Install CrowdSec: modern alternative to Fail2ban

Introduction

CrowdSec is the new generation of attack protection. Where Fail2ban analyzes logs and bans locally, CrowdSec goes further:

• Local detection: analyzes Nginx, SSH, MySQL logs, etc.
• Bouncer: applies bans (firewall, Nginx, Cloudflare, etc.)
• Collaborative threat intel: anonymized sharing of malicious IPs between all users
• Community: you benefit from attacks others detect (CrowdSec is used by 200000+ machines worldwide)

Two-part architecture: an agent that detects, one or more bouncers that ban.

Prerequisites

• Debian 12 / Ubuntu 22.04+ VPS
• Root access
• At least one service to monitor (SSH minimum)

Step 1: Installation

curl -s https://install.crowdsec.net | sudo sh
sudo apt install -y crowdsec

CrowdSec auto-detects present services (SSH, Nginx, Apache, etc.) and installs appropriate rule collections.

Step 2: Check status

sudo systemctl status crowdsec
sudo cscli metrics

cscli metrics shows acquisitions (log sources), active parsers and scenarios.

Step 3: Inspect installed scenarios

CrowdSec uses scenarios: rules describing malicious behaviors.

sudo cscli scenarios list

Default-installed examples:

• crowdsecurity/ssh-bf: SSH brute-force
• crowdsecurity/http-bad-user-agent: suspicious web bots
• crowdsecurity/http-crawl-non_statics: aggressive crawlers
• crowdsecurity/http-probing: vulnerability scans

Step 4: Test detection

Provoke a fake SSH attack (from another machine than the one you're using):

# On another machine, or use nmap
for i in {1..10}; do ssh nonexistent@YOUR_VPS_IP; done

On the VPS:

sudo cscli alerts list

You'll see an alert for the attacking IP.

Step 5: Install a bouncer (the element that actually bans)

CrowdSec without a bouncer detects but doesn't ban. Install the firewall bouncer:

sudo apt install -y crowdsec-firewall-bouncer-iptables

The bouncer auto-registers with the CrowdSec agent and applies bans via iptables.

Check:

sudo systemctl status crowdsec-firewall-bouncer
sudo cscli bouncers list

Step 6: Bouncer for Nginx (web sites)

If you host a site, the Nginx bouncer is very powerful: it blocks malicious IPs at HTTP level before they reach your app.

sudo apt install -y crowdsec-nginx-bouncer

Follow the interactive wizard which detects your Nginx config and adapts it.

Check:

sudo nginx -t
sudo systemctl reload nginx

Step 7: View banned IPs

sudo cscli decisions list

Shows all active decisions (current bans), with source, duration and scenario.

Step 8: Configure collaborative threat intel (CTI)

Enabled by default. To verify:

sudo cscli capi status

Should show You can successfully interact with Central API (CAPI).

To benefit from community blocklists (IPs already known as malicious by other users), create a free account on https://app.crowdsec.net then:

sudo cscli console enroll YOUR_ENROLLMENT_KEY

The enrollment key is in your CrowdSec dashboard.

Step 9: Whitelist (don't ban certain IPs)

To add your office IP to the whitelist:

sudo nano /etc/crowdsec/parsers/s02-enrich/whitelists.yaml

name: crowdsecurity/whitelists
description: "Whitelist events from your IPs"
whitelist:
  reason: "VeryCloud office"
  ip:
    - "82.26.157.10"
    - "192.168.0.0/24"

Restart:

sudo systemctl reload crowdsec

Step 10: Manually ban an IP

sudo cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual ban"

Unban:

sudo cscli decisions delete --ip 1.2.3.4

Step 11: Local web dashboard (optional)

CrowdSec includes a Metabase dashboard to visualize attacks:

sudo cscli dashboard setup --listen 0.0.0.0

Accessible at http://YOUR_VPS_IP:3000.

⚠️ Restrict port 3000 access via UFW if exposed:

sudo ufw allow from YOUR_FIXED_IP to any port 3000

Step 12: Additional collections

CrowdSec has a collections system (scenario packs). To protect other services:

# Recommended collections
sudo cscli collections install crowdsecurity/wordpress
sudo cscli collections install crowdsecurity/mysql
sudo cscli collections install crowdsecurity/postgresql
sudo cscli collections install crowdsecurity/iptables  # detects port scans

# Reload
sudo systemctl reload crowdsec

List available collections:

sudo cscli collections list -a

Troubleshooting

No detection despite attacks

Check acquisitions:

sudo cscli metrics

If 0 everywhere, CrowdSec doesn't read logs. Check:

sudo cat /etc/crowdsec/acquis.yaml

Adapt log paths if different.

Bouncer doesn't ban

sudo systemctl status crowdsec-firewall-bouncer
sudo cscli bouncers list

Check the bouncer is validated. Otherwise:

sudo cscli bouncers add firewall-bouncer

And re-copy the API key into /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.

Missing logs

CrowdSec reads logs in real-time. If you use systemd-journal (Debian 12), make sure acquisition is in journal mode:

source: journalctl
journalctl_filter:
  - "_SYSTEMD_UNIT=ssh.service"
labels:
  type: syslog

Useful commands

# Detailed metrics
sudo cscli metrics

# General status
sudo cscli capi status
sudo cscli lapi status

# Alerts list
sudo cscli alerts list

# Alert details
sudo cscli alerts inspect ALERT_ID

# Active decisions (bans)
sudo cscli decisions list

# Test if an IP is banned
sudo cscli decisions list --ip 1.2.3.4

# Reload without restart
sudo systemctl reload crowdsec

# Update scenarios/collections
sudo cscli hub update
sudo cscli hub upgrade

Conclusion

CrowdSec is more effective than Fail2ban for most use cases, and radically more modern. It becomes essential for public servers:

• You benefit from worldwide threat intel (new botnets detected in minutes)
• You protect multiple services with a single stack
• Nginx/Cloudflare bouncers block before the attack reaches your app

Going further:

• Configure the Cloudflare bouncer to block IPs at CDN level
• Host a central Local API (LAPI) that aggregates detections from all your VPS
• Integrate alerts with Discord / Slack / email via native notifications

Resources

• Official site: https://www.crowdsec.net
• Documentation: https://docs.crowdsec.net
• Collections hub: https://hub.crowdsec.net