Skip to main content
Back to Category

CrowdSec Setup: Community-Driven Security Engine

CrowdSec installation, bouncer configuration, attack detection, IP blocking, dashboard, collection and scenario management.

Read time: 15 min Monitoring
crowdsecsecurityidsattack detectionfirewalldockercommunity
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

CrowdSec Setup: Community-Driven Security Engine

CrowdSec is a community-driven open-source security engine. It detects attacks through log analysis and provides proactive protection with threat intelligence shared by the community. It can be considered a modern and scalable alternative to Fail2ban.

What is CrowdSec?

Key features of CrowdSec:

  • Log Analysis: Real-time system log analysis
  • Community Intelligence: Global threat database sharing
  • Bouncer System: Blocking at different layers (firewall, Nginx, Cloudflare)
  • Scenario-Based: YAML-based attack scenarios
  • Collections: Ready-made security rule packages
  • Dashboard: Web-based management panel
  • API-Based: REST API integration
  • Lightweight: Low resource consumption

Installation

Installation with Package Manager

hljs bash
# Add CrowdSec repository
curl -s https://install.crowdsec.net | sudo sh

# Install CrowdSec
sudo apt install crowdsec -y

# Install firewall bouncer
sudo apt install crowdsec-firewall-bouncer-iptables -y

# Service status
sudo systemctl status crowdsec
sudo systemctl status crowdsec-firewall-bouncer

Docker Installation

hljs yaml
# docker-compose.yml
version: '3.8'
services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    ports:
      - "8080:8080"
      - "6060:6060"
    volumes:
      - crowdsec_config:/etc/crowdsec
      - crowdsec_data:/var/lib/crowdsec/data
      - /var/log:/var/log:ro
      - /var/log/nginx:/var/log/nginx:ro
    environment:
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd

volumes:
  crowdsec_config:
  crowdsec_data:
hljs bash
docker compose up -d

Basic Configuration

Collection Management

Collections are packages containing parsers, scenarios, and postoverflow rules for a specific service:

hljs bash
# List installed collections
sudo cscli collections list

# Install collections
sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/sshd
sudo cscli collections install crowdsecurity/apache2
sudo cscli collections install crowdsecurity/wordpress
sudo cscli collections install crowdsecurity/http-cve

# Update all hub items
sudo cscli hub update
sudo cscli hub upgrade

Scenario Management

Scenarios are YAML files that define specific attack patterns:

hljs bash
# List scenarios
sudo cscli scenarios list

# Install scenarios
sudo cscli scenarios install crowdsecurity/ssh-bf
sudo cscli scenarios install crowdsecurity/http-crawl-non_statics
sudo cscli scenarios install crowdsecurity/http-bad-user-agent
sudo cscli scenarios install crowdsecurity/http-probing

# Inspect scenario
sudo cscli scenarios inspect crowdsecurity/ssh-bf

Parser Management

hljs bash
sudo cscli parsers list
sudo cscli parsers install crowdsecurity/sshd-logs
sudo cscli parsers install crowdsecurity/nginx-logs

Bouncer Configuration

Firewall Bouncer (iptables/nftables)

hljs bash
sudo apt install crowdsec-firewall-bouncer-iptables -y
sudo nano /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
hljs yaml
mode: iptables
update_frequency: 10s
api_url: http://localhost:8080/
api_key: YOUR_API_KEY
deny_action: DROP
deny_log: true
deny_log_prefix: "crowdsec: "

Nginx Bouncer

hljs bash
sudo apt install crowdsec-nginx-bouncer -y
sudo cscli bouncers add nginx-bouncer
sudo nano /etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf
hljs ini
API_URL=http://localhost:8080/
API_KEY=YOUR_BOUNCER_API_KEY
CACHE_EXPIRATION=1
UPDATE_FREQUENCY=10

Docker Bouncer

hljs yaml
services:
  bouncer-firewall:
    image: crowdsecurity/crowdsec-firewall-bouncer-nftables:latest
    container_name: crowdsec-firewall-bouncer
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./crowdsec-firewall-bouncer.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
    depends_on:
      - crowdsec

Decision Management

hljs bash
# List active decisions
sudo cscli decisions list

# Manually ban an IP
sudo cscli decisions add --ip 1.2.3.4 --reason "Manual ban" --type ban --duration 24h

# Ban IP range
sudo cscli decisions add --range 1.2.3.0/24 --reason "Subnet ban" --type ban

# Remove decision
sudo cscli decisions delete --ip 1.2.3.4

# Clear all decisions
sudo cscli decisions delete --all

Alert Management

hljs bash
sudo cscli alerts list
sudo cscli alerts inspect ALERT_ID
sudo cscli alerts delete --all

CrowdSec Console (Dashboard)

hljs bash
# Enroll to Console
sudo cscli console enroll YOUR_ENROLLMENT_KEY
sudo systemctl restart crowdsec

Dashboard access: https://app.crowdsec.net

Dashboard features:

  • Real-time attack map
  • Blocked IPs and statistics
  • Scenario and collection management
  • Bouncer status monitoring
  • Alert history

Custom Scenario Creation

hljs yaml
# /etc/crowdsec/scenarios/custom-brute-force.yaml
type: leaky
name: custom/brute-force
description: "Custom brute force detection"
filter: "evt.Meta.log_type == 'ssh_failed-auth'"
groupby: evt.Meta.source_ip
capacity: 5
leakspeed: 10m
blackholeduration: 4h
labels:
  service: ssh
  type: brute_force
  remediation: true
hljs bash
sudo systemctl reload crowdsec

Whitelist Configuration

hljs yaml
# /etc/crowdsec/parsers/s02-enrich/whitelist.yaml
name: custom/whitelist
description: "Trusted IPs"
whitelist:
  reason: "Trusted IP addresses"
  ip:
    - "192.168.1.0/24"
    - "10.0.0.0/8"
    - "1.2.3.4"
  expression:
    - evt.Meta.source_ip startsWith '172.16.'

Prometheus Metrics

hljs bash
sudo cscli metrics
curl http://localhost:6060/metrics

Grafana dashboard: Dashboard ID 15620

Update

hljs bash
sudo apt update
sudo apt upgrade crowdsec crowdsec-firewall-bouncer-iptables
sudo cscli hub update
sudo cscli hub upgrade

# Docker update
docker compose pull
docker compose up -d

Logs and Debug

hljs bash
sudo tail -f /var/log/crowdsec.log
sudo tail -f /var/log/crowdsec-firewall-bouncer.log
sudo cscli config show
sudo cscli explain --file /var/log/auth.log --type syslog

By installing CrowdSec on your REXE servers, you can benefit from community-driven security protection. Unlike Fail2ban, CrowdSec can proactively block IPs that haven't even attacked your server yet, thanks to global threat intelligence sharing.

Frequently Asked Questions

What is the difference between CrowdSec and Fail2ban?

CrowdSec shares community-driven threat intelligence, meaning attacker IPs detected by other users are automatically blocked on your server too. Fail2ban only performs local log analysis. CrowdSec has a more modern, API-based, and scalable architecture. The bouncer system allows blocking at different layers (firewall, Nginx, Cloudflare).

CrowdSec doesn't seem to be blocking anything after installation.

Check that the bouncer is installed and running: 'sudo cscli bouncers list'. Verify the API key is correctly configured for the firewall bouncer. Check that log files are readable by CrowdSec. Review metrics with 'sudo cscli metrics'. Verify collections are properly installed: 'sudo cscli collections list'.

My own IP was accidentally blocked, how do I remove it?

Remove the IP from the block list: 'sudo cscli decisions delete --ip YOUR_IP'. For a permanent solution, add it to the whitelist: add your IP to /etc/crowdsec/parsers/s02-enrich/whitelist.yaml and reload with 'sudo systemctl reload crowdsec'.

How do I connect to CrowdSec Console?

Create a free account at https://app.crowdsec.net. Get the enrollment key. Run 'sudo cscli console enroll YOUR_KEY' on the server. Approve the server in the Console. Restart the service: 'sudo systemctl restart crowdsec'.

How do I monitor Docker container logs with CrowdSec?

Mount Docker container logs as volumes to CrowdSec. Add volume definitions like '/var/log/nginx:/var/log/nginx:ro' in docker-compose.yml. Install the relevant collection (e.g., crowdsecurity/nginx). Define the log source in acquis.yaml.

CrowdSec is generating too many false positives.

Update the whitelist configuration. Adjust scenario parameters (increase capacity and leakspeed values). Review alerts with 'sudo cscli alerts list' to identify false positives. Create custom scenarios with more specific rules. Use postoverflow rules to filter false positives.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps