CrowdSec•9mo ago

Tracking nginx host not being banned

I’m trying too figure out why host 62 isn’t banning from failed login attempts this host does not fall under my Authentik. Here is the acquisition metrics

29 Replies

CrowdSec•9mo ago

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

iiamloz•9mo ago

So when you mean failing to login, which application is host 62 proxying too?

b_d0nOP•9mo ago

So I’m saying when I access the domain “host 62” and put a bogus password multiple times it never bans me. It’s proxying too stash Witch isn’t under Authentik, when under Authentik the ban works

iiamloz•9mo ago

and if you grep "login" from that proxy host you see the 401 status returned? cause at the moment we dont detect basic auth failures from a downstream application

b_d0nOP•9mo ago

Ahh so I’d need to wait until someone makes a parser for that application

iiamloz•9mo ago

well does it log the failed authentication if so yeah we can make one

b_d0nOP•9mo ago

I’m not sure how to use Grep. Can this be done on unraid? Would it be grep login ip:port? I do see ERRO[2025-02-04 05:40:58] Error logging in: invalid credentials in the applications logs itself

iiamloz•9mo ago

but as far as I can see there no IP and there an open issue for them to add it You can just write you own custom scenario instead

b_d0nOP•9mo ago

Can you help with this? And no I don’t see the ip listed in the logs during the failures

iiamloz•9mo ago

Yeah source so I suggest to do something like

# Detect stash Authorization Errors
type: leaky
#debug: true
name: my/stash-bf
description: "Detect stash Authorization error brute force"
filter: |
     evt.Meta.log_type == 'http_access-log' &&
     evt.Meta.target_fqdn == 'your_stash_host_here' &&
     evt.Parsed.verb == 'GET' &&
     evt.Meta.http_status == '401'
groupby: evt.Meta.source_ip
capacity: 3
leakspeed: "30s"
blackhole: 1m
labels:
  remediation: true

# Detect stash Authorization Errors
type: leaky
#debug: true
name: my/stash-bf
description: "Detect stash Authorization error brute force"
filter: |
     evt.Meta.log_type == 'http_access-log' &&
     evt.Meta.target_fqdn == 'your_stash_host_here' &&
     evt.Parsed.verb == 'GET' &&
     evt.Meta.http_status == '401'
groupby: evt.Meta.source_ip
capacity: 3
leakspeed: "30s"
blackhole: 1m
labels:
  remediation: true

You have to check the proxy logs if its 401 or 403 then you need to add this scenario to a file under /etc/crowdsec/scenarios/ it has to be named .yaml so stash-bf.yaml for example if your in a container you need to check if you are persisting the above folder EG /etc/crowdsec most likely

b_d0nOP•9mo ago

Like so?

iiamloz•9mo ago

Yeah so within /mnt/user/appdata/crowdsec/ you will find the sceanarios folder where you need to create the yaml file

b_d0nOP•9mo ago

And it’ll either be 401 or 403. What if it’s showing neither? Or is that not possible

iiamloz•9mo ago

not possible, there has to be a status code

b_d0nOP•9mo ago

WARN Ignoring file /etc/crowdsec/hub/scenarios/stash-bf.yaml: path is too short: /etc/crowdsec/hub/scenarios/stash-bf.yaml

WARN Ignoring file /etc/crowdsec/hub/scenarios/stash-bf.yaml: path is too short: /etc/crowdsec/hub/scenarios/stash-bf.yaml

Do I need to put it in its own folder or just add it to the crowdsecsecurity folder?

iiamloz•9mo ago

You add it to /etc/crowdsec/scenarios didnt say add it to the hub for official ones they get symlinked to the hub, for local one you place the file directly into the scenarios folder

b_d0nOP•9mo ago

That did it 🔥 thank you for all the help. So is it always applicationname-bf.yaml? And the above snippet with the correct name?

iiamloz•9mo ago

it can be whatever you want to call it as long as its a yaml file for local files we dont validate the names in anything, so as long as its unique and doesnt clash with any other stuff then your good

b_d0nOP•9mo ago

What how does the scenario know to target host 62 then? Sorry just trying to pick your brain and learn I’m an idiot I have to add the stash host.. which would be ip:port or would I put the domain? Where it says “your stash host here” in the snippet

iiamloz•9mo ago

yeah that how it knows to only target that fqdn

b_d0nOP•9mo ago

I don’t see a 401 or 403 in the nginx access log for that application

iiamloz•9mo ago

it should be in the error log though?

b_d0nOP•9mo ago

I see a a few 404 errors from 1/29 but I don’t see anything from the manual failed attempts today? 404 auth request unexpected status So I’m still trying to figure this out the error log for this host shows no auth errors also the error log isn’t listed under cscli metrics show acquisitions

b_d0nOP•9mo ago

Does this mean I’m SOL for now?

iiamloz•9mo ago

this means you can still detect "bruteforce" but you cant detect if it was a failed login or someone just refreshing the login page multiple times very odd that they choose 200 status code for a failed login, maybe they should use a different code 😄

CrowdSec•9mo ago

Resolving Tracking nginx host not being banned This has now been resolved. If you think this is a mistake please run /unresolve

b_d0nOP•9mo ago

Would I need too use code 200? Isn’t code 200 used for successful connections?

iiamloz•9mo ago

Yes exactly, thats why I said you can detect a "bruteforce" but not a failed authentication as they should be returning a 401 code

b_d0nOP•9mo ago

Yeah that’s definitely not good security practice. Thanks again for the help.

Gaming

Programming

Tracking nginx host not being banned

Did you find this page helpful?