CrowdSec Setup: Community-Driven Security Engine

CrowdSec is a community-driven open-source security engine. It detects attacks through log analysis and provides proactive protection with threat intelligence shared by the community. It can be considered a modern and scalable alternative to Fail2ban.

What is CrowdSec?

Key features of CrowdSec:

Log Analysis: Real-time system log analysis
Community Intelligence: Global threat database sharing
Bouncer System: Blocking at different layers (firewall, Nginx, Cloudflare)
Scenario-Based: YAML-based attack scenarios
Collections: Ready-made security rule packages
Dashboard: Web-based management panel
API-Based: REST API integration
Lightweight: Low resource consumption

Installation

Installation with Package Manager

hljs bash

# Add CrowdSec repository
curl -s https://install.crowdsec.net | sudo sh

# Install CrowdSec
sudo apt install crowdsec -y

# Install firewall bouncer
sudo apt install crowdsec-firewall-bouncer-iptables -y

# Service status
sudo systemctl status crowdsec
sudo systemctl status crowdsec-firewall-bouncer

Docker Installation

hljs yaml

# docker-compose.yml
version: '3.8'
services:
  crowdsec:
    image: crowdsecurity/crowdsec:latest
    container_name: crowdsec
    restart: unless-stopped
    ports:
      - "8080:8080"
      - "6060:6060"
    volumes:
      - crowdsec_config:/etc/crowdsec
      - crowdsec_data:/var/lib/crowdsec/data
      - /var/log:/var/log:ro
      - /var/log/nginx:/var/log/nginx:ro
    environment:
      - COLLECTIONS=crowdsecurity/linux crowdsecurity/nginx crowdsecurity/sshd

volumes:
  crowdsec_config:
  crowdsec_data:

hljs bash

docker compose up -d

Basic Configuration

Collection Management

Collections are packages containing parsers, scenarios, and postoverflow rules for a specific service:

hljs bash

# List installed collections
sudo cscli collections list

# Install collections
sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/sshd
sudo cscli collections install crowdsecurity/apache2
sudo cscli collections install crowdsecurity/wordpress
sudo cscli collections install crowdsecurity/http-cve

# Update all hub items
sudo cscli hub update
sudo cscli hub upgrade

Scenario Management

Scenarios are YAML files that define specific attack patterns:

hljs bash

# List scenarios
sudo cscli scenarios list

# Install scenarios
sudo cscli scenarios install crowdsecurity/ssh-bf
sudo cscli scenarios install crowdsecurity/http-crawl-non_statics
sudo cscli scenarios install crowdsecurity/http-bad-user-agent
sudo cscli scenarios install crowdsecurity/http-probing

# Inspect scenario
sudo cscli scenarios inspect crowdsecurity/ssh-bf

Parser Management

hljs bash

sudo cscli parsers list
sudo cscli parsers install crowdsecurity/sshd-logs
sudo cscli parsers install crowdsecurity/nginx-logs

Bouncer Configuration

Firewall Bouncer (iptables/nftables)

hljs bash

sudo apt install crowdsec-firewall-bouncer-iptables -y
sudo nano /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml

hljs yaml

mode: iptables
update_frequency: 10s
api_url: http://localhost:8080/
api_key: YOUR_API_KEY
deny_action: DROP
deny_log: true
deny_log_prefix: "crowdsec: "

Nginx Bouncer

hljs bash

sudo apt install crowdsec-nginx-bouncer -y
sudo cscli bouncers add nginx-bouncer
sudo nano /etc/crowdsec/bouncers/crowdsec-nginx-bouncer.conf

hljs ini

API_URL=http://localhost:8080/
API_KEY=YOUR_BOUNCER_API_KEY
CACHE_EXPIRATION=1
UPDATE_FREQUENCY=10

Docker Bouncer

hljs yaml

services:
  bouncer-firewall:
    image: crowdsecurity/crowdsec-firewall-bouncer-nftables:latest
    container_name: crowdsec-firewall-bouncer
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - ./crowdsec-firewall-bouncer.yaml:/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
    depends_on:
      - crowdsec

Decision Management

hljs bash

# List active decisions
sudo cscli decisions list

# Manually ban an IP
sudo cscli decisions add --ip 1.2.3.4 --reason "Manual ban" --type ban --duration 24h

# Ban IP range
sudo cscli decisions add --range 1.2.3.0/24 --reason "Subnet ban" --type ban

# Remove decision
sudo cscli decisions delete --ip 1.2.3.4

# Clear all decisions
sudo cscli decisions delete --all

Alert Management

hljs bash

sudo cscli alerts list
sudo cscli alerts inspect ALERT_ID
sudo cscli alerts delete --all

CrowdSec Console (Dashboard)

hljs bash

# Enroll to Console
sudo cscli console enroll YOUR_ENROLLMENT_KEY
sudo systemctl restart crowdsec

Dashboard access: https://app.crowdsec.net

Dashboard features:

Real-time attack map
Blocked IPs and statistics
Scenario and collection management
Bouncer status monitoring
Alert history

Custom Scenario Creation

hljs yaml

# /etc/crowdsec/scenarios/custom-brute-force.yaml
type: leaky
name: custom/brute-force
description: "Custom brute force detection"
filter: "evt.Meta.log_type == 'ssh_failed-auth'"
groupby: evt.Meta.source_ip
capacity: 5
leakspeed: 10m
blackholeduration: 4h
labels:
  service: ssh
  type: brute_force
  remediation: true

hljs bash

sudo systemctl reload crowdsec

Whitelist Configuration

hljs yaml

# /etc/crowdsec/parsers/s02-enrich/whitelist.yaml
name: custom/whitelist
description: "Trusted IPs"
whitelist:
  reason: "Trusted IP addresses"
  ip:
    - "192.168.1.0/24"
    - "10.0.0.0/8"
    - "1.2.3.4"
  expression:
    - evt.Meta.source_ip startsWith '172.16.'

Prometheus Metrics

hljs bash

sudo cscli metrics
curl http://localhost:6060/metrics

Grafana dashboard: Dashboard ID 15620

Update

hljs bash

sudo apt update
sudo apt upgrade crowdsec crowdsec-firewall-bouncer-iptables
sudo cscli hub update
sudo cscli hub upgrade

# Docker update
docker compose pull
docker compose up -d

Logs and Debug

hljs bash

sudo tail -f /var/log/crowdsec.log
sudo tail -f /var/log/crowdsec-firewall-bouncer.log
sudo cscli config show
sudo cscli explain --file /var/log/auth.log --type syslog

By installing CrowdSec on your REXE servers, you can benefit from community-driven security protection. Unlike Fail2ban, CrowdSec can proactively block IPs that haven't even attacked your server yet, thanks to global threat intelligence sharing.

CrowdSec Setup: Community-Driven Security Engine

Table of Contents