Files
my-self-host-services/crowdsec/parsers/s02-enrich/whitelist-registry-auth-challenge.yaml
T

7 lines
507 B
YAML

name: aykhans/whitelist-registry
description: "Prevent http-probing / http-generic-401-bf false positives from Docker/OCI registry traffic"
whitelist:
reason: "Docker/OCI registry v2 protocol is probe-like by design: unauthenticated /v2/ requests get 401 auth challenges and blob-existence checks get 404 before upload; real registry abuse is handled by Gitea's own auth"
expression:
- evt.Meta.service == 'http' and evt.Meta.target_fqdn == 'git.aykhans.me' and evt.Meta.http_path startsWith '/v2/'