some url return 403

[andyoulovexy]

Like this:

How to solve it?tks

[TheophileDiot]

Hi, looks like the plugin crowdsec denied your requests

[andyoulovexy]

Hi, looks like the plugin crowdsec denied your requests

How to solve it?tks

[TheophileDiot]

@andyoulovexy It can be a false positive with Crowdsec so I'd say that you can deactivate the plugin in your configuration and try opening an issue related to this to Crowdsec, maybe they can help you with this since it's related to their tool.

[andyoulovexy]

@andyoulovexy It can be a false positive with Crowdsec so I'd say that you can deactivate the plugin in your configuration and try opening an issue related to this to Crowdsec, maybe they can help you with this since it's related to their tool.

maybe,maybe crowdsec plugin should be fix or update?I will open an issue in crowdsec hub,tks

[TheophileDiot]

@andyoulovexy I'll have a check

[andyoulovexy]

@andyoulovexy I'll have a check

I commented these three lines, and there is no problem with revisiting, but I tested based on the nikto tool, and my ip was banned, but revisiting based on this ip can still be accessed normally

[TheophileDiot]

@andyoulovexy Your IP was probably banned by the badbehavior because of the number of bad status code you generated

[andyoulovexy]

Your IP was probably banned by the badbehavior because of the number of bad status code you generated

i didn't turn on bad behavior

[TheophileDiot]

@andyoulovexy That's not recommended, except if you're just testing your configuration 😅
Do you have any logs ?

[TheophileDiot]

@andyoulovexy It looks like that Crowdsec is still activated so your IP was banned

[TheophileDiot]

bunkerweb.txt
crowdsec_plugin.txt

@andyoulovexy Your IP address was showing so I deleted your message, here are the files you sent with your IP censored

[andyoulovexy]

bunkerweb.txt crowdsec_plugin.txt

@andyoulovexy Your IP address was showing so I deleted your message, here are the files you sent with your IP censored

bunkerweb.txt
crowdsec_plugin.txt
tks！！！

[andyoulovexy]

@andyoulovexy It looks like that Crowdsec is still activated so your IP was banned

My IP is not banned

[TheophileDiot]

@andyoulovexy It looks like that Crowdsec is still activated so your IP was banned

My IP is not banned

According to your screenshot, you're being reported by Crowdsec and Modsecurity.

[andyoulovexy]

@andyoulovexy It looks like that Crowdsec is still activated so your IP was banned

My IP is not banned

According to your screenshot, you're being reported by Crowdsec and Modsecurity.

i will disable modsecurity,i will try it

[TheophileDiot]

@andyoulovexy Hmmmm it's okay for now but later it would be better to create rules for modsec.

[andyoulovexy]

i didn't start modsecurity at all.

[TheophileDiot]

@andyoulovexy You just deactivated it or it was already deactivated ?

[andyoulovexy]

@andyoulovexy You just deactivated it or it was already deactivated ?

After adding the service, it is not activated

[TheophileDiot]

@andyoulovexy Ok, any changes in the logs then ?

[andyoulovexy]

@andyoulovexy You just deactivated it or it was already deactivated ?

my ip x.x.x.222,it not in crowdsec decision!!!

but in bunkerweb log :

[andyoulovexy]

@andyoulovexy Ok, any changes in the logs then ?

[TheophileDiot]

Ok, it has to be a problem with Crowdsec then, let me know if you have an answer for your issue

[andyoulovexy]

Ok, it has to be a problem with Crowdsec then, let me know if you have an answer for your issue

ok.I think crowdsec-bunkerweb-bouncer had some problem,but i still open an issue in crowdsec.tks

[andyoulovexy]

Ok, it has to be a problem with Crowdsec then, let me know if you have an answer for your issue

ok.I think crowdsec-bunkerweb-bouncer had some problem,but i still open an issue in crowdsec.tks
I had add my ip to whitelist,everything is ok!!but i can't add all ip to whitelist!!!!.

This logs:

[andyoulovexy]

Ok, it has to be a problem with Crowdsec then, let me know if you have an answer for your issue

maybe need check bans.i think exist balcklist cache~.i open an issue at crowdsec discord，crowdsec developer reply crowdsec-bunkerweb-bouncer had some problem！！！https://discord.com/channels/921520481163673640/1003029165425049751/threads/1052533768151384094

[andyoulovexy]

Ok, it has to be a problem with Crowdsec then, let me know if you have an answer for your issue

debug logs:
*2022/12/15 02:57:49 [debug] 1802#1802: 597 [lua] bouncer.lua:376: allowIp(): 'ipv4_4294967295_1032667358' is in cache
2022/12/15 02:57:49 [info] 1802#1802: *597 [ACCESS] Return value from crowdsec.access() is : CrowSec bouncer denied request, client: x.x.x.222, server: app.example.com, request: "GET /data/upload/image/20220409/1649486537112450.png HTTP/2.0", host: "app.example.com", referrer: "https://app.example.com/"
2022/12/15 02:57:49 [warn] 1802#1802: *597 [ACCESS] Denied access from crowdsec : CrowSec bouncer denied request, client: x.x.x.222, server: app.example.com, request: "GET /data/upload/image/20220409/1649486537112450.png HTTP/2.0", host: "app.example.com", referrer: "https://app.example.com/"

[killmasta93]

hi @andyoulovexy were you able to solve this issue? currently having the same issue which i just realized

[andyoulovexy]

Until version 1.5.2, this issue still persists, equivalent to crowdsec still not being used as a plugin

[andyoulovexy]

just stream?why does't work in live mode?

[killmasta93]

i have no idea, but it seems to work like that

[andyoulovexy]

Does Bunkerweb1.5.2 still require clamav and virtuotal API containers !!why clamav and virustotal does't work?do you test it?

[killmasta93]

yeah clamav does not work havent try Virus total yet still looking into the clam AV issue

[andyoulovexy]

ok. I will wait an stable version.