From 54cda9027ab154afb50b3a60cae1df540b6a3eec Mon Sep 17 00:00:00 2001 From: poprhythm Date: Sat, 26 Sep 2026 01:16:48 +0000 Subject: [PATCH] falco: tune gitea-web proxy noise, bound log growth nginx-proxy's routine reverse-proxied traffic to gitea:3000 trips the "Redirect stdout/stdin to network connection" rule every 5-15 min via the same dup3 mechanic as the already-excluded sshd case - not a new attack pattern, just proxied web traffic volume. Scoped to gitea's own fixed internal port so a redirect on any other port from this previously-compromised container still alerts. Also caps falco's own json-file log at 50MB x5 files - it had grown to 1.1GB unbounded (mostly 15s-interval metrics snapshots), which was making `docker logs falco` unreliable for the exact triage step its own alert text points admins to. Claude-Session: https://claude.ai/code/session_01HZQK6jHmdTpFjFZM8FUnqA --- falco/docker-compose.yaml | 5 +++++ falco/rules/tune-noise.yaml | 12 ++++++++++++ 2 files changed, 17 insertions(+) diff --git a/falco/docker-compose.yaml b/falco/docker-compose.yaml index 1d321cc..9f17fe3 100644 --- a/falco/docker-compose.yaml +++ b/falco/docker-compose.yaml @@ -10,6 +10,11 @@ services: image: falcosecurity/falco:0.44.1 container_name: falco restart: always + logging: + driver: json-file + options: + max-size: "50m" + max-file: "5" cap_drop: - all cap_add: diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml index afc07bd..d40902d 100644 --- a/falco/rules/tune-noise.yaml +++ b/falco/rules/tune-noise.yaml @@ -77,11 +77,23 @@ # same dup2-based mechanic. Confirmed at the 2026-09-16 host reboot; will # recur on every container start. Scoped to the image, not proc.name, # since this is the container's own /init script. +# - gitea web (not sshd this time): nginx-proxy's ordinary reverse-proxied +# HTTP traffic to gitea's own listen port hits the same dup3-onto-socket +# mechanic as the SSH case above, just for the web server instead of SSH. +# Confirmed 2026-09-25/26 firing every 5-15 min, always container=gitea, +# command="gitea web", user=git, fd.lport=3000 (gitea's fixed internal +# port, not internet-reachable directly - only nginx-proxy on +# npm-network can reach it) - i.e. every one of these traced to normal +# proxied web traffic volume, not a new pattern. Scoped to gitea's own +# listen port specifically, not the whole image or process, so a redirect +# on any *other* port from this container (still a real anomaly for a +# previously-compromised service) still gets flagged. - macro: user_known_stand_streams_redirect_activities condition: > (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session)) or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh") or (container.image.repository = "rommapp/romm" and proc.cmdline = "bash /init") + or (container.image.repository = "docker.gitea.com/gitea" and proc.cmdline = "gitea web" and fd.lport = 3000) # "Clear Log Activities" false-positive: lsyncd (host systemd service, not a # container - running since 2026-07-29) truncates its own status file,