CrowdSec for Linux Server Protection: Collaborative Threat Blocking

CrowdSec analyzes logs locally, detects attack patterns, and can block offenders through firewall bouncers. Unlike isolated deny lists, CrowdSec shares threat signals across its community — so your server benefits from attacks seen elsewhere. It complements Fail2ban and fits well on VPS and dedicated Linux hosts.

Prerequisites

• Ubuntu 22.04+ or Debian 12 with SSH and a web server (Nginx/Apache)
• Root or sudo access and outbound HTTPS for hub enrollment
• UFW, nftables, or iptables available for the firewall bouncer

Step 1: Install CrowdSec

curl -s https://install.crowdsec.net | sudo bash
sudo apt update
sudo apt install -y crowdsec
sudo systemctl enable --now crowdsec
sudo cscli version

Step 2: Install Core Collections

Collections bundle parsers, scenarios, and post-overflow actions for common stacks.

sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/sshd
sudo cscli collections install crowdsecurity/nginx
sudo systemctl reload crowdsec

Step 3: Enroll with CrowdSec Console (Recommended)

sudo cscli console enroll
# Follow the URL to link the machine and enable community blocklists

Step 4: Install and Configure Firewall Bouncer

sudo apt install -y crowdsec-firewall-bouncer-iptables
sudo systemctl enable --now crowdsec-firewall-bouncer-iptables
sudo systemctl status crowdsec-firewall-bouncer-iptables --no-pager

Step 5: Verify Log Acquisition

sudo cscli metrics
sudo cscli decisions list
sudo journalctl -u crowdsec -n 50 --no-pager

Step 6: Simulate SSH Brute Force (Lab Only)

From a separate test machine, generate failed SSH logins against a non-production host to confirm detection.

# On the protected server after failed attempts:
sudo cscli decisions list
sudo cscli alerts list

Step 7: Whitelist Trusted IPs

sudo cscli parsers install crowdsecurity/whitelists
# Add your office or VPN egress IP:
sudo cscli decisions add --ip 203.0.113.10 --duration 8760h --reason "office-egress"

Step 8: Harden SSH Alongside CrowdSec

# /etc/ssh/sshd_config recommendations:
# PermitRootLogin no
# PasswordAuthentication no
# MaxAuthTries 3
sudo systemctl reload ssh

CrowdSec vs Fail2ban

• CrowdSec — collaborative intelligence, modern hub, multi-service scenarios, API-driven bouncers.
• Fail2ban — mature, simple regex jails, excellent for single-service SSH protection.
• Many teams run both during migration, then consolidate once CrowdSec covers all log sources.

Production Checklist

• Whitelist monitoring probes, CI deploy IPs, and office egress before enabling aggressive community lists.
• Monitor bouncer health — a stopped bouncer means detections without enforcement.
• Review cscli alerts list weekly to tune false positives.
• Keep CrowdSec and collections updated: sudo cscli hub update && sudo cscli hub upgrade.
• Document unblock procedures for on-call when a legitimate IP is banned.

"Collaborative threat blocking works when detections are visible, bouncers are healthy, and trusted IPs are whitelisted before the first false positive locks out your team."