │
├─────────────────────────────────┼──────┼────────┼──────────┤
│ child-crowdsecurity/syslog-logs │ 53   │ 53     │ -        │
│ crowdsecurity/syslog-logs       │ 53   │ 53     │ -        │
╰─────────────────────────────────┴──────┴────────┴──────────╯

Local API Metrics:
╭────────────────────┬────────┬──────╮
│       Route        │ Method │ Hits │
├────────────────────┼────────┼──────┤
│ /v1/decisions      │ GET    │ 7    │
│ /v1/heartbeat      │ GET    │ 3    │
│ /v1/watchers/login │ POST   │ 1    │
╰────────────────────┴────────┴──────╯

Local API Machines Metrics:
╭───────────┬───────────────┬────────┬──────╮
│  Machine  │     Route     │ Method │ Hits │
├───────────┼───────────────┼────────┼──────┤
│ localhost │ /v1/heartbeat │ GET    │ 3    │
╰───────────┴───────────────┴────────┴──────╯

Local API Bouncers Metrics:
╭─────────────┬───────────────┬────────┬──────╮
│   Bouncer   │     Route     │ Method │ Hits │
├─────────────┼───────────────┼────────┼──────┤
│ nginx-proxy │ /v1/decisions │ GET    │ 7    │
╰─────────────┴───────────────┴────────┴──────╯

Local API Bouncers Decisions:
╭─────────────┬───────────────┬───────────────────╮
│   Bouncer   │ Empty answers │ Non-empty answers │
├─────────────┼───────────────┼───────────────────┤
│ nginx-proxy │ 7             │ 0                 │
╰─────────────┴───────────────┴───────────────────╯

Local API Decisions:
╭────────────────────────────────────────────┬────────┬────────┬───────╮
│                   Reason                   │ Origin │ Action │ Count │
├────────────────────────────────────────────┼────────┼────────┼───────┤
│ crowdsecurity/f5-big-ip-cve-2020-5902      │ CAPI   │ ban    │ 23    │
│ crowdsecurity/http-admin-interface-probing │ CAPI   │ ban    │ 1415  │
│ crowdsecurity/http-probing                 │ CAPI   │ ban    │ 1276  │
│ crowdsecurity/ssh-bf                       │ CAPI   │ ban    │ 14055 │
│ crowdsecurity/CVE-2022-35914               │ CAPI   │ ban    │ 48    │
│ crowdsecurity/CVE-2022-42889               │ CAPI   │ ban    │ 4     │
│ crowdsecurity/http-sensitive-files         │ CAPI   │ ban    │ 38    │
│ crowdsecurity/ssh-slow-bf                  │ CAPI   │ ban    │ 46    │
│ crowdsecurity/thinkphp-cve-2018-20062      │ CAPI   │ ban    │ 6     │
│ firehol_cybercrime                         │ lists  │ ban    │ 840   │
│ crowdsecurity/CVE-2022-41082               │ CAPI   │ ban    │ 872   │
│ crowdsecurity/http-cve-2021-41773          │ CAPI   │ ban    │ 19    │
│ crowdsecurity/http-cve-2021-42013          │ CAPI   │ ban    │ 5     │
│ crowdsecurity/netgear_rce                  │ CAPI   │ ban    │ 4     │
│ otx-webscanners                            │ lists  │ ban    │ 8225  │
│ crowdsecurity/http-bad-user-agent          │ CAPI   │ ban    │ 14153 │
│ crowdsecurity/CVE-2023-22518               │ CAPI   │ ban    │ 11    │
│ crowdsecurity/http-backdoors-attempts      │ CAPI   │ ban    │ 1192  │
│ crowdsecurity/http-path-traversal-probing  │ CAPI   │ ban    │ 178   │
│ crowdsecurity/CVE-2023-22515               │ CAPI   │ ban    │ 17    │
│ crowdsecurity/CVE-2023-49103               │ CAPI   │ ban    │ 227   │
│ crowdsecurity/apache_log4j2_cve-2021-44228 │ CAPI   │ ban    │ 372   │
│ crowdsecurity/http-crawl-non_statics       │ CAPI   │ ban    │ 425   │
│ crowdsecurity/jira_cve-2021-26086          │ CAPI   │ ban    │ 10    │
│ ltsich/http-w00tw00t                       │ CAPI   │ ban    │ 1     │
│ firehol_cruzit_web_attacks                 │ lists  │ ban    │ 13252 │
│ crowdsecurity/CVE-2019-18935               │ CAPI   │ ban    │ 85    │
│ crowdsecurity/grafana-cve-2021-43798       │ CAPI   │ ban    │ 49    │
│ crowdsecurity/CVE-2022-37042               │ CAPI   │ ban    │ 21    │
│ crowdsecurity/CVE-2022-26134               │ CAPI   │ ban    │ 216   │
│ crowdsecurity/http-generic-bf              │ CAPI   │ ban    │ 16    │
│ crowdsecurity/http-open-proxy              │ CAPI   │ ban    │ 870   │
│ crowdsecurity/fortinet-cve-2018-13379      │ CAPI   │ ban    │ 58    │
╰────────────────────────────────────────────┴────────┴────────┴───────╯

Local API Alerts:
╭───────────────────────────────┬───────╮
│            Reason             │ Count │
├───────────────────────────────┼───────┤
│ manual 'ban' from 'localhost' │ 3     │
╰───────────────────────────────┴───────╯

iiAmLoz · February 6, 2024, 4:05pm

Yes, but have you setup the logs for home assistant to be passed into crowdsec? and then setup the acquisition to find the files?

Random-Human · February 6, 2024, 4:30pm

Now it finally works! Thank you for your great support, I couldn’t have done it without you! Thanks so much for your big help

I mounted the HA-log with Docker and put this in the acquis.yml:

filenames:
  - /var/log/homeassistant/home-assistant.log
labels:
  type: home-assistant

Topic		Replies	Views
Crowdsec NPM blocking is not working	0	17	January 18, 2025
Setting up crowdsec (native on host) with nginx proxy manager (running in docker) crowdsec	1	301	December 16, 2024
OpenResty Bouncer and Nginx Proxy Manager crowdsec	5	2233	January 11, 2022
[docker setup] local bouncer on host doesn't ban IPs	3	1155	September 30, 2023
Crowdsec deeply blocks my IP and I cannot revert it crowdsec	1	1039	January 19, 2024

Nginx-proxy-manager+crowdsec (Docker) ban only local

Related topics