crowdsec collection for opencloud

[cscholz]

Is there anyone already working on a crowdsec collection for opencloud?

[micbar]

Please explain what crowdsec is and what problem does it solve for openCloud.

[cscholz]

CrowdSec is an open-source intrusion prevention system (IPS) that detects suspicious activities in log files and blocks them automatically. It is based on community intelligence: users share information about attackers to protect each other. CrowdSec analyses logs, recognizes patterns such as brute force attacks or port scans and blocks the corresponding IPs. The collected data is processed in a central database and made available as curated blocklists. These lists can be used in firewalls, web servers or applications to prevent attacks at an early stage.

CrowdSec is free, modular and supports many platforms such as Linux, Windows, Docker and Kubernetes. It is suitable for both small servers and large cloud infrastructures.

It can be used to reduce the attack surface of Opencloud if suspicious activity is detected via log patterns

[tackin]

It's available as a container as middlware to traefik.

[micbar]

This is awesome! How can we contribute to that idea?

[scetu]

I believe that this conversation is to prevent false positive bans which can ocur by Crowdsec (looking at you http-crawl-non_statics scenario), for example by listing big directories in WebUI, Crowdsec can detect this (numerous HTTP requests within short timeframe) as attack scenario and whitelist needs to be applied.

For example when streaming Plex video with Crowdsec in place, you need to apply plex-allowlist otherwise your Plex client accessing Plex server will get banned by Crowdsec due to triggering http-crawl-non_statics after some time when playing video.

I have just yesterday deployed my instance of Opencloud and had no time to explore it yet (I am currently working to integrate with my Authelia for OIDC), but I am running it via proxy which is having Crowdsec in place and it monitors all trafic via the proxy, thus I will let you know If I will need to whitelist anything.

[scetu]

Hey, this is my first draft of whitelist what I currently have in place.

/etc/crowdsec/parsers/s02-enrich/05-Opencloud-whitelist.yaml

name: custom-whitelist/Opencloud-whitelist
description: "Whitelist events related to Opencloud server"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"
whitelist:
 reason: "Opencloud Whitelist"
 expression:
    - evt.Meta.http_path contains '/remote.php/dav/spaces'

I have whitelisted whole /remote.php/dav/spaces cause Opencloud is returning multiple "error" codes (405, 401, etc.) and this got me banned.

[micbar]

That looks like your OpenIDConnect setup is wrong. The web client does token refresh requests during the upload workflow. Please check if you are allowing your IdP to be connect-src in the CSP.yaml file.

[R-Nabil]

Hey,

Were you able to move forward with this ? I have indeed experiences many ban from crowdsec, which I thought was due to a bad install but seems to be due to many 40x errors thrown out.

I'll be using your draft for now ! Thanks

[chiragkrishna]

@micbar hey even i am facing the same issue. uploading multiple files ask for basic auth. here is my csp.yaml

directives:
  child-src:
    - "'self'"
  connect-src:
    - "'self'"
    - "blob:"
    - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
    - "https://redacted-authentik/"
  default-src:
    - "'none'"
  font-src:
    - "'self'"
  frame-ancestors:
    - "'self'"
  frame-src:
    - "'self'"
    - "blob:"
    - "https://embed.diagrams.net/"
    - "https://redacted-collabora/"
    - "https://docs.opencloud.eu"
  img-src:
    - "'self'"
    - "data:"
    - "blob:"
    - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
    - "https://redacted-collabora/"
  manifest-src:
    - "'self'"
  media-src:
    - "'self'"
  object-src:
    - "'self'"
    - "blob:"
  script-src:
    - "'self'"
    - "'unsafe-inline'"
    - "https://redacted-authentik/"
  style-src:
    - "'self'"
    - "'unsafe-inline'"

[micbar]

Looks fine from a quick read. Can you check your browser console and network tab for errors?

[chiragkrishna]

thanks, i checked the errors in browser console.
these are the errors

1) Refused to frame "https://redacted-authentik/" because it violates the following Content Security Policy directive:
"frame-src 'self' blob: https://embed.diagrams.net/ https://redacted-collabora/ https://docs.opencloud.eu".

2) https://unpkg.com/echarts@6.0.0/dist/echarts.min.js blocked script-src-elem

3) CSP blocks the use of 'eval' in JavaScript

is this the correct way to solve the problem?
my new csp.yaml

directives:
  child-src:
    - "'self'"
  connect-src:
    - "'self'"
    - "blob:"
    - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
    - "https://redacted-authentik/"
  default-src:
    - "'none'"
  font-src:
    - "'self'"
  frame-ancestors:
    - "'self'"
  frame-src:
    - "'self'"
    - "blob:"
    - "https://embed.diagrams.net/"
    - "https://redacted-collabora/"
    - "https://docs.opencloud.eu"
    - "https://redacted-authentik/"      <----- Added
  img-src:
    - "'self'"
    - "data:"
    - "blob:"
    - "https://raw.githubusercontent.com/opencloud-eu/awesome-apps/"
    - "https://redacted-collabora/"
  manifest-src:
    - "'self'"
  media-src:
    - "'self'"
  object-src:
    - "'self'"
    - "blob:"
  script-src:
    - "'self'"
    - "https://unpkg.com"      <----- Added
    - "'unsafe-eval'"      <----- Added
    - "'unsafe-inline'"
    - "https://redacted-authentik/"
  style-src:
    - "'self'"
    - "'unsafe-inline'"

[mrarzt]

Sounds really good about crowdsec. Would love if this can be added to the OpenCloud as a option just to enable it in the config file and make maybe some changes ;-)

[Mayurifag]

For now crowdsec is hell when its oversights opencloud, I am having a LOT of 403 positives and if I have .git folders in my spaces for whatever reasons (I do!), those are also getting false positives.

I hope the collection for opencloud will be done one day!

I also lurking for ultimate whitelist rule at least. I ignore everything contains '/dav/spaces/', but thats not making its job 100% yet very permissive, so I won't share code snippet here.

Thanks in advance, community!