Closed Morriz closed 6 months ago
@Morriz: Thanks for opening an issue, it is currently awaiting triage.
In the meantime, you can:
other requests get handled just fine
What happened?
I receive github webhooks, but those get a 403 from crowdsec, even after removing the db and starting fresh without any blocklists.
What did you expect to happen?
No 403?
How can we reproduce it (as minimally and precisely as possible)?
add a github web hook to a project and trigger delivery
Anything else we need to know?
No response
Crowdsec version
OS version
Enabled collections and parsers
Acquisition config
--- filenames: - /var/log/auth.log - /var/log/syslog labels: type: syslog --- filenames: - /var/log/traefik/access.log labels: type: traefik
Config show
Prometheus metrics
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.
Well there must of been a decision against the IP address, and even after clearing things there might be a time lapse between when your remediation component fetches the deleted IP addresses. You should consult your bouncer documentation to ensure which mode you are running in if its not LIVE
which is the common naming scheme then this would be intended behaviour until it repulls. (Also there might be a intended bug/issue instead of deleting it via cscli decsions delete
and deleting the database its impossible for crowdsec to know what state the bouncer is currently in, so it would of been more appropriate to delete the decisions or all via cscli decisions delete --all
)
We had it in the past when a user wanted to do this, the issue we have is github uses azure serverless infra and in doing so can be mixed in with others that use azure serverless for malicious behaviors. the user in the end, use a VPN from github action to their infrastructure which is recommended way around this issue as clearly the ip address is malicious but for the seconds you have it contacting your infra it is not, unless you want to whitelist the whole of azure ASN's
What happened?
I receive github webhooks, but those get a 403 from crowdsec, even after removing the db and starting fresh without any blocklists.
What did you expect to happen?
No 403?
How can we reproduce it (as minimally and precisely as possible)?
add a github web hook to a project and trigger delivery
Anything else we need to know?
No response
Crowdsec version
OS version
Enabled collections and parsers
Acquisition config
Config show
Prometheus metrics
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.