aykhans/my-self-host-services
1
0
Fork 0
mirror of https://github.com/aykhans/my-self-host-services.git synced 2026-08-28 01:44:33 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crowdsec: whitelist all git registry /v2/ traffic (blob 404s + auth 401s)

Browse Source
This commit is contained in:
aykhans
2026-08-15 13:56:58 +00:00
parent 61d27a6340
commit 6adca4400f
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crowdsec/docker-compose.yaml
+1
View File
@@ -43,6 +43,7 @@ services:
- ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro
- ./parsers/s02-enrich/whitelist-matrix-client-probes.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml:ro
- ./parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:ro
- ./parsers/s02-enrich/whitelist-registry-auth-challenge.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml:ro
- ./scenarios/stalwart-smtp-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-smtp-bruteforce.yaml:ro
- ./scenarios/stalwart-auth-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-auth-bruteforce.yaml:ro
- ./scenarios/http-admin-interface-probing.yaml:/etc/crowdsec/scenarios/http-admin-interface-probing.yaml:ro
crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml
+6
View File
@@ -0,0 +1,6 @@
name: aykhans/whitelist-registry
description: "Prevent http-probing / http-generic-401-bf false positives from Docker/OCI registry traffic"
whitelist:
reason: "Docker/OCI registry v2 protocol is probe-like by design: unauthenticated /v2/ requests get 401 auth challenges and blob-existence checks get 404 before upload; real registry abuse is handled by Gitea's own auth"
expression:
- evt.Meta.service == 'http' and evt.Meta.target_fqdn == 'git.aykhans.me' and evt.Meta.http_path startsWith '/v2/'