search

crowdsecurity / hub

Main repository for crowdsec scenarios/parsers
https://hub.crowdsec.net
157 stars 150 forks source link

false positive LePresidente/http-generic-403-bf with sogo (Webmailer) #686

Open JonnyFPV opened 1 year ago

JonnyFPV commented 1 year ago

Is it possible to whitelist this service or do I need to configure something?

Because if I try to login to soho I get banned.

Regards Jan

`################################################################################################

LaurenceJJones commented 1 year ago

What is soho? we dont officially have a collection to support mailcow (even thought it just a frontend to postfix + dovecot) so if we wanted too we could create a whitelist to ignore 403 response from /SOGo/so/passwordRecoveryEnabled endpoint.

JonnyFPV commented 1 year ago

I mean Sogo yes. So, how can I configure it, to prevent bans on logins to sogo?

Or how can I support you for supporting mailcow/Sogo?

LaurenceJJones commented 1 year ago

Well with the limited information you provided I can write an generic whitelist. Since its a FP on nginx side so there no need to parse mailcow logs.

JonnyFPV commented 1 year ago

That would be great if you write some whitelisting. Regards 👍

JonnyFPV commented 1 year ago

any progress? :-)

LaurenceJJones commented 1 year ago

Here a WIP version

name: crowdsecurity/mailcow-sogo-whitelist
description: "Whitelist events from mailcow-sogo"
filter: "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']"
whitelist:
  reason: "Mailcow-SOGo Whitelist"
  expression:
   - evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Meta.http_path == '/SOGo/so/passwordRecoveryEnabled'

However, I dont know how the application works so you could be whitelisting events from an endpoint you want to protect.

JonnyFPV commented 1 year ago

ok, thank you, the login is working fine now. But did this whitelisting now disable any Protection for this service?