From 6adca4400f31e4f29ec07ac7ff6672af23a54f14 Mon Sep 17 00:00:00 2001 From: Aykhan Shahsuvarov Date: Sat, 15 Aug 2026 13:56:58 +0000 Subject: [PATCH] crowdsec: whitelist all git registry /v2/ traffic (blob 404s + auth 401s) --- crowdsec/docker-compose.yaml | 1 + .../s02-enrich/whitelist-registry-auth-challenge.yaml | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml diff --git a/crowdsec/docker-compose.yaml b/crowdsec/docker-compose.yaml index 79b752f..d30450b 100644 --- a/crowdsec/docker-compose.yaml +++ b/crowdsec/docker-compose.yaml @@ -43,6 +43,7 @@ services: - ./parsers/s02-enrich/whitelist-trusted.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-trusted.yaml:ro - ./parsers/s02-enrich/whitelist-matrix-client-probes.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-matrix-client-probes.yaml:ro - ./parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-dav-auth-challenge.yaml:ro + - ./parsers/s02-enrich/whitelist-registry-auth-challenge.yaml:/etc/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml:ro - ./scenarios/stalwart-smtp-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-smtp-bruteforce.yaml:ro - ./scenarios/stalwart-auth-bruteforce.yaml:/etc/crowdsec/scenarios/stalwart-auth-bruteforce.yaml:ro - ./scenarios/http-admin-interface-probing.yaml:/etc/crowdsec/scenarios/http-admin-interface-probing.yaml:ro diff --git a/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml b/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml new file mode 100644 index 0000000..96d1939 --- /dev/null +++ b/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml @@ -0,0 +1,6 @@ +name: aykhans/whitelist-registry +description: "Prevent http-probing / http-generic-401-bf false positives from Docker/OCI registry traffic" +whitelist: + reason: "Docker/OCI registry v2 protocol is probe-like by design: unauthenticated /v2/ requests get 401 auth challenges and blob-existence checks get 404 before upload; real registry abuse is handled by Gitea's own auth" + expression: + - evt.Meta.service == 'http' and evt.Meta.target_fqdn == 'git.aykhans.me' and evt.Meta.http_path startsWith '/v2/'