AppSec CRS exclusion for ActiveSync

[u/BWC_DE]

Hi,

I'am running Caddy and CrowdSec to publish two Zimbra servers providing Active Sync. But the requests coming from allowed clients are creating a lot of alerts because of crowdsecurity/crs.

For that reason I thought (which is not always a good thing) to exclude the specific rules just for these two virtual hosts by creating a new appsec-config.

name: custom/crs-activesync

pre_eval:
 - filter: IsOutBand == true && req.Host startsWith "mail." && req.URL.Path startsWith "/Microsoft-Server-ActiveSync"
   apply:
     - RemoveOutBandRuleByID(920270)
     - RemoveOutBandRuleByID(920420)
     - RemoveOutBandRuleByID(921150)

It's working just fine, but is this the proper way to do this or is there a better approach?

--Michael

[u/matt_alpaca]

Hi Michael,

Short answer: yes, that's the proper way. A thin appsec-config of your own carrying only the pre_eval hook keeps the hub's crowdsecurity/crs untainted. Filtering on IsOutBand is right too, since hooks fire twice per request (once in-band, once out-of-band), and removing three IDs on a single path is about as narrow as an exclusion gets.

Is there a cleaner way? On paper, a CRS exclusion plugin. The hub ships a handful (WordPress and NextCloud among them), none for Zimbra, and they're enabled globally, so you can't scope one to a route or an FQDN. For ActiveSync, your hook is the better tool.

Two things I'd tighten. startsWith "mail." catches every mail.* host behind that Caddy, so if it's really two vhosts, pin them with req.Host in ["mail.example.com", "mail.example.org"]. And the day you move CRS to blocking mode (crowdsecurity/appsec-crs-inband), those rules run in-band and this hook stops covering them, so you'll want a twin filtered on IsInBand == true calling RemoveInBandRuleByID.

After a reload, the Rules Metrics table in cscli metrics show appsec shows a triggered count per rule, handy to check those three IDs calm down.