Component inclusion request: cs-abuseipdb-bouncer (AbuseIPDB reporting integration)

Aperta
  • Qualcosa non va?
#1,985 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go, python
Ambito
backend, security

Direzione di ricerca

Start by reading the CrowdSec Hub contribution requirements and the component specifications referenced in the issue, then compare them with the linked integration's documentation and compliance matrix. The issue asks whether this outbound reporting integration fits the Remediation Components Hub or another category; done means confirming eligibility and the appropriate category, with any required inclusion changes identified.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hello CrowdSec team,

I'd like to request inclusion of cs-abuseipdb-bouncer in the CrowdSec Hub as a community-maintained integration.

Repository Information

Description

cs-abuseipdb-bouncer is a standalone CrowdSec integration that automatically reports qualifying malicious IP addresses detected by CrowdSec to AbuseIPDB.

It consumes CrowdSec Local API decisions, maps scenarios to AbuseIPDB categories, and submits reports with filtering, deduplication, rate limiting, and persistent retry handling.

Key Capabilities

CrowdSec Integration
  • Stream-based decision consumption via the official go-cs-bouncer library
  • 10-second default polling interval, configurable down to 2 seconds
  • API key and mTLS authentication
  • Versioned User-Agent identification
  • LAPI usage telemetry through /v1/usage-metrics
AbuseIPDB Reporting
  • Automatic reporting of qualifying ban decisions
  • Scenario mapping covering 22 of 23 AbuseIPDB categories
  • Private, reserved, invalid, and whitelisted IP filtering
  • Per-IP cooldown and daily API quota enforcement
  • Concurrent reporting worker pool
  • Persistent retry queue with exponential backoff
  • HTTP rate-limit and Retry-After handling
Reliability and Observability
  • bbolt-backed persistent state
  • Prometheus metrics
  • Health and readiness endpoints
  • Structured JSON logging
  • Graceful shutdown
Security and Supply Chain
  • Distroless, non-root Docker container
  • Read-only filesystem and dropped capabilities
  • Seccomp syscall restrictions
  • Credential redaction and TLS enforcement
  • Cosign-signed images
  • CycloneDX SBOM
  • Automated vulnerability scanning

Documentation

Automated Testing

Component Classification

This project is an outbound threat intelligence reporting integration, rather than an inline traffic enforcement component.

It consumes CrowdSec decisions and forwards qualifying detections to AbuseIPDB. It does not directly block traffic, enforce firewall rules, or provide CAPTCHA challenges.

The implementation follows the applicable CrowdSec specifications for stream mode, component identification, authentication, and LAPI usage telemetry.

Would this reporting integration be eligible for the Remediation Components Hub, or would another Hub category be more appropriate?

I'm happy to make any adjustments necessary for inclusion.

Thank you for considering the project.

Lingua principale
Python
Stelle
257
Fork
235
Merge medio
3g 20h
PR unite (30g)
27

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di crowdsecurity/hub

Tutte le issue di crowdsecurity/hub

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.