Skip to content

Commit f4d53a1

Browse files
buixorbuixor
authored
Merge pull request #683 from crowdsecurity/apache_bouncer
Apache bouncer
2 parents ac28cf4 + b963795 commit f4d53a1

File tree

2 files changed

+199
-0
lines changed

2 files changed

+199
-0
lines changed

‎crowdsec-docs/sidebarsUnversioned.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,11 @@ module.exports = {
234234
label: "AWS WAF",
235235
id: "bouncers/aws_waf",
236236
},
237+
{
238+
type: "doc",
239+
label: "Apache",
240+
id: "bouncers/apache_bouncer",
241+
},
237242
{
238243
type: "doc",
239244
label: "BlockList Mirror",

‎crowdsec-docs/unversioned/bouncers/apache.mdx‎

Lines changed: 194 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,194 @@
1+
---
2+
id: apache_bouncer
3+
title: Apache Bouncer
4+
sidebar_position: 2
5+
---
6+
7+
import Tabs from "@theme/Tabs";
8+
import TabItem from "@theme/TabItem";
9+
import useBaseUrl from "@docusaurus/useBaseUrl";
10+
11+
<p align="center">
12+
<img
13+
src={useBaseUrl("/img/crowdsec_nginx.svg")}
14+
alt="CrowdSec"
15+
title="CrowdSec"
16+
width="400"
17+
height="300"
18+
/>
19+
</p>
20+
<p align="center">
21+
<img src="https://img.shields.io/badge/build-pass-green" />
22+
<img src="https://img.shields.io/badge/tests-pass-green" />
23+
</p>
24+
<p align="center">
25+
&#x1F4DA; <a href="#installation/">Documentation</a>
26+
&#x1F4A0; <a href="https://hub.crowdsec.net">Hub</a>
27+
&#128172; <a href="https://discourse.crowdsec.net">Discourse </a>
28+
</p>
29+
30+
A Remediation Component for Apache.
31+
32+
:::warning
33+
34+
Beta Remediation Component, please report any issues on [GitHub](https://github.com/crowdsecurity/cs-apache2-bouncer/issues)
35+
36+
:::
37+
38+
## How does it work ?
39+
40+
This component leverages Apache's module mecanism to provide IP address blocking capability.
41+
42+
The module supports **Live mode** with a local (in-memory) cache.
43+
44+
At the back, this component uses `mod_proxy`, `mod_ssl` for requests to LAPI, and `mod_socache` for the caching feature.
45+
46+
## Installation
47+
48+
:::warning
49+
50+
There is not yet publicly available packages or this Remediation Component.
51+
52+
We are providing ways to build your own while we're working on packaging.
53+
54+
:::
55+
56+
Clone or download directly [from our GitHub repository](https://github.com/crowdsecurity/cs-apache2-bouncer).
57+
58+
59+
<Tabs
60+
defaultValue="nginx_debian"
61+
values={[
62+
{ label: 'Debian/Ubuntu', value: 'nginx_debian' ,},
63+
{ label: 'Others (build from source)', value: 'others' ,},
64+
]
65+
}>
66+
<TabItem value="nginx_debian">
67+
68+
```bash
69+
dpkg-buildpackage -us -uc
70+
sudo dpkg -i ../crowdsec-apache2-bouncer_1.0.0_amd64.deb
71+
```
72+
73+
</TabItem>
74+
75+
<TabItem value="others">
76+
77+
```bash
78+
aclocal
79+
autoconf
80+
autoheader
81+
automake --add-missing
82+
./configure
83+
make
84+
sudo make install
85+
sudo cp config/mod_crowdsec.* /etc/apache2/mods-available/
86+
sudo mkdir -p /etc/crowdsec/bouncers/
87+
sudo cp ./config/crowdsec-apache2-bouncer.conf /etc/crowdsec/bouncers/
88+
```
89+
90+
</TabItem>
91+
92+
</Tabs>
93+
94+
### Initial Configuration
95+
96+
Enable the mod_crowdsec module:
97+
98+
```bash
99+
sudo a2enmod mod_crowdsec
100+
```
101+
102+
Generate an API key for the bouncer [1]:
103+
104+
```bash
105+
sudo cscli bouncers add apache2
106+
```
107+
108+
Remediation Component config's is located in `/etc/crowdsec/bouncers/crowdsec-apache2-bouncer.conf`:
109+
110+
```bash
111+
## Replace the API key with the newly generated one [1]
112+
CrowdsecAPIKey this_is_a_bad_password
113+
...
114+
```
115+
116+
:::info
117+
If needed, edit `CrowdsecURL` (and other parameters)
118+
:::
119+
120+
```bash
121+
sudo systemctl restart apache2
122+
```
123+
124+
## Configuration directives
125+
126+
### `Crowdsec`
127+
128+
> on|off
129+
130+
Enable or disable module globally:
131+
- `off` (**default**): Module has to be enabled per location.
132+
- `on`: Module is enabled by default.
133+
134+
Behavior can be overriden in any location.
135+
136+
### `CrowdsecFallback`
137+
138+
> fail|block|allow
139+
140+
How to respond if the Crowdsec API is not available:
141+
- `fail` (**default**) returns a 500 Internal Server Error.
142+
- `block` returns a 302 Redirect (or 429 Too Many Requests if CrowdsecLocation is unset).
143+
- `allow` will allow the request through.
144+
145+
### `CrowdsecBlockedHTTPCode`
146+
147+
> 500|403|429
148+
149+
HTTP code to return when a request is blocked (default is `429`).
150+
151+
### `CrowdsecLocation`
152+
153+
Set to the URL to redirect to when the IP address is banned. As per RFC 7231 may be a path, or a full URL. For example: /sorry.html
154+
155+
### `CrowdsecURL`
156+
157+
Set to the URL of the Crowdsec API. For example: http://localhost:8080.
158+
159+
### `CrowdsecAPIKey`
160+
161+
Set to the API key of the Crowdsec API. Add an API key using 'cscli bouncers add'.
162+
163+
### `CrowdsecCache`
164+
165+
Enable the crowdsec cache. Defaults to 'none'. Options detailed here: https://httpd.apache.org/docs/2.4/socache.html.
166+
167+
### `CrowdsecCacheTimeout`
168+
169+
Set the crowdsec cache timeout. Defaults to 60 seconds.
170+
171+
## Next steps
172+
173+
### Overriding HTTP Response
174+
175+
If you want to return custom HTTP code and/or content, you can use `CrowdsecLocation` and `RewriteRules` :
176+
177+
```bash
178+
CrowdsecLocation /one/
179+
```
180+
181+
```bash
182+
<Location /one/>
183+
Crowdsec off
184+
RewriteEngine On
185+
RewriteRule .* - [R=403,L]
186+
# Require all denied
187+
ErrorDocument 403 "hell nooo"
188+
</Location>
189+
190+
```
191+
192+
193+
194+

0 commit comments

Comments
 (0)