Package: pycrowdsec
PyCrowdSecCrowdSecis a FOSS tool which parses logs and detects attacks. PyCrowdSec enables integration of CrowdSec with python projects. It is easy to setup and boosts the security by leveraging CrowdSec's attack detection capabilities.PyCrowdSec contains a python client library for CrowdSec, as well as middlewares for django and flask integrations.Installation:pipinstallpycrowdsecYou'll also need an instance of CrowdSec running, see installation instructionshereClient library:StreamClientThis client polls CrowdSec LAPI and keeps track of active decisions.
In the below example assume that there's a ban decisions for IP "77.88.99.66" and captcha decision for country "CN".Basic Usage:frompycrowdsec.clientimportStreamClientclient=StreamClient(api_key=<CROWDSEC_API_KEY>,)client.run()# This starts polling the APIassertclient.get_current_decisions()=={"77.88.99.66":"ban""CN":"captcha"}assertclient.get_action_for("77.88.99.66")=="ban"assertclient.get_action_for("CN")=="captcha"TheCROWDSEC_API_KEYcan be obtained by runningsudocsclibouncersaddpython_bouncerTheStreamClient's constructor also accepts the following optional parameters for more advanced configurations.lapi_url: str
Base URL of CrowdSec API. Default ishttp://localhost:8080/.interval: int
Query the CrowdSec API every "interval" seconduser_agent: str
User agent to use while calling the API.scopes: List[str]
List of decision scopes which shall be fetched. Default is ["ip", "range"]QueryClientThis client will query CrowdSec LAPI to check whether the requested item has any decisions against it.
In the below example assume that there's a ban decisions for IP "77.88.99.66" and captcha decision for country "CN".Basic Usage:frompycrowdsec.clientimportStreamClientclient=StreamClient(api_key=<CROWDSEC_API_KEY>,)client.run()# This starts polling the APIassertclient.get_action_for("77.88.99.66")=="ban"assertclient.get_action_for("CN")=="captcha"TheQueryClient's constructor also accepts the following optional parameters for more advanced configurations.lapi_url: str
Base URL of CrowdSec API. Default ishttp://localhost:8080/.user_agent: str
User agent to use while calling the API.Flask Integration:See./examples/flaskfor more detailed example (includes captcha remediation too).A minimal flask app with PyCrowdSec protection would look like:fromflaskimportFlaskfrompycrowdsec.clientimportStreamClientfrompycrowdsec.flaskimportget_crowdsec_middlewareclient=StreamClient(api_key=<CROWDSEC_API_KEY>)app=Flask(__name__)app.before_request(get_crowdsec_middleware(actions,c.cache,exclude_views=["ban_page"])actions={"ban":lambda:redirect(url_for("ban_page")),}@app.route("/ban")defban_page():returnabort(403)@app.route("/")defindex():return"Hello"if__name__="__main__":app.run(host="0.0.0.0")Django Integration:See./examples/djangofor more detailed example (includes captcha remediation too).After installingpycrowdsec, in yoursettings.pyadd the following line in theMIDDLEWARElistMIDDLEWARE=[........."pycrowdsec.django.crowdsec_middleware",.........]Next add define the following variables required forpycrowdsecto function.PYCROWDSEC_LAPI_KEY=<YOUR_LAPI_KEY>PYCROWDSEC_ACTIONS={"ban":lambdarequest:redirect(reverse("ban_view")),}# IMPORTANT: If any action is doing a redirect to some view, always exclude it for pycrowdsec. Otherwise the middleware will trigger the redirect on the action view too.PYCROWDSEC_EXCLUDE_VIEWS={"ban_view"}You'll also need to register a view with nameban_view. In this example all the banned IPs would be redirected to theban_viewFor more advanced configurations, you can specify the following variables in yoursettings.pyPYCROWDSEC_POLL_INTERVALint : Query the CrowdSec API everyPYCROWDSEC_POLL_INTERVALseconds.PYCROWDSEC_LAPI_URLstr: Base URL of CrowdSec API.PYCROWDSEC_ACTIONSDict[str, Callable]: Action to be taken when some request matches CrowdSec's decision.PYCROWDSEC_REQUEST_TRANSFORMERSList[Callable]: Obtains value from Django Request object, this value is used to match the request with CrowdSec's decisions. By default it contains only one transformer which obtains IP from the request.