CrowdSec protection for NethVoice module

[gsanchietti]

Create a CrowdSec configuration to protect the NethVoice module against:

• SIP brute force attacks (implementation: Crowdsec: SIP bruteforce traffic not banned #7481)
• HTTP brute force attacks against NethCTI, admin interface (wizard), FreePBX and report

New scenarios must be visible on the Collections page (see #8068)

CrowdSec already provides basic HTTP protection against fast brute force attack using LePresidente/http-generic-403-bf and LePresidente/http-generic-401-bf scenarios which are enabled by default.
New implementation will focus on:

• specific slow brute force attack to NethVoice applications
• specific SIP brute force attack to Kamailio

Related PRs:

• feat: add NethVoice-specific CrowdSec detection scenarios ns8-crowdsec#181 feat: protect NethVoice and Kamailio ns8-crowdsec#182
• kamailio: log failed SIP auth source IP for CrowdSec nethesis/ns8-nethvoice-proxy#193

Related issues:

• Crowdsec: SIP bruteforce traffic not banned #7481
• ns8-crowdsec: add Alerts, Collections, and Central API pages #8068

[gsanchietti]

Testing versions: crowdsec:1.2.0-dev.1, nethvoice-proxy:1.6.4-testing.5

Fresh install:

add-module ghcr.io/nethserver/crowdsec:1.2.0-dev.1 1
add-module ghcr.io/nethesis/nethvoice-proxy:1.6.4-testing.5 1

Update existing instance:

api-cli run update-module --data '{"module_url":"ghcr.io/nethserver/crowdsec:1.2.0-dev.1","instances":["crowdsec1"]}'
api-cli run update-module --data '{"module_url":"ghcr.io/nethesis/nethvoice-proxy:1.6.4-testing.5","instances":["nethvoice-proxy1"]}'

TC1 — First install: all four HTTP scenarios present and active

1. Fresh install (NETHVOICE_COLLECTION_ENABLED=True default).
2. cscli scenarios list shows: nethserver/nethvoice-middleware-bf, nethserver/nethvoice-reports-bf, nethserver/nethvoice-admin-login-bf, nethserver/nethvoice-http-exploit-scan, plus nethserver/kamailio-bf.
3. cscli parsers list shows the matching -logs.yaml parsers and nethserver/nethvoice-whitelist-http-probing.

TC2 — Middleware brute force ban

1. ≥8 failed logins (401/403) against the NethCTI middleware API (nethvoice-middleware-logs parses its [GIN] access log, tagging log_type=nethvoice_middleware_access-log), spaced no more than 10m apart, from one source IP.
2. nethserver/nethvoice-middleware-bf alert + ban (blackhole: 15m) in cscli decisions list.
3. Negative check: whitelisted noisy endpoints from nethvoice-whitelist-http-probing.yaml (GET /webrest/astproxy/trunks 401, GET /webrest/user/endpoints/all 401, GET /webrest/astproxy/extensions 401, POST /webrest/authentication/login 401, POST /webrest/authentication/logout 401, GET /freepbx/rest/mobiles|nethlink|mobileapp/*|webrtc/201 404, GET /freepbx/rest/migration 403, GET /janus/*, GET /webrest/astproxy/qmanager_qstats/* 200) from the same IP must not count toward the ban — this whitelist matches on the generic http_access-log/http_error-log tags (LePresidente's http-40x-bf scenarios), so also confirm those generic scenarios don't fire on this traffic either.

TC3 — Reports-api brute force ban

1. ≥8 failed logins (401/403) against reports-api (program reports-api, parsed by nethvoice-reports-logs), spaced no more than 10m apart, from one source IP.
2. nethserver/nethvoice-reports-bf alert + ban (blackhole: 15m).

TC4 — Admin API login brute force ban

1. ≥8 failed POSTs (401/403) to /freepbx/rest/login within 10m from one source IP.
2. nethserver/nethvoice-admin-login-bf alert + ban (blackhole: 15m).

TC5 — FreePBX exploit-path scan detection

1. ≥5 POSTs to /admin/config.php returning 308/404, spaced no more than 15m apart, from one source IP.
2. nethserver/nethvoice-http-exploit-scan alert + ban (blackhole: 2h) — verify it still triggers even when hits are spaced out over most of the 15m window (slow-scan case).

TC6 — Update path: HTTP protections off, then opt-in

1. After update, NETHVOICE_COLLECTION_ENABLED=False → none of the nethserver/nethvoice-*/nethserver/kamailio-* scenarios or parsers present (cscli scenarios list / cscli parsers list), no bans from repeating TC2–TC5 traffic.
2. Enable via runagent -m crowdsec1 python3 -c 'import agent ; agent.set_env("NETHVOICE_COLLECTION_ENABLED", "True")' + systemctl restart crowdsec1, repeat TC2–TC5 → all four trigger correctly.