Crowdsec port 6060 open #1410

New Issue

MrUnknownDE · 2026-04-05T19:24:53+02:00

MrUnknownDE commented

2026-04-05 19:24:53 +02:00

Originally created by @mellow65 on 6/3/2025

I'm aware Crowdsec comes with the disclaimer of potentially needing extra set up, and maybe it's me not knowing tons about Crowdsec but I am continually trying to learn. But the way that Crowdsec is set up in the docker compose, port 6060 is open to the world.

running both of these commands gives me the same results, the metrics from my crowdsec install.

curl http://yourpublicIP:6060/metrics
curl http://pangolin.yourdomain.com:6060/metrics

I'm not 100% if should care, but also couldn't/shouldn't that port be set up to only allow from an internal docker IP or loopback IP?

172.18.0.1:6060:6060
127.0.0.1:6060:6060

Help me understand why this isn't a bad idea to expose the port to the world.

*Originally created by @mellow65 on 6/3/2025* I'm aware Crowdsec comes with the disclaimer of potentially needing extra set up, and maybe it's me not knowing tons about Crowdsec but I am continually trying to learn. But the way that Crowdsec is set up in the docker compose, port 6060 is open to the world. running both of these commands gives me the same results, the metrics from my crowdsec install. curl http://yourpublicIP:6060/metrics curl http://pangolin.yourdomain.com:6060/metrics I'm not 100% if should care, but also couldn't/shouldn't that port be set up to only allow from an internal docker IP or loopback IP? - 172.18.0.1:6060:6060 - 127.0.0.1:6060:6060 Help me understand why this isn't a bad idea to expose the port to the world.

MrUnknownDE closed this issue

2026-04-05 19:24:53 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1410