Re: [PR] ADR-69 - Crowdsec IP filtering [james-project]

["quantranhong1999 (via GitHub)" <gi...@apache.org>]

quantranhong1999 commented on code in PR #1761:
URL: https://github.com/apache/james-project/pull/1761#discussion_r1378354085


##########
src/adr/0069-crowdsec-IP-filtering.md:
##########
@@ -0,0 +1,51 @@
+# 69. Crowdsec
+
+Date: 2022-10-26
+
+## Status
+
+Accepted (lazy consensus).
+
+Implemented. 
+
+## Context
+
+Currently, there is no mechanism to check harmful IP addresses implementing attacks like bruteforce attacks, dictionary attacks, etc.
+
+- Bruteforce attack: A hacker attempts to guess the user's login credentials.
+- Dictionary attacks: A dictionary attack tries to find out the list of valid mail addresses.
+
+Fail2ban can detect these attacks, however it is very complex to setup in a distributed system.
+
+## Decision 
+
+To that end, James is integrated with [Crowdsec](https://www.crowdsec.net/). Crowdsec will check James logs, based on defined scenarios, Crowdsec can detect malevolent behaviors, and block them from accessing James at various levels (infrastructural, system, applicative). For basic, we implement Crowdsec to detect at system level.
+
+A quick introduction about Crowdsec:
+
+```
+CrowdSec Security Engine is an open-source and lightweight software that allows you to detect peers with malevolent behaviors and block them from accessing your systems at various levels (infrastructural, system, applicative).
+
+To achieve this, the Security Engine reads logs from different sources (files, streams ...) to parse, normalize and enrich them before matching them to threats patterns called scenarios. 
+
+```
+
+CrowdSec ships by default with scenarios (brute force, port scan, web scan, etc.) adapted for most contexts, but you can easily extend it by picking more of them from the [HUB](https://app.crowdsec.net/hub/collections). It is also easy to adapt an existing one or create one yourself.
+
+Set up a new maven project dedicated to Crowdsec extension. This allows to be embedded in a James server as a soft dependency
+using the external-jar loading mechanism. With this way, the extension could be dropped in one's James installation, and not a runtime dependency.
+
+James connects to Crowdsec via https protocol with reactor http client. 

Review Comment:
   > Crowdsec only cares for the content of logs, so instead of listing down the protocols, we should tell the abnormal behaviors that Crowdsec can detect.
   
   It is CrowdSec responsibility to detect the attacks and ban decision. CrowdSec does not care much about application protocols or whatever except purely logs.
   
   But which surfaces in James can leverage that ban decision? It is a different story. That should be noted in ADR.
   
   BTW you did not precisely introduce the attack scenarios. ``james-bf-auth`, `dictionary-attack`` are just the names in your POC, those can change in any time. Should not force reader to guess `bf` is bruteforce, no?
   
   Let's list the attacks FQDN and explain them a bit IMO.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@james.apache.org
For additional commands, e-mail: notifications-help@james.apache.org