diff --git a/.traefik.yml b/.traefik.yml index 527bb1b..5f29052 100644 --- a/.traefik.yml +++ b/.traefik.yml @@ -7,8 +7,7 @@ import: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin summary: 'Crowdsec Bouncer Traefik Plugin' testData: - crowdsec: - bouncer: - enabled: true - crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5 + bouncer: + enabled: true + crowdsecLapiKey: 40796d93c2958f9e58345514e67740e5 diff --git a/README.md b/README.md index e332f04..b43c078 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,28 @@ This plugins aims to implement a Crowdsec Bouncer into a traefik plugin. > [CrowdSec](https://www.crowdsec.net/) is an open-source and collaborative IPS (Intrusion Prevention System) and a security suite. > We leverage local behavior analysis and crowd power to build the largest CTI network in the world. +The purpose is to enable treafik to authorize and block requests from IP based and their reputation and behavior. + +The crowdsec utility will provide the community blocklist which contains highly reported and validated IP banned from the crowdsec network. + +When used with crowdsec it will leverage the local API which will analyze traefik logs and take decisions on the requests made by users/bots. Malicious actors will be banned based on patterns against your website. + +There is 3 operating mode for this plugin: +- none -> If the client IP is on ban list, it will get a http code 403 response. + Otherwise, request will continue as usual. All request call the Crowdsec LAPI + +- live -> If the client IP is on ban list, it will get a http code 403 response. + Otherwise, request will continue as usual. + The bouncer can leverage use of a local cache in order to reduce the number + of requests made to the Crowdsec LAPI. It will keep in cache the status for + each IP that makes queries. + +- stream -> Stream Streaming mode allows you to keep in the local cache only the Banned IPs, + every requests that does not hit the cache is authorized. + Every minute, the cache is updated with news from the Crowdsec LAPI. + +The recommanded mode for performance is the streaming mode, decisions are updated every 60 sec by default and that's the only communication between traefik and crowdsec. Every requests that happens hits the cache for quick decisions. + ## Usage @@ -50,6 +72,11 @@ http: bouncer: enabled: true crowdseclapikey: 40796d93c2958f9e58345514e67740e5 + updateIntervalSeconds: 60 + defaultDecisionSeconds: 60 + crowdsecLapiHost: + crowdsecLapiScheme: + crowdsecMode: stream ``` ### Local Mode @@ -76,12 +103,46 @@ The source code of the plugin should be organized as follows: └── vendor/* ``` -For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. +For local developpement a docker-compose-local.yml is provided and reproduce the directory layout needed by traefik. This works once you have generated and filled your LAPI-KEY, if not look below for informations ```bash docker-compose -f docker-compose-local.yml up -d ``` +#### Generate LAPI-KEY +You need to generate a crowdsec API key for the LAPI. +You can follow the documentation here: https://docs.crowdsec.net/docs/user_guides/lapi_mgmt/ + +```bash +docker-compose -f docker-compose-local.yml up -d crowdsec +docker exec crowdsec cscli bouncers add crowdsecBouncer +``` + +This LApi key must be set where is noted FIXME-LAPI-KEY in the docker-compose-test.yml +```yaml +... +whoami: + labels: + - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY" +... +crowdsec: + environment: + BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY +... +``` + +You can then run all the containers: +```bash +docker-compose -f docker-compose-local.yml up -d +``` + +#### Add manually an IP to the blocklist + +```bash +docker-compose -f docker-compose-local.yml up -d crowdsec +docker exec crowdsec cscli decisions add --ip 10.0.0.10 +``` + ### About [maxlerebourg](https://github.com/maxlerebourg) and [I](https://github.com/mhanotaux) have been using traefik since 2020. diff --git a/bouncer.go b/bouncer.go index 144eff1..60e77fc 100644 --- a/bouncer.go +++ b/bouncer.go @@ -39,7 +39,7 @@ type Config struct { func CreateConfig() *Config { return &Config{ Enabled: false, - CrowdsecMode: "none", + CrowdsecMode: "stream", CrowdsecLapiScheme: "http", CrowdsecLapiHost: "crowdsec:8080", CrowdsecLapiKey: "", diff --git a/docker-compose-local.yml b/docker-compose-local.yml index a5c2a9f..7ed880c 100644 --- a/docker-compose-local.yml +++ b/docker-compose-local.yml @@ -30,7 +30,7 @@ services: - "traefik.http.routers.whoami.entrypoints=web" - "traefik.http.routers.whoami.middlewares=crowdsec@docker" - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true" - - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 @@ -39,7 +39,7 @@ services: environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec - BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5 + BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY depends_on: - 'traefik' volumes: @@ -47,8 +47,6 @@ services: - logs:/var/log/traefik:ro - crowdsec-db:/var/lib/crowdsec/data/ - crowdsec-config:/etc/crowdsec/ - ports: - - "8083:8080" volumes: logs: diff --git a/docker-compose.yml b/docker-compose.yml index 39aa3d5..919f567 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -29,7 +29,7 @@ services: - "traefik.http.routers.whoami.entrypoints=web" - "traefik.http.routers.whoami.middlewares=crowdsec@docker" - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true" - - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=40796d93c2958f9e58345514e67740e5" + - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapikey=FIXME-LAPI-KEY" crowdsec: image: crowdsecurity/crowdsec:v1.4.1 @@ -38,7 +38,7 @@ services: environment: COLLECTIONS: crowdsecurity/traefik CUSTOM_HOSTNAME: crowdsec - BOUNCER_KEY_TRAEFIK: 40796d93c2958f9e58345514e67740e5 + BOUNCER_KEY_TRAEFIK: FIXME-LAPI-KEY depends_on: - 'traefik' volumes: @@ -46,8 +46,6 @@ services: - logs:/var/log/traefik:ro - crowdsec-db:/var/lib/crowdsec/data/ - crowdsec-config:/etc/crowdsec/ - ports: - - "8083:8080" volumes: logs: