parker/cumulus
Watch
1
0
Fork
You've already forked cumulus
 0
Code Pull requests Activity Actions

Disable CrowdSec http-probing on the edge #54

Merged
parkerhdavis merged 1 commit from disable-http-probing into main 2026-10-14 15:51:37 -06:00
Conversation 0 Commits 1 Files changed 2 +21 -51
parkerhdavis commented 2026-10-14 15:51:31 -06:00 (Migrated from github.com)
Copy link

Summary

  • Disable crowdsecurity/http-probing by adding it to the compose's DISABLE_SCENARIOS, alongside the already-disabled http-generic-bf.
  • The scenario infers attack purely from 403/404 volume against a single IP, which structurally misfires on this edge: browsers, the fleet agents, and every CLI an agent session runs all egress one home IP. fj's PR-template sweep (~21 legitimate 404s per PR command, covering .forgejo/, .gitea/, .github/ and docs/ variants) overflowed the scenario's default bucket twice on 2026-10-14 — each ban denied the dashboard, every Pangolin resource, and the fleet's tunnel agents at once. Raising the capacity is whack-a-mole while sweeps grow (the morning's 20-capacity mount is removed as moot).
  • What remains armed: the targeted probing scenarios (admin-interface, CVE, sqli, traversal, w00tw00t) and AppSec virtual patching, which caught real scanners (thinkphp CVE, admin probing) today on their own.

Deployment

Live already applied post-merge via make sync && make up droplet on the Droplet; the Agents Hub § Security Baseline documents the standing rule (false positives get tuned/disabled in the compose, never whitelisted).

## Summary - Disable `crowdsecurity/http-probing` by adding it to the compose's `DISABLE_SCENARIOS`, alongside the already-disabled `http-generic-bf`. - The scenario infers attack purely from 403/404 volume against a single IP, which structurally misfires on this edge: browsers, the fleet agents, and every CLI an agent session runs all egress one home IP. `fj`'s PR-template sweep (~21 legitimate 404s per PR command, covering .forgejo/, .gitea/, .github/ and docs/ variants) overflowed the scenario's default bucket twice on 2026-10-14 — each ban denied the dashboard, every Pangolin resource, and the fleet's tunnel agents at once. Raising the capacity is whack-a-mole while sweeps grow (the morning's 20-capacity mount is removed as moot). - What remains armed: the targeted probing scenarios (admin-interface, CVE, sqli, traversal, w00tw00t) and AppSec virtual patching, which caught real scanners (thinkphp CVE, admin probing) today on their own. ## Deployment Live already applied post-merge via `make sync && make up droplet` on the Droplet; the Agents Hub § Security Baseline documents the standing rule (false positives get tuned/disabled in the compose, never whitelisted).
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
parker/cumulus!54
No description provided.