Skip to content

CrowdSec: a rejected console enroll key stays saved #8221

Closed
Bug
Closed
CrowdSec: a rejected console enroll key stays saved#8221
Bug
Assignees
stephdl
Labels
verifiedAll test cases were verified successfully
Milestone
NethServer 8.11

Description

@stephdl
stephdl
opened on Oct 9, 2026

Steps to reproduce

  • Open CrowdSec > Blocklists > Community blocklist, with "Central API and signal sharing" enabled.
  • Type a wrong value in "Enroll key" and save. The page shows an invalid key error, as expected.
  • Reload the page.
  • Save again without changing anything.

Expected behavior

A rejected key is not saved. Saving again shows the same error.

Actual behavior

The rejected key is saved anyway. After the reload it shows in the field as if it were valid. Saving again passes without any error, because the key did not change, so it is never checked again.

The phonehome data then reports the instance as enrolled in the CrowdSec console (console_enrolled: true). It also says true when the Central API is turned off after a key was saved, although nothing can reach the console then.

The key is saved before it is checked:
https://github.com/NethServer/ns8-crowdsec/blob/5740724cce2baf8eb45de6c43bd4e944fae47716/imageroot/actions/configure-module/90Enroll_instance#L19-L28

Components

CrowdSec 1.3.0 and 1.4.0-dev.1

See also

Activity

  1. stephdl
    added this to the NethServer 8.10 milestone on Oct 9, 2026
  2. stephdl
    added the
    Bug
    issue type on Oct 9, 2026
  3. stephdl
    added this to NethServeron Oct 9, 2026

  4. stephdl commented on Oct 9, 2026

    @stephdl
    stephdl
    on Oct 9, 2026
    Author

    Fix: NethServer/ns8-crowdsec#223

  5. stephdl
    self-assigned this
    on Oct 9, 2026
  6. DavidePrincipi
    modified the milestones: NethServer 8.10, NethServer 8.11 on Oct 9, 2026

  7. DavidePrincipi commented on Oct 13, 2026

    @DavidePrincipi
    DavidePrincipi
    on Oct 13, 2026
    Member

    @stephdl moved to In Progress since NethServer/ns8-crowdsec#223 is open. Feel free to move it back if that's not right.

  8. stephdl
    added a commit that references this issue on Oct 13, 2026

    fix(enroll): never save an unchecked enroll key (#223)

    5a1a157

  9. stephdl commented on Oct 13, 2026

    @stephdl
    stephdl
    on Oct 13, 2026
    Author

    QA for crowdsec:1.4.1-dev.1

    Install or update to ghcr.io/nethserver/crowdsec:1.4.1-dev.1.
    In the UI, go to CrowdSec > Blocklists > Community blocklist.

    1. Wrong enroll key is not saved

    • Enable "Central API and signal sharing".
    • Type a wrong value in "Enroll key" and save.
    • The field shows an invalid key error.
    • Reload the page. The "Enroll key" field is empty.
    • Type the same wrong key and save again. The error shows again.

    2. Valid enroll key is saved

    • Get an enroll key from https://app.crowdsec.net (Security Engines > Enroll).
    • Paste it in "Enroll key" and save. No error.
    • Reload the page. The key is still there.
    • The instance shows up in the CrowdSec console, waiting to be accepted.

    3. Other settings are kept after a rejected key

    • Start with no enroll key saved.
    • In the same save, turn "Pull community blocklist" off and type a wrong enroll key.
    • The invalid key error shows.
    • Reload the page. "Pull community blocklist" is off and the "Enroll key" field is empty.
    • Add an IP to the allowlist and save. No error.

    4. Phonehome facts

    Run on the node (replace crowdsec1 with the module id):

    api-cli run module/crowdsec1/get-facts | jq .console_enrolled
    • After a rejected key, with no key saved before: false.
    • With a valid key saved and the Central API on: true.
    • Then turn the Central API off and save: false.
  10. stephdl
    assigned
    gsanchietti
    and unassigned
    stephdl
    on Oct 13, 2026
  11. stephdl
    added
    testingPackages are available from testing repositories
    on Oct 13, 2026

  12. gsanchietti commented on Oct 13, 2026

    @gsanchietti
    gsanchietti
    on Oct 13, 2026
    Member

    All test cases have been verified.

  13. gsanchietti
    added
    verifiedAll test cases were verified successfully
    and removed
    testingPackages are available from testing repositories
    on Oct 13, 2026
  14. gsanchietti
    removed their assignment
    on Oct 13, 2026
  15. nethbot
    moved this from Testing to In Progress in NethServeron Oct 13, 2026
  16. stephdl
    self-assigned this
    on Oct 13, 2026

  17. stephdl commented on Oct 14, 2026

    @stephdl
    stephdl
    on Oct 14, 2026
    Author

    released by https://github.com/NethServer/ns8-crowdsec/releases/tag/1.4.1

  18. stephdl
    closed this as completedon Oct 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

verifiedAll test cases were verified successfully

Type

Bug

Projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions