aykhans/my-self-host-services
1
0 Fork 0
mirror of https://github.com/aykhans/my-self-host-services.git synced 2026-10-17 12:33:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crowdsec: whitelist first-party client false positives (Matrix media/rooms, DAV auth)

Browse Source
This commit is contained in:
aykhans committed 2026-08-05 08:10:02 +00:00
1 parent e577bf7304
commit 175e3b4416
3 files changed
+13 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

crowdsec/docker-compose.yaml
+1
View File
@@ -42,6 +42,7 @@ services:
- ./parsers/s01-parse/stalwart-logs-extended.yaml:/etc/crowdsec/parsers/s01-parse/stalwart-logs-extended.yaml:ro - ./parsers/s01-parse/stalwart-logs-extended.yaml:/etc/crowdsec/parsers/s01-parse/stalwart-logs-extended.yaml:ro
- ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro - ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro
- ./parsers/s02-enrich/whitelist-matrix-client-probes.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml:ro - ./parsers/s02-enrich/whitelist-matrix-client-probes.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml:ro
- ./parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:ro
- ./scenarios/stalwart-smtp-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-smtp-bruteforce.yaml:ro - ./scenarios/stalwart-smtp-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-smtp-bruteforce.yaml:ro
- ./scenarios/stalwart-auth-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-auth-bruteforce.yaml:ro - ./scenarios/stalwart-auth-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-auth-bruteforce.yaml:ro
- ./scenarios/http-admin-interface-probing.yaml:/etc/crowdsec/scenarios/http-admin-interface-probing.yaml:ro - ./scenarios/http-admin-interface-probing.yaml:/etc/crowdsec/scenarios/http-admin-interface-probing.yaml:ro
crowdsec/parsers/s02-enrich/whitelist-dav-auth-challenge.yaml
+6
View File
@@ -0,0 +1,6 @@
name: aykhans/whitelist-dav-auth-challenge
description: "Prevent http-generic-bf false positives from DAV clients' auth-challenge 401s"
whitelist:
reason: "CalDAV/CardDAV/WebDAV clients (Thunderbird etc.) send an unauthenticated PROPFIND and get 401 by design; real DAV auth brute-force is still covered by the Stalwart auth-bruteforce scenario reading Stalwart's own logs"
expression:
- evt.Meta.service == 'http' and evt.Meta.http_status == '401' and evt.Meta.http_path startsWith '/dav/'
crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml
+6 -3
View File
@@ -1,8 +1,11 @@
name: aykhans/whitelist-matrix-client-probes name: aykhans/whitelist-matrix-client-probes
description: "Prevent http-probing false positives from Matrix client feature-detection 404s" description: "Prevent http-probing / http-crawl false positives from normal Matrix client traffic"
whitelist: whitelist:
reason: "Matrix client MSC feature-detection and media preview requests return 404 by design (benign)" reason: "Matrix client feature-detection, media loading and room lookups are benign client behavior"
expression: expression:
# Feature-detection endpoints (unstable MSCs) return 404 by design
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/unstable/org.matrix.msc' - evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/unstable/org.matrix.msc'
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/v1/media/preview_url' # Room event/relations/state lookups that 404 (event not found / federated backfill)
- evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/' and evt.Meta.http_path contains '/rooms/' - evt.Meta.service == 'http' and evt.Meta.http_status == '404' and evt.Meta.http_path startsWith '/_matrix/client/' and evt.Meta.http_path contains '/rooms/'
# Media thumbnails/downloads/preview: high-cardinality GET bursts (any status) trip http-crawl
- evt.Meta.service == 'http' and evt.Meta.http_path startsWith '/_matrix/client/' and evt.Meta.http_path contains '/media/'