poprhythm
54cda9027a
nginx-proxy's routine reverse-proxied traffic to gitea:3000 trips the "Redirect stdout/stdin to network connection" rule every 5-15 min via the same dup3 mechanic as the already-excluded sshd case - not a new attack pattern, just proxied web traffic volume. Scoped to gitea's own fixed internal port so a redirect on any other port from this previously-compromised container still alerts. Also caps falco's own json-file log at 50MB x5 files - it had grown to 1.1GB unbounded (mostly 15s-interval metrics snapshots), which was making `docker logs falco` unreliable for the exact triage step its own alert text points admins to. Claude-Session: https://claude.ai/code/session_01HZQK6jHmdTpFjFZM8FUnqA
45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
networks:
|
|
default:
|
|
# Falco's own default bridge network, plus netdata's network so netdata
|
|
# can scrape http://falco:8765/metrics by container name.
|
|
netdata_default:
|
|
external: true
|
|
|
|
services:
|
|
falco:
|
|
image: falcosecurity/falco:0.44.1
|
|
container_name: falco
|
|
restart: always
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
cap_drop:
|
|
- all
|
|
cap_add:
|
|
- sys_admin
|
|
- sys_resource
|
|
- sys_ptrace
|
|
security_opt:
|
|
- apparmor:unconfined
|
|
networks:
|
|
- default
|
|
- netdata_default
|
|
ports:
|
|
- "127.0.0.1:8765:8765"
|
|
volumes:
|
|
- /sys/kernel/tracing:/sys/kernel/tracing:ro
|
|
- /var/run/docker.sock:/host/var/run/docker.sock:ro
|
|
- /proc:/host/proc:ro
|
|
- /etc:/host/etc:ro
|
|
- ./config/falco.yaml:/etc/falco/config.d/telemetry.yaml:ro
|
|
- ./rules/miner-detect.yaml:/etc/falco/rules.d/miner-detect.yaml:ro
|
|
- ./rules/miner-pool-ports.yaml:/etc/falco/rules.d/miner-pool-ports.yaml:ro
|
|
- ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
|
|
- ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
|
|
- ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro
|
|
- ./rules/ssh-persistence.yaml:/etc/falco/rules.d/ssh-persistence.yaml:ro
|
|
- ./rules/cloud-metadata-probe.yaml:/etc/falco/rules.d/cloud-metadata-probe.yaml:ro
|
|
- ./rules/db-spawned-process.yaml:/etc/falco/rules.d/db-spawned-process.yaml:ro
|