search

crowdsecurity / pfSense-pkg-crowdsec

58 stars 2 forks source link

Can't register my crowdsec on unraid to use LAPI on my pfSense #73

Closed europacafe closed 1 year ago

europacafe commented 1 year ago

I want my crowdsec on my unraid to use LAPI on my pfSense. I issued this command on crowdsec console (run as container on unraid): cscli lapi register -u 1xx.xx.xx.x where 1xx.xx.xx.x is my pfSense ip running crowdsec full stack As my pfSense always redirects to https:, registration can't pass through, and return this message: FATA[07-11-2023 14:23:11] api client register: api register (http://1xx.xx.xx.x/): Post "https://1xx.xx.xx.x.:10443/v1/watchers": tls: failed to verify certificate: x509: cannot validate certificate for 1xx.xx.xx.x because it doesn't contain any IP SANs

What should I do?

LaurenceJJones commented 1 year ago

As my pfSense always redirects to https:

So you have exposed and installed a certificate on the CrowdSec port? or using a reverse proxy?

Edit: I see the port within the error message not in your original command... okay have you installed the CA cert on the unraid system?

Edit Edit: I put 2 + 2 and made 5... so the error you are getting is because the certificate it is offering does not have any IP addresses or hostnames as the SANS field, this is automatically rejected as you dont know if the cert is a MITM attacked. The better question I should start with is how did you get this cert? is it self signed?

europacafe commented 1 year ago

It is the self-signed coming pre-installed with pfSense installation.

LaurenceJJones commented 1 year ago

It is the self-signed coming pre-installed with pfSense installation.

Then you will need to set the insecure_skip_verify: true within the configurations as it not signed with a hostname or CA

https://docs.crowdsec.net/docs/next/configuration/crowdsec_configuration#insecure_skip_verify

mmetc commented 1 year ago

TLS is something that should be configured by the plugin itself, but we didn't include it in the first version. The PHP file crowdsec.inc is hardcoding "http" in the configuration, for both lapi and bouncer, so you may want to change it.

europacafe commented 1 year ago

It is my bad. I have to specify the crowdsec LAPI port 8080 too, i.e, cscli lapi register -u 1xx.xx.xx.x:8080 Thank you