problem with npmplus + crowdsec and wordpress

[Raxiel1987]

i'm facing a problem with this setup.

i'm using a builder for my websites the same in Joomla and wordpress.
the builder not working properly in wordpress ( i had a similar issue in joomla but i resolved by modify the config of crowdsec)
in wordpress i get blocked by crowdsec with time limit

2024-11-28T15:31:52.871064358Z 2024/11/28 16:31:52 [warn] 426846#426846: *529926 a client request body is buffered to a temporary file /usr/local/nginx/client_body_temp/0000000806 while reading request body, client: x.x.x.x, server: xxxxxxmo.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://lxxxxo.it/wp-admin/theme-install.php?browse=popular"

2024-11-28T15:31:57.716926285Z 2024/11/28 16:31:57 [error] 426846#426846: *529926 lua tcp socket write timed out, client: x.x.x.x, server: xxxxxxx.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://xxxxxxx.it/wp-admin/theme-install.php?browse=popular"

2024-11-28T15:31:57.716967337Z 2024/11/28 16:31:57 [error] 426846#426846: *529926 [lua] crowdsec.lua:578: AppSecCheck(): Fallback because of err: timeout, client: x.x.x.x, server: xxxxxxx.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://xxxxxxxx.it/wp-admin/theme-install.php?browse=popular"

2024-11-28T15:31:57.716988329Z 2024/11/28 16:31:57 [error] 426846#426846: *529926 [lua] crowdsec.lua:651: Allow(): AppSec check: timeout, client: x.x.x.x, server: xxxxxxxx.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://xxxxxxx.it/wp-admin/theme-install.php?browse=popular"

2024-11-28T15:31:57.716991639Z 2024/11/28 16:31:57 [alert] 426846#426846: *529926 [lua] crowdsec.lua:718: Allow(): [Crowdsec] denied 'x.x.x.x' with 'ban' (by appsec), client: x.x.x.x, server: xxxxxxx.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://xxxxxxxx.it/wp-admin/theme-install.php?browse=popular"

2024-11-28T15:32:05.974587253Z 2024/11/28 16:32:05 [warn] 426846#426846: *529960 a client request body is buffered to a temporary file /usr/local/nginx/client_body_temp/0000000807 while reading request body, client: x.x.x.x, server: xxxxxx.it, request: "POST /wp-admin/update.php?action=upload-theme HTTP/3.0", referrer: "https://xxxxxxxx.it/wp-admin/theme-install.php?browse=popular"

i tried to disable modsecurity but the error persist
maybe add more "time" to crowdsec config?

[Zoey2936]

you can try to increase the timeout and report back

[Raxiel1987]

ok where to increase the timeout?
what file and line i shoudl edit?

[Zoey2936]

the crowdsec config in /opt/npm/etc

[Raxiel1987]

i changed the directory of npmplus install cause i had a npm classic
i have this directory /portainer/Files/AppData/Config/Nginx-Proxy/data with inside :
etc | nginx | nginx_custom | tls
inside etc i have :
access | crowdsec | html | logrotate.state | modsecurity | npm

i have to go inside crowdsec folder?
and modify crowdsec.conf?

[Zoey2936]

yes

[Raxiel1987]

but in crowdsec config i have this :

ENABLED=true
API_URL=http://127.0.0.1:8080
API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
CACHE_EXPIRATION=1
# bounce for all type of remediation that the bouncer can receive from the local API
BOUNCING_ON_TYPE=ban
FALLBACK_REMEDIATION=ban
REQUEST_TIMEOUT=3000
UPDATE_FREQUENCY=10
# live or stream
MODE=live
# exclude the bouncing on those location
EXCLUDE_LOCATION=
#those apply for "ban" action
# /!\ REDIRECT_LOCATION and RET_CODE can't be used together. REDIRECT_LOCATION take priority over RET_CODE
BAN_TEMPLATE_PATH=/data/etc/crowdsec/ban.html
REDIRECT_LOCATION=
RET_CODE=
#those apply for "captcha" action
#valid providers are recaptcha, hcaptcha, turnstile
CAPTCHA_PROVIDER=
# Captcha Secret Key
SECRET_KEY=
# Captcha Site key
SITE_KEY=
CAPTCHA_TEMPLATE_PATH=/data/etc/crowdsec/captcha.html
CAPTCHA_EXPIRATION=3600
APPSEC_URL=http://127.0.0.1:7422
APPSEC_FAILURE_ACTION=deny

what i have to change?

[Zoey2936]

https://github.com/ZoeyVid/NPMplus/releases/tag/2024-10-21-r1

[Zoey2936]

please read the changelogs

[Raxiel1987]

okay

so i have to delete that file and i will recreate it

i try :D

[Raxiel1987]

i've changed these values to :
APPSEC_FAILURE_ACTION=deny
APPSEC_CONNECT_TIMEOUT=6000
APPSEC_SEND_TIMEOUT=90000
APPSEC_PROCESS_TIMEOUT=60000
ALWAYS_SEND_TO_APPSEC=false
SSL_VERIFY=true

no luck always timeout

[Raxiel1987]

the error starts when i try to open the yootheme editor for build pages
also the other things works (slowly)

[Zoey2936]

logs....

[Raxiel1987]

there are no logs

[Zoey2936]

then I can't help you

[Raxiel1987]

2024-11-28T18:15:28.886940467Z 2024/11/28 19:15:28 [warn] 22769#22769: *4923 an upstream response is buffered to a temporary file /usr/local/nginx/proxy_temp/0/01/0000000010 while reading upstream, client: x.x.x.x, server: lxxxxx, request: "GET /wp-content/themes/twentytwentyfour/screenshot.png?ver=1.3 HTTP/2.0", upstream: "http://10.1.1.225:80/wp-content/themes/twentytwentyfour/screenshot.png?ver=1.3", host: "lxxxxx", referrer: "https://lxxxxx/wp-admin/themes.php"

2024-11-28T18:15:38.574021792Z 2024/11/28 19:15:38 [warn] 22769#22769: *4923 a client request body is buffered to a temporary file /usr/local/nginx/client_body_temp/0000000011 while reading request body, client: x.x.x.x, server: lxxxxx, request: "POST /wp-admin/update.php?action=upload-theme HTTP/2.0", host: "lxxxxx", referrer: "https://lxxxxx/wp-admin/theme-install.php?browse=popular"

2024-11-28T18:16:40.944249660Z 2024/11/28 19:16:40 [warn] 22769#22769: *4923 a client request body is buffered to a temporary file /usr/local/nginx/client_body_temp/0000000012 while reading request body, client: x.x.x.x, server: lxxxxx, request: "POST /wp-admin/admin-ajax.php?action=kernel&p=theme%2Fstyle HTTP/2.0", host: "lxxxxx", referrer: "https://lxxxxxo.it/wp-admin/admin-ajax.php?action=kernel&p=customizer"

these are the only logs from that website 

in firefox instead i see a messagge when open the builder says:
Your session has expired. Please reload page to start working.

[Zoey2936]

you can try to disable proxy buffering using the existing env option

[Raxiel1987]

if i disable proxy buffering what this involves?

anyway i try

[Raxiel1987]

even with disabled proxy buffering is not working..
i HATE wordpress (not only for this) i will fuck wordpress and install joomla ( that works well )
for this client i will use an alternate server to build the website