mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-06 12:55:03 -05:00
[GH-ISSUE #770] Crowdsec Defaults to Captcha without Captcha set up and bypasses checks #1620
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#1620
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mellow65 on GitHub (May 22, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/770
I'm exploring an unknown world when it comes to Crowdsec, but have been stumbling through it, so bare with me.
After having Pangolin up for a few weeks, I opted to add Crowdsec and start the journey of getting that working. If nothing else it was an eye opening experience of the constant probing of things from the internet.
What I found not 5 mins after setting it up is I already had a couple IPs poking at my services. Crowdsec saw them, which was great, but they were flagged as Captcha, not ban. I get in a production kind of world captcha is probably safer, but in my case where I'm just trying to expose a couple small services to essentially myself, I would rather things default to ban, and then I can fix it after the fact.
The problem is I hadn't set up a captcha yet, yet they were still being flagged as captcha.
After much playing around and manually adding my phones IP address flagged as captcha, I found that if an IP gets flagged as captcha and you don't have a captcha set up, that IP is freely able to get to your domain.
I believe at least in my case I've sorted everything to be flagged as ban if crowdsec decides the IP is no good, and I did that by commenting out the captcha section of the profile.yaml file.
But as I feel Pangonlin has the chance to have a decent following with homelabbers, I would like to see ban be the default decision when it came to what happens when a crowdsec decides an IP is no good.
@TuncTaylan commented on GitHub (May 22, 2025):
Based on my experience, and I just tested this to be sure :) when CAPTCHA is not configured (which is the default with the Pangolin installer), IP addresses that get flagged for CAPTCHA are banned for four hours. The decision type is listed simply as "captcha," and those IPs receive an HTTP ERROR 403.
If an IP address is flagged and banned (decision type "ban"), it just results in a timeout (ERR_TIME_OUT).
For fun, I also tested this with my iPhone (using iCloud Private Relay, which uses Cloudflare IPs in my country). The IP was banned and flagged as "captcha," but I was still able to access the site.
So my question is: how did you test it? Are there any proxy / VPN involved?
@mellow65 commented on GitHub (May 22, 2025):
Well what the crap, I have no idea what the heck happened now, because now it's following you're saying. I would have put money on what I was saying!! Because that's what triggered me to go down the rabbit hole to figure out how to not flag things as captcha.
But yeah, now my phones IP flagged as captcha are hitting the HTTP ERROR 403 page. I've even made sure I went back in the profile.yaml and uncommented the captcha section. I even went to the point of adding a captcha just to make sure that was all working, which it does.
So disregard the concern. I'm still leaving my profile as ban first, as I've made it up in my head that it fits my needs better (as I'm essentially the only one that uses the services).
I do appreciate the sanity check. 😊
@TuncTaylan commented on GitHub (May 22, 2025):
There are some delay between parsing and decision taking by bouncers. :)
@mellow65 commented on GitHub (May 22, 2025):
Oh man, I think i figured it out, because it just happened to me again!!! I think my IP rolled in the middle of testing! Because that just happened to me!! 🤣
@TuncTaylan commented on GitHub (May 23, 2025):
Yes, that's also what was happening to my iPhone with private relay. Better safe than sorry 👍