crowdsec

CrowdSec

CrowdSec detects hostile behavior from logs and HTTP requests, then exposes alerts and decisions through LAPI. The engine alone does not block traffic: install and verify at least one remediation component (bouncer) before claiming protection.

Safety Gate

Before any mutation, confirm the target host/container, scope, backup or rollback, and maintenance window. Prefer read-only inspection and simulation first. Never manually delete decisions, collections, or data without recording the reason and an undo path. Save bouncer keys when created; they are shown once. Use simulation: true while tuning scenarios so detections are observed without enforcement, then verify allowlists before live blocking.

Choose a Deployment

For Debian/Ubuntu, add the CrowdSec repository, install crowdsec, then install a remediation package such as crowdsec-firewall-bouncer-iptables or -nftables. For Docker Compose, expose LAPI (127.0.0.1:8080), metrics (127.0.0.1:6060), and AppSec (127.0.0.1:7422) only to required networks, mount /etc/crowdsec, /var/lib/crowdsec/data, and logs read-only, and pin a reviewed image version. Persist the data directory, mandatory for v1.7.0+. Load the Docker deployment guide for a full compose example and remote-agent caveats.

After installation, verify systemctl status crowdsec (or container health), then cscli version, cscli collections list, acquisition metrics, and bouncer connectivity. Do not expose LAPI or AppSec publicly without an explicit network and authentication design.

The Detection-to-Blocking Workflow

1. Select collections for the actual log format, for example crowdsecurity/linux, sshd, nginx, traefik, or base-http-scenarios.
2. Configure acquisition in /etc/crowdsec/acquis.yaml or acquis.d/; every source needs labels.type so the correct parser runs. Use poll_without_inotify: true for unreliable NFS/SMB or bind mounts and use_time_machine: true for buffered logs.
3. Check parser/scenario hits and unparsed lines with cscli metrics -o json.
4. Use profiles to map alerts to decisions. Keep profiles.yaml.local and remember YAML sequences replace rather than merge.
5. Add a bouncer with cscli bouncers add NAME, store its one-time key securely, and verify cscli bouncers list plus a harmless test decision.
6. Confirm the reverse proxy/firewall is actually enforcing decisions; an alert or LAPI decision alone is not proof of a blocked request.