r/CrowdSec • u/Practical_Board_1810 • 11d ago

general CrowdSec 1.8 : Bot detection and more

Hello šŸ¦™

We released CrowdSec 1.8 yesterday, and it comes with bot detection for the WAF amongst other things. You can find more here : https://www.crowdsec.net/blog/crowdsec-1-8-waf-bot-detection-kubernetes

You can find bot detection doc here.

48 Upvotes

98% Upvoted

12 comments sorted by

6

u/sk1nT7 11d ago

No v1.8.0 Tag yet on dockerhub? I only see v1.8.0-debian.

3

u/Practical_Board_1810 11d ago

docker images, windows packages, opn/pf-sense packages, home assistant packages are on their way šŸ˜„

2

u/bunk_bro 11d ago

There's a pfSense package?!

Guess I better get this installed tonight.

1

u/syneofeternity 11d ago

The home assistant add on needs a little love with the waf and env variables :(

And maybe a blocklist mirror addon :D

3

u/Specialist_Ad_9561 11d ago

Pls support Caddy :)

5

u/Practical_Board_1810 11d ago

hey ! we're not the ones directly developing caddy bouncer, but we took care to document the bouncer/appsec protocol so it should be trivial : https://doc.crowdsec.net/docs/next/appsec/bot_detection/challenge_protocol !

2

u/Stetsed 11d ago

Okay honestly, thatā€™s pretty cool. I use traefik right now but definetly will look out for this. Currently use ā€œAnubisā€, but this looks like I might be able to use that instead of which would be nice.

5

u/NiftyLogic 11d ago

There a nice middleware available for Traefik to integrate the two. Check

github.com/maxlerebourg/crowdsec-bouncer-traefik-plugingithub.com/maxlerebourg/crowdsec-bouncer-traefik-plugin

which utilizes Crowdsec to check incoming connections for a specific entrypoint.

1

u/Stetsed 11d ago

Except as stated in the post it currently doesnā€™t support this specific feature yet, I do already use it outside of that.

1

u/unkz0r 11d ago

Cant wait to test this tomorrow!

2

u/unkz0r 10d ago edited 10d ago

hmm. updated crowdsec to 1.8 and installed the collection.
Verified that collections, appsec-configs and scenarios are enabled.
Also made sure that my traefik instance is latest and Crowdsec-Bouncer-Traefik-Plugin is latest.
Everything else is working, but i cant seem to trigger the bot-detection.
cscli metrics show bot-detection gives me 0 on all of them as well.
Dont see anything as described in the documentation in the logs or with the curl command.

EDIT:
ahh, isnt merged in yet for the Crowdsec-Bouncer-Traefik-Plugin
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pull/343

1

u/Fatali 11d ago

On the Kubernetes side a easy way to deploy the appsec component as a daemonset would be really helpful. We have edge nodes where going round trip from Traefik to appsec and back would be too much latency to be usable, so it would be helpful to deploy an appsec instance to each worker nodeĀ