Source evidence

Log-folder

CrowdSec · support · 2023-04-05T05:58:00+00:00

CrowdSec plugin evidence original source source API

mixedsentiment

highseverity

0.95relevance

2replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

6 / 32 rows with source links

18.8% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

26 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

AleksCee resolved

Hello, I just figure out that the files in wp-content/plugins/crowdsec/logs/ are accessible directly. Should there not better be protected by htaccess or other methods? thanks, Alex Hello @alekscee , you are right: server-side rules should be added to prevent access to these files. If this is not possible, the logging of files can be completely disabled using the “Disable prod log” parameter. As we can not do this in the plugin sources (we don’t know if user works with Apache, Nginx or anything else), I think we should at least add this notice in the advanced settings and add some configuration examples in the documentation. Will do so asap. Thank you for pointing that out. [UPDATE] : For those using Apache, we will add a .htaccess file in the .logs folder with some “deny” directives. This reply was modified 3 years, 1 month ago by CrowdSec - lightweight and collaborative security engine . Hi @alekscee , we just published a new 2.3.0 release of the plugin. This release contains necessary .htacess and an updated documentation for Nginx users. I’m closing this issue. Happy to continue the conversation here or elsewhere. Thanks again.

Commercial Context

Opportunity

trust and abuse-prevention operations

Security abuse-prevention assurance for keeping sites trusted, protected, and recoverable

Buyer: site owners, agencies, and maintenance teams

Wedge: test security lockouts, bot/spam defenses, risky access changes, and incident alerts

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: Log-folder: users show security, bugs, missing feature pain that may indicate a product gap.

Evidence quote: As we can not do this in the plugin sources (we don’t know if user works with Apache, Nginx or anything else), I think we should at least add this notice in the advanced settings and add some configuration examples in the documentation.

Affected feature: security

security bugs missing feature support

Plugin

API

CrowdSec

2.0K active installs · 60.1K downloads · rating 100.0

captcha crowdsec hacker-protection ip blocker security

Comments

2 shown

CrowdSec – lightweight and collaborative security engine 2023-04-05T06:37:00+00:00

Hello @alekscee , you are right: server-side rules should be added to prevent access to these files. If this is not possible, the logging of files can be completely disabled using the “Disable prod log” parameter. As we can not do this in the plugin sources (we don’t know if user works with Apache, Nginx or anything else), I think we should at least add this notice in the advanced settings and add some configuration examples in the documentation. Will do so asap. Thank you for pointing that out. [UPDATE] : For those using Apache, we will add a .htaccess file in the .logs folder with some “deny” directives. This reply was modified 3 years, 1 month ago by CrowdSec - lightweight and collaborative security engine .

CrowdSec – lightweight and collaborative security engine 2023-04-06T09:18:00+00:00

Hi @alekscee , we just published a new 2.3.0 release of the plugin. This release contains necessary .htacess and an updated documentation for Nginx users. I’m closing this issue. Happy to continue the conversation here or elsewhere. Thanks again.