CrowdSec: detect WebTop login brute force #8288

CrowdSec does not block brute force attacks against the WebTop login page. A failed login is not visible to any installed CrowdSec collection, so an attacker can try passwords without being banned.

There are two reasons. First, the web server answers a failed login with HTTP 200, the same code as a normal page, so the generic HTTP brute force scenarios (which look for 401/403) never trigger. Second, the web server log only shows the reverse proxy address (Traefik), not the real client, so even a scenario on the access log would ban the proxy itself.

WebTop now writes a dedicated authentication line with the real client address and an explicit result:

Success:

node webapp[1700806]: webtop-auth: [webtop][webtop:core] <SESSION_ID>: client=203.0.113.10 profile=alice@NethServer action=LOGIN_SUCCESS
node apache[1700412]: 10.0.2.100 - - [04/Nov/2026:08:04:27 +0000] "POST /webtop/login HTTP/1.1" 302 -

Failure:

node webapp[1700806]: webtop-auth: [webtop][webtop:core] null: client=203.0.113.10 profile=alice@? action=LOGIN_FAILURE
node apache[1700412]: 10.0.2.100 - - [04/Nov/2026:08:05:44 +0000] "POST /webtop/login HTTP/1.1" 200 4053

Proposed solution

Add a custom parser and a brute force scenario to ns8-crowdsec, like the ones already shipped for NethVoice and Nextcloud. The parser reads the webtop-auth: lines from the webapp program in the journal and extracts the client address, the user and the action. The scenario bans a client address after several LOGIN_FAILURE events in a short time.

Before release, confirm that the client= value always comes from the address set by Traefik and cannot be forged by the client with an X-Forwarded-For header. Otherwise an attacker could get any address banned.

Alternative solutions

A scenario on the web server access log matching POST /webtop/login with status 200. I discarded it: it is fragile and it only sees the proxy address.

Additional context

No WebTop parser exists in the CrowdSec hub.

See also

https://github.com/NethServer/ns8-crowdsec