CrowdSec detects attacks in your logs — SSH brute force, web scanners, credential stuffing — and blocks the offending IPs, much like Fail2Ban. The difference is the “crowd”: installations share signals about attackers, so your server can block IPs that attacked others before they ever reach you.

How it works

CrowdSec has two parts:

  • Security engine (the crowdsec agent): reads logs, parses them, and matches behaviour against scenarios (e.g. “10 failed SSH logins in 1 minute”). Matches become decisions (ban this IP for 4 hours).
  • Bouncers (remediation components): enforce decisions — in the firewall, in Nginx, in Cloudflare, etc.

Detection and blocking are separate, so one engine can feed bouncers on several servers.

1. Install the engine

CrowdSec provides a repository setup script for Debian/Ubuntu and RHEL-family systems (read it first if you prefer):

curl -s https://install.crowdsec.net | sudo sh
sudo apt install -y crowdsec

During installation CrowdSec detects running services (sshd, Nginx, Apache, MySQL…) and installs matching collections — bundles of parsers and scenarios.

sudo systemctl status crowdsec --no-pager
sudo cscli version

2. Add a firewall bouncer

The engine detects but doesn’t block on its own. Install the firewall bouncer:

sudo apt install -y crowdsec-firewall-bouncer-iptables
# or for nftables-based systems:
sudo apt install -y crowdsec-firewall-bouncer-nftables

It registers with the local engine automatically and blocks decided IPs at the firewall level.

sudo cscli bouncers list

3. Check what’s monitored

sudo cscli collections list
sudo cscli metrics

cscli metrics shows which log files are being read, how many lines were parsed, and which scenarios triggered. If a log source shows zero parsed lines, the acquisition config doesn’t match your log paths.

Log sources are defined in /etc/crowdsec/acquis.yaml and /etc/crowdsec/acquis.d/. Example for Nginx:

filenames:
  - /var/log/nginx/access.log
  - /var/log/nginx/error.log
labels:
  type: nginx

For services that log only to journald:

source: journalctl
journalctl_filter:
  - "_SYSTEMD_UNIT=ssh.service"
labels:
  type: syslog

Restart after changes: sudo systemctl restart crowdsec.

4. Install more collections

sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/wordpress
sudo cscli collections install crowdsecurity/http-cve
sudo systemctl reload crowdsec

The CrowdSec Hub lists collections for many services — Postfix, Dovecot, Nextcloud, Vaultwarden, Home Assistant and more.

5. View alerts and decisions

sudo cscli alerts list
sudo cscli decisions list
sudo cscli decisions list --origin CAPI     # blocks received from the community blocklist

Manually ban or unban:

sudo cscli decisions add --ip 192.0.2.66 --duration 24h --reason "manual"
sudo cscli decisions delete --ip 198.51.100.25

6. Whitelist your own IPs

Avoid locking out your office or monitoring systems. Create /etc/crowdsec/parsers/s02-enrich/mywhitelist.yaml:

name: me/whitelist
description: "My trusted IPs"
whitelist:
  reason: "office and monitoring"
  ip:
    - "198.51.100.25"
  cidr:
    - "10.8.0.0/24"
sudo systemctl reload crowdsec

7. Connect to the console (optional)

The CrowdSec web console shows alerts across your servers and manages blocklists. Enroll with the key from your console account:

sudo cscli console enroll <your-key>

Sharing signals with the community is what gives you the community blocklist; review CrowdSec’s privacy documentation to see what’s shared.

Web-level bouncers

Firewall bans block an IP entirely. For websites you may prefer an Nginx or OpenResty bouncer, which can show a captcha instead of dropping the connection — friendlier to users on shared IPs. There are also bouncers for Cloudflare, Traefik and HAProxy.

CrowdSec vs Fail2Ban

Fail2Ban CrowdSec
Detection Regex on log lines Parsers + behavioural scenarios
Shared intelligence No Community blocklist
Remediation Firewall actions Bouncers: firewall, web, CDN…
Multi-server Per server Central engine/API possible
Resource use Very light Light (Go binary)

Both are good. Fail2Ban is simpler for a single server with a few jails — see Fail2Ban. CrowdSec pays off with web-facing services and multiple servers. Don’t run both against the same logs with overlapping bans; pick one.

Troubleshooting

  • No alerts ever — check cscli metrics for parsed lines; fix log paths in acquisition files.
  • You got banned — unban with cscli decisions delete --ip … from the VNC console, then whitelist your IP.
  • Behind Cloudflare or a proxy — logs show the proxy’s IP. Configure real-IP logging in Nginx, or use the Cloudflare bouncer, otherwise CrowdSec may ban the proxy.

CrowdSec complements, not replaces, the basics: SSH keys, a firewall, and the hardening checklist.

  • CrowdSec
  • Security
  • Firewall