CrowdSec Intrusion Prevention in Practice: Community Threat-Intel Cooperative Defense Deploy Guide

CrowdSec open-source IPS deploy in practice: Agent log parsing, scenario detection, Bouncer firewall bans, and community threat-intel cooperative defense. Full config and verification.

Scope: This tutorial covers CrowdSec IPS deployment on servers running Nginx, Apache, SSH, and other ingress services. Community threat intel auto-bans malicious IPs. For Linux admins and security ops fighting brute force, port scans, and vuln probes.

Prerequisites

• OS: Debian/Ubuntu (this tutorial uses Ubuntu 22.04) or CentOS 7+, root required
• Nginx installed or SSH running; logs writing normally (systemd-journald or file)
• Host can reach the internet (CrowdSec community API for threat intel)
• Firewall allows business ports 80/443; temporarily allow 8080 during install (bouncer API)

How It Works

CrowdSec is an open-source collaborative IPS. Fail2ban-like idea, modern machinery: local Agent collects and parses logs; built-in Scenarios flag abnormal behavior (SSH brute force, web scans); hits become Decisions; a Bouncer enforces at the data-path layer. Malicious IPs are uploaded anonymously to the community reputation store (CTI). CrowdSec nodes worldwide share ban data. Vs Fail2ban's single-host blacklist, CrowdSec adds: behavior-adaptive detection, IP reputation scoring, community cooperative defense.

Procedure

Step 1: Install CrowdSec

Official one-liner (Ubuntu/Debian):

`curl -s https://install.crowdsec.net | sudo sh`

Confirm Agent is running:

`sudo systemctl status crowdsec
cscli version`

Step 2: Enroll in the Community and Pull Intel

Register a free CrowdSec account to sync the reputation store, then:

`sudo cscli console enroll <ENROLL_KEY>`

List loaded detection scenarios and parsers:

`sudo cscli scenarios list
sudo cscli parsers list`

Step 3: Install the Firewall Bouncer

Most common: cs-firewall-bouncer (nftables/iptables):

`sudo apt install crowdsec-firewall-bouncer-iptables`

Installer asks for a bouncer API key. Or mint one manually:

`sudo cscli bouncers add firewallBouncer`

Restart bouncer so config takes effect:

`sudo systemctl restart crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer`

Step 4: Verify Detection and Ban

List Decisions; confirm malicious IPs are blacklisted:

`sudo cscli decisions list
sudo cscli alerts list`

Tail live logs for bouncer actions:

`sudo journalctl -u crowdsec -f`

Configuration Verification

Two checks: (1) from another host, SSH brute force (e.g. hydra, 5 failed logins); CrowdSec should emit an alert within 1 minute; (2) cscli decisions list shows the IP banned; connecting from that IP should time out or refuse. To unban a test IP:

`sudo cscli decisions delete --ip <TEST_IP>`

FAQ

FAQ1: CrowdSec banned a legit user?

Allowlist. Create: sudo cscli allowlists add my_allowlist. Add IP: sudo cscli allowlists add-item my_allowlist --ip 1.2.3.4. Optionally lower scenario sensitivity (raise SSH brute-force fail threshold).

FAQ2: Bouncer install failed or API key wrong?

Confirm Agent is healthy (sudo cscli hub list with no errors). Delete the old bouncer and re-key: sudo cscli bouncers delete firewallBouncer then cscli bouncers add again. Check api_url and api_key in /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.

Summary

CrowdSec closes the loop: log parse → scenario detect → Bouncer ban, plus community threat intel for cross-node defense. Cuts noise from brute force and scan/probe traffic. Low deploy cost, customizable rules. Good first automated server line. In production, isolate the bouncer API listen port and access control. Run cscli hub update on a schedule to refresh scenarios.