Nextcloud GNOME Online Account triggers crowdsecurity/http-generic-bf

[sim6]

Please see the following alert:

[...]
 - Simulation   : false
 - Remediation  : true
 - Reason       : crowdsecurity/http-generic-bf
 - Events Count : 6
[...]
 - Context  :
╭────────────┬────────────────────────────────────────────╮
│     Key    │                    Value                   │
├────────────┼────────────────────────────────────────────┤
│ method     │ PROPFIND                                   │
│ method     │ OPTIONS                                    │
│ status     │ 401                                        │
│ target_uri │ /remote.php/dav                            │
│ target_uri │ /remote.php/webdav                         │
│ target_uri │ /remote.php/dav/                           │
│ user_agent │ Evolution/3.58.2                           │
│ user_agent │ gnome-online-accounts/3.56.2 libsoup/3.6.5 │
╰────────────┴────────────────────────────────────────────╯

[buixor]

Hello,

Can you provide associated generated logs please ?

[sim6]

{"level":"info","ts":1768325216.6267188,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33828","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"PROPFIND","host":"example.com","uri":"/remote.php/dav/","headers":{"Depth":["0"],"User-Agent":["Evolution/3.58.2"],"Cache-Control":["no-cache"],"Pragma":["no-cache"],"Content-Type":["application/xml; charset=\"utf-8\""],"Content-Length":["235"],"Accept-Encoding":["gzip, deflate, br"],"Accept-Language":["en-us, en;q=0.9"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":235,"user_id":"","duration":0.049868093,"size":584,"status":401,"resp_headers":{"Content-Security-Policy":["default-src 'none';"],"Content-Length":["584"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Robots-Tag":["noindex, nofollow"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"Via":["1.1 Caddy"],"Referrer-Policy":["no-referrer"],"X-Content-Type-Options":["nosniff"],"Date":["Tue, 13 Jan 2026 17:26:56 GMT"],"X-Permitted-Cross-Domain-Policies":["none"],"X-Frame-Options":["SAMEORIGIN"],"Content-Type":["application/xml; charset=utf-8"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"X-Xss-Protection":["1; mode=block"],"Server":["Apache/2.4.62 (Debian)"],"Set-Cookie":["REDACTED"]}}
{"level":"info","ts":1768325217.284583,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33828","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"PROPFIND","host":"example.com","uri":"/remote.php/dav/","headers":{"Accept-Encoding":["gzip, deflate, br"],"Accept-Language":["en-us, en;q=0.9"],"Content-Length":["235"],"Depth":["0"],"User-Agent":["Evolution/3.58.2"],"Cache-Control":["no-cache"],"Pragma":["no-cache"],"Content-Type":["application/xml; charset=\"utf-8\""]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":235,"user_id":"","duration":0.058069077,"size":584,"status":401,"resp_headers":{"X-Robots-Tag":["noindex, nofollow"],"X-Permitted-Cross-Domain-Policies":["none"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["application/xml; charset=utf-8"],"X-Frame-Options":["SAMEORIGIN"],"Referrer-Policy":["no-referrer"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"X-Xss-Protection":["1; mode=block"],"Content-Length":["584"],"Via":["1.1 Caddy"],"Date":["Tue, 13 Jan 2026 17:26:57 GMT"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"Content-Security-Policy":["default-src 'none';"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Server":["Apache/2.4.62 (Debian)"]}}
{"level":"info","ts":1768325217.95302,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33870","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"OPTIONS","host":"example.com","uri":"/remote.php/webdav/","headers":{"Accept-Encoding":["gzip, deflate, br"],"User-Agent":["gnome-online-accounts/3.56.2 libsoup/3.6.5"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":0,"user_id":"","duration":0.065922039,"size":414,"status":401,"resp_headers":{"Server":["Apache/2.4.62 (Debian)"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Security-Policy":["default-src 'none';"],"Content-Type":["application/xml; charset=utf-8"],"X-Robots-Tag":["noindex, nofollow"],"Referrer-Policy":["no-referrer"],"X-Frame-Options":["SAMEORIGIN"],"X-Permitted-Cross-Domain-Policies":["none"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"Date":["Tue, 13 Jan 2026 17:26:57 GMT"],"X-Xss-Protection":["1; mode=block"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"X-Content-Type-Options":["nosniff"],"Via":["1.1 Caddy"],"Content-Length":["414"],"Set-Cookie":["REDACTED"]}}
{"level":"info","ts":1768325219.8171146,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33854","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"PROPFIND","host":"example.com","uri":"/remote.php/dav/","headers":{"Content-Type":["application/xml; charset=\"utf-8\""],"Content-Length":["235"],"Accept-Encoding":["gzip, deflate, br"],"Accept-Language":["en-us, en;q=0.9"],"Depth":["0"],"User-Agent":["Evolution/3.58.2"],"Cache-Control":["no-cache"],"Pragma":["no-cache"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":235,"user_id":"","duration":0.060248743,"size":584,"status":401,"resp_headers":{"Content-Length":["584"],"Referrer-Policy":["no-referrer"],"Date":["Tue, 13 Jan 2026 17:26:59 GMT"],"Content-Security-Policy":["default-src 'none';"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Xss-Protection":["1; mode=block"],"X-Permitted-Cross-Domain-Policies":["none"],"X-Frame-Options":["SAMEORIGIN"],"Via":["1.1 Caddy"],"Set-Cookie":["REDACTED"],"X-Content-Type-Options":["nosniff"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"Content-Type":["application/xml; charset=utf-8"],"X-Robots-Tag":["noindex, nofollow"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"Server":["Apache/2.4.62 (Debian)"]}}
{"level":"info","ts":1768325228.056869,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33862","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"PROPFIND","host":"example.com","uri":"/remote.php/dav/","headers":{"Pragma":["no-cache"],"Content-Type":["application/xml; charset=\"utf-8\""],"Content-Length":["209"],"Accept-Encoding":["gzip, deflate, br"],"Accept-Language":["en-us, en;q=0.9"],"Depth":["0"],"User-Agent":["Evolution/3.58.2"],"Cache-Control":["no-cache"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":209,"user_id":"","duration":0.053759793,"size":584,"status":401,"resp_headers":{"Referrer-Policy":["no-referrer"],"X-Robots-Tag":["noindex, nofollow"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Permitted-Cross-Domain-Policies":["none"],"X-Xss-Protection":["1; mode=block"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"Content-Type":["application/xml; charset=utf-8"],"Server":["Apache/2.4.62 (Debian)"],"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["SAMEORIGIN"],"Content-Length":["584"],"Via":["1.1 Caddy"],"Set-Cookie":["REDACTED"],"Content-Security-Policy":["default-src 'none';"],"Date":["Tue, 13 Jan 2026 17:27:08 GMT"]}}
{"level":"info","ts":1768325228.171392,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33828","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"OPTIONS","host":"example.com","uri":"/remote.php/webdav/","headers":{"User-Agent":["gnome-online-accounts/3.56.2 libsoup/3.6.5"],"Accept-Encoding":["gzip, deflate, br"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":0,"user_id":"","duration":0.056811869,"size":414,"status":401,"resp_headers":{"X-Xss-Protection":["1; mode=block"],"Referrer-Policy":["no-referrer"],"Content-Security-Policy":["default-src 'none';"],"Date":["Tue, 13 Jan 2026 17:27:08 GMT"],"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["SAMEORIGIN"],"X-Robots-Tag":["noindex, nofollow"],"Via":["1.1 Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"Set-Cookie":["REDACTED"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"X-Permitted-Cross-Domain-Policies":["none"],"Server":["Apache/2.4.62 (Debian)"],"Content-Length":["414"],"Content-Type":["application/xml; charset=utf-8"]}}
{"level":"info","ts":1768325229.0243764,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33842","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"OPTIONS","host":"example.com","uri":"/remote.php/webdav/","headers":{"Accept-Encoding":["gzip, deflate, br"],"User-Agent":["gnome-online-accounts/3.56.2 libsoup/3.6.5"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":0,"user_id":"","duration":0.056903355,"size":414,"status":401,"resp_headers":{"Set-Cookie":["REDACTED"],"Date":["Tue, 13 Jan 2026 17:27:08 GMT"],"X-Permitted-Cross-Domain-Policies":["none"],"Via":["1.1 Caddy"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"X-Robots-Tag":["noindex, nofollow"],"X-Content-Type-Options":["nosniff"],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Referrer-Policy":["no-referrer"],"Content-Security-Policy":["default-src 'none';"],"Server":["Apache/2.4.62 (Debian)"],"Content-Length":["414"],"Content-Type":["application/xml; charset=utf-8"]}}
{"level":"info","ts":1768325230.555346,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"192.0.2.1","remote_port":"33867","client_ip":"192.0.2.1","proto":"HTTP/2.0","method":"OPTIONS","host":"example.com","uri":"/remote.php/webdav/","headers":{"User-Agent":["gnome-online-accounts/3.56.2 libsoup/3.6.5"],"Accept-Encoding":["gzip, deflate, br"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"example.com"}},"bytes_read":0,"user_id":"","duration":0.816876172,"size":414,"status":401,"resp_headers":{"X-Frame-Options":["SAMEORIGIN"],"Strict-Transport-Security":["max-age=15552000; includeSubDomains"],"Set-Cookie":["REDACTED"],"Content-Length":["414"],"Content-Security-Policy":["default-src 'none';"],"Www-Authenticate":["Basic realm=\"Nextcloud\", charset=\"UTF-8\""],"X-Content-Type-Options":["nosniff"],"X-Robots-Tag":["noindex, nofollow"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"X-Permitted-Cross-Domain-Policies":["none"],"Content-Type":["application/xml; charset=utf-8"],"Date":["Tue, 13 Jan 2026 17:27:10 GMT"],"Via":["1.1 Caddy"],"Server":["Apache/2.4.62 (Debian)"],"X-Xss-Protection":["1; mode=block"],"Referrer-Policy":["no-referrer"]}}