CrowdSec on a VPS: Collaborative Threat Intelligence and Modern Fail2ban Replacement

CrowdSec is a modern, open-source intrusion prevention system that improves on Fail2ban in two key ways: it uses a behavior-based detection engine (not just simple regex pattern matching) and participates in a community threat intelligence network — sharing malicious IPs with 500,000+ servers globally. When CrowdSec detects an attack on your VPS, that IP is blocked across the entire CrowdSec community within minutes.

CrowdSec vs Fail2ban

Step 1: Install CrowdSec

<code"># Official installation script
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt install -y crowdsec

# Verify installation
sudo cscli version
sudo systemctl status crowdsec

Step 2: Collections (Detection Scenarios)

<code"># CrowdSec detects attacks using "collections" — bundles of parsers + scenarios
# Default installed: Linux syslog, SSH brute force

# Install collections for your stack:
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/wordpress
sudo cscli collections install crowdsecurity/http-cve   # Known CVE exploitation
sudo cscli collections install crowdsecurity/linux-lpe  # Privilege escalation

# View installed collections
sudo cscli collections list

# Update all collections
sudo cscli hub update
sudo cscli hub upgrade

Step 3: Configure Log Sources

<code">sudo nano /etc/crowdsec/acquis.yaml

<code">---
# SSH logs
filenames:
  - /var/log/auth.log
  - /var/log/syslog
labels:
  type: syslog
---
# Nginx access logs
filenames:
  - /var/log/nginx/access.log
labels:
  type: nginx
---
# Nginx error logs
filenames:
  - /var/log/nginx/error.log
labels:
  type: nginx
---
# WordPress — requires nginx logs and path info
filenames:
  - /var/log/nginx/access.log
labels:
  type: nginx

<code">sudo systemctl restart crowdsec
# Verify CrowdSec is parsing logs:
sudo cscli metrics   # Shows events parsed and scenarios triggered

Step 4: Install Bouncers (The Blocking Component)

CrowdSec separates detection (the agent) from blocking (bouncers). Install the bouncer for your use case:

Firewall Bouncer (Blocks at iptables/nftables level)

<code"># Most efficient — blocks before traffic reaches Nginx
sudo apt install -y crowdsec-firewall-bouncer-iptables

# Configure
sudo nano /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

<code">mode: iptables
update_frequency: 10s
log_mode: file
log_dir: /var/log/
api_url: http://localhost:8080
api_key: YOUR_BOUNCER_API_KEY

<code">sudo systemctl enable crowdsec-firewall-bouncer
sudo systemctl start crowdsec-firewall-bouncer

Nginx Bouncer (Blocks at HTTP level)

<code"># Blocks HTTP requests, can return custom error pages
sudo apt install -y lua-resty-crowdsec

# Or use the standalone Nginx bouncer:
# https://github.com/crowdsecurity/cs-nginx-bouncer

Step 5: Register with CrowdSec Community

<code"># Create a free account at https://app.crowdsec.net/
# Register your server to contribute to and receive community intelligence

sudo cscli console enroll YOUR_ENROLLMENT_KEY

# Benefits after enrollment:
# - Your detected IPs are shared with the community
# - You receive the community blocklist (pre-blocked known attackers)
# - Web dashboard showing your security posture

# Pull the community blocklist manually:
sudo cscli decisions list   # Shows all active bans including community ones

Step 6: Manage Decisions

<code"># View active bans
sudo cscli decisions list

# View recent alerts (detected attacks, not yet banned)
sudo cscli alerts list

# Manually ban an IP
sudo cscli decisions add --ip 198.51.100.1 --reason "Manual ban" --duration 24h

# Ban a subnet
sudo cscli decisions add --range 198.51.100.0/24 --reason "Attacker subnet" --duration 168h

# Unban an IP
sudo cscli decisions delete --ip 198.51.100.1

# Unban all decisions
sudo cscli decisions delete --all

# Add to allowlist (never ban this IP)
sudo nano /etc/crowdsec/whitelists.yaml

<code">name: my_whitelists
description: "Whitelisted IPs"
whitelist:
  reason: "Admin IPs"
  ip:
    - "YOUR_HOME_IP"
    - "YOUR_OFFICE_IP"
  cidr:
    - "10.0.0.0/8"

Step 7: Custom Scenarios

<code">sudo nano /etc/crowdsec/scenarios/custom-wp-brute.yaml

<code">type: leaky
name: custom/wp-login-brute
description: "WordPress login brute force"
filter: "evt.Meta.service == 'http' and evt.Meta.http_path contains '/wp-login.php' and evt.Meta.http_status in ['200', '302']"
leakspeed: "10s"      # One token every 10 seconds
capacity: 5           # Bucket holds 5 tokens
duration: 1h          # Ban duration
labels:
  service: http
  type: brute_force
  remediation: true

Monitoring

<code"># Real-time metrics
sudo cscli metrics

# Scenario trigger counts
sudo cscli scenarios list

# Decisions summary
sudo cscli decisions list | grep -c "ban"   # Total active bans

# Prometheus metrics endpoint (for Grafana)
# CrowdSec exposes metrics at http://localhost:6060/metrics

Getting Started

CrowdSec installs as a systemd service on any Ubuntu VPS at VPS.DO in under 5 minutes. The firewall bouncer blocks at the iptables level — before TCP connections are established, using zero Nginx resources for blocked IPs. After registering with the CrowdSec console, you immediately benefit from the community blocklist: known scanners, brute-forcers, and exploit bots pre-blocked without any local detection required.

Conclusion

CrowdSec modernizes intrusion prevention with behavioral detection, community threat intelligence, and flexible bouncer architecture. The community blocklist alone — IPs currently attacking other CrowdSec-protected servers worldwide — provides immediate value before any local attacks occur. For VPS operators who want more than regex-based pattern matching, CrowdSec is the recommended upgrade path from Fail2ban, with lower false positive rates and automatic threat intelligence sharing.