Crowdsec Defaults to Captcha without Captcha set up and bypasses checks #1459

New Issue

MrUnknownDE · 2026-04-05T19:29:04+02:00

MrUnknownDE commented

2026-04-05 19:29:04 +02:00

Originally created by @mellow65 on 5/22/2025

I'm exploring an unknown world when it comes to Crowdsec, but have been stumbling through it, so bare with me.

After having Pangolin up for a few weeks, I opted to add Crowdsec and start the journey of getting that working. If nothing else it was an eye opening experience of the constant probing of things from the internet.

What I found not 5 mins after setting it up is I already had a couple IPs poking at my services. Crowdsec saw them, which was great, but they were flagged as Captcha, not ban. I get in a production kind of world captcha is probably safer, but in my case where I'm just trying to expose a couple small services to essentially myself, I would rather things default to ban, and then I can fix it after the fact.

The problem is I hadn't set up a captcha yet, yet they were still being flagged as captcha.

After much playing around and manually adding my phones IP address flagged as captcha, I found that if an IP gets flagged as captcha and you don't have a captcha set up, that IP is freely able to get to your domain.

I believe at least in my case I've sorted everything to be flagged as ban if crowdsec decides the IP is no good, and I did that by commenting out the captcha section of the profile.yaml file.

But as I feel Pangonlin has the chance to have a decent following with homelabbers, I would like to see ban be the default decision when it came to what happens when a crowdsec decides an IP is no good.

*Originally created by @mellow65 on 5/22/2025* I'm exploring an unknown world when it comes to Crowdsec, but have been stumbling through it, so bare with me. After having Pangolin up for a few weeks, I opted to add Crowdsec and start the journey of getting that working. If nothing else it was an eye opening experience of the constant probing of things from the internet. What I found not 5 mins after setting it up is I already had a couple IPs poking at my services. Crowdsec saw them, which was great, but they were flagged as Captcha, not ban. I get in a production kind of world captcha is probably safer, but in my case where I'm just trying to expose a couple small services to essentially myself, I would rather things default to ban, and then I can fix it after the fact. The problem is I hadn't set up a captcha yet, yet they were still being flagged as captcha. After much playing around and manually adding my phones IP address flagged as captcha, I found that if an IP gets flagged as captcha and you don't have a captcha set up, that IP is freely able to get to your domain. I believe at least in my case I've sorted everything to be flagged as ban if crowdsec decides the IP is no good, and I did that by commenting out the captcha section of the profile.yaml file. But as I feel Pangonlin has the chance to have a decent following with homelabbers, I would like to see ban be the default decision when it came to what happens when a crowdsec decides an IP is no good.

MrUnknownDE closed this issue

2026-04-05 19:29:04 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1459