/var/log/crowdsec.log
time="2026-08-28T15:32:14+02:00" level=info msg="Ip 89.47.191.6 performed 'inherent-io/keycloak-bf' (6 events over 6.387940505s) at 2026-08-28 13:32:14.664731637 +0000 UTC"
time="2026-08-28T15:32:15+02:00" level=info msg="(e2d7bc980f47470baaacfb4c32253a52f7vYRx6qVLpkWmUu/crowdsec) inherent-io/keycloak-bf by ip 89.47.191.6 (SE/1653) : 1h captcha on Ip 89.47.191.6" module=db
time="2026-08-28T15:32:26+02:00" level=info msg="Ip 89.47.191.6 performed 'inherent-io/keycloak-slow-bf' (11 events over 18.532603287s) at 2026-08-28 13:32:26.809418622 +0000 UTC"
time="2026-08-28T15:32:27+02:00" level=info msg="(e2d7bc980f47470baaacfb4c32253a52f7vYRx6qVLpkWmUu/crowdsec) inherent-io/keycloak-slow-bf by ip 89.47.191.6 (SE/1653) : 1h ban on Ip 89.47.191.6" module=db
/etc/crowdsec/profiles.yaml.local
name: captcha_remediation
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip" && GetDecisionsSinceCount(Alert.GetValue(), "24h") == 0
decisions:
- type: captcha
duration: 1h
on_success: break
---
name: default_ip_remediation
filters:
- Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
- type: ban
duration: 1h
on_success: break
/etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf
MODE=live
CAPTCHA_EXPIRATION=3600
- Submit wrong username+password 5/6 times -> captcha remediation added
- Browser displays captcha
- Solve captcha -> allowed back in
- Submit 5/6 more wrong username+password combinations -> ban remediation added
- Nothing happens, can still access the website and brute-force as much as we want
The official example is even worse:
https://docs.crowdsec.net/docs/next/local_api/profiles/captcha_profile/
With
GetDecisionsSinceCount(Alert.GetValue(), "24h") <= 3
instead of
GetDecisionsSinceCount(Alert.GetValue(), "24h") == 0
the user just gets one single captcha remediation added and that's it.
With this example I would expect that multiple captcha remediation can be added and each one of them needs to be solved exactly once.
And I would also expect that a ban would lock out the user immediately, no matter if they solved a captcha or not.
/var/log/crowdsec.log/etc/crowdsec/profiles.yaml.local/etc/crowdsec/bouncers/crowdsec-openresty-bouncer.confThe official example is even worse:
https://docs.crowdsec.net/docs/next/local_api/profiles/captcha_profile/
With
GetDecisionsSinceCount(Alert.GetValue(), "24h") <= 3instead of
GetDecisionsSinceCount(Alert.GetValue(), "24h") == 0the user just gets one single captcha remediation added and that's it.
With this example I would expect that multiple captcha remediation can be added and each one of them needs to be solved exactly once.
And I would also expect that a ban would lock out the user immediately, no matter if they solved a captcha or not.