Bot detection arrives in CrowdSec 1.8.0, along with two DoS fixes
Failed SSH logins pile up in an auth log, and a scanner walks a website looking for exposed admin paths. CrowdSec reads log sources and HTTP requests, works out which addresses are misbehaving, and hands the block to a separate remediation component sitting in front of the service. Users report what they see back to the project, which curates it into a community blocklist every installation can pull down. Version 1.8.0 landed on August 31.
The big change is bot detection in the CrowdSec WAF, the half of the engine that inspects HTTP. Turn it on and clients get a challenge and fingerprinting page before they reach the site. CrowdSec grades the challenge, checks the fingerprint against rules you configure, and decides whether the client looks legitimate.
Some real visitors will not get through
The challenge requires SSE4.1 and writable-executable memory, so older or hardened clients cannot solve it. A visitor with cookies disabled now gets an explicit error message, which at least tells them what went wrong. Test the feature against your actual audience before switching it on everywhere, because the page sits in front of everyone, not just the bots.
Two ways to crash the log intake, now closed
This release also fixes two denial of service vulnerabilities in the HTTP and k8s-audit datasources, the parts that take logs in. The HTTP acquisition datasource had no cap on decompressed body size and trusted the sender’s Content-Length. The Kubernetes audit webhook read request bodies without bound. Both sit at the intake end, which means the component watching for attacks was itself something worth attacking. If you feed CrowdSec over HTTP or from a k8s audit webhook, this is the part of the release that applies to you whether or not you care about bots.
A dedicated Kubernetes datasource now pulls logs straight from the apiserver, removing a collection step for cluster operators. New HTTP helpers in the expression language let parsers and scenarios query external services while a decision is being made. The decisions stream endpoint in the local API got performance work, which matters most to anyone running many remediation components against one API.
Bot detection stays off until you enable it. The two datasource fixes apply either way, and that is the stronger argument for taking this release.
CrowdSec is available for free on GitHub.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
