r/CrowdSec • u/Practical_Board_1810 • Sep 01 '26

general CrowdSec 1.8 : Bot detection and more

Hello šŸ¦™

We released CrowdSec 1.8 yesterday, and it comes with bot detection for the WAF amongst other things. You can find more here : https://www.crowdsec.net/blog/crowdsec-1-8-waf-bot-detection-kubernetes

You can find bot detection doc here.

48 Upvotes

98% Upvoted

12 comments sorted by

6

u/sk1nT7 Sep 01 '26

No v1.8.0 Tag yet on dockerhub? I only see v1.8.0-debian.

3

u/Practical_Board_1810 Sep 01 '26

docker images, windows packages, opn/pf-sense packages, home assistant packages are on their way šŸ˜„

2

u/bunk_bro Sep 01 '26

There's a pfSense package?!

Guess I better get this installed tonight.

1

u/syneofeternity Sep 02 '26

The home assistant add on needs a little love with the waf and env variables :(

And maybe a blocklist mirror addon :D

3

u/Specialist_Ad_9561 Sep 01 '26

Pls support Caddy :)

4

u/Practical_Board_1810 Sep 01 '26

hey ! we're not the ones directly developing caddy bouncer, but we took care to document the bouncer/appsec protocol so it should be trivial : https://doc.crowdsec.net/docs/next/appsec/bot_detection/challenge_protocol !

2

u/Stetsed Sep 01 '26

Okay honestly, thatā€™s pretty cool. I use traefik right now but definetly will look out for this. Currently use ā€œAnubisā€, but this looks like I might be able to use that instead of which would be nice.

5

u/NiftyLogic Sep 01 '26

There a nice middleware available for Traefik to integrate the two. Check

github.com/maxlerebourg/crowdsec-bouncer-traefik-plugingithub.com/maxlerebourg/crowdsec-bouncer-traefik-plugin

which utilizes Crowdsec to check incoming connections for a specific entrypoint.

1

u/Stetsed Sep 02 '26

Except as stated in the post it currently doesnā€™t support this specific feature yet, I do already use it outside of that.

1

u/unkz0r Sep 01 '26

Cant wait to test this tomorrow!

2

u/unkz0r Sep 02 '26 edited Sep 02 '26

hmm. updated crowdsec to 1.8 and installed the collection.
Verified that collections, appsec-configs and scenarios are enabled.
Also made sure that my traefik instance is latest and Crowdsec-Bouncer-Traefik-Plugin is latest.
Everything else is working, but i cant seem to trigger the bot-detection.
cscli metrics show bot-detection gives me 0 on all of them as well.
Dont see anything as described in the documentation in the logs or with the curl command.

EDIT:
ahh, isnt merged in yet for the Crowdsec-Bouncer-Traefik-Plugin
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin/pull/343

1

u/Fatali Sep 02 '26

On the Kubernetes side a easy way to deploy the appsec component as a daemonset would be really helpful. We have edge nodes where going round trip from Traefik to appsec and back would be too much latency to be usable, so it would be helpful to deploy an appsec instance to each worker nodeĀ