CrowdSec: collaborative intrusion prevention that shares blocklists

CrowdSec (about 15,000 stars on GitHub) is an open source intrusion prevention system written in Go. It was started in 2020 by the French company CrowdSec SAS and is often introduced as a modern replacement for fail2ban: like fail2ban it reads log files, recognises hostile behaviour such as repeated failed logins, web scanning or port probing, and then blocks the offending address. The difference is the collaborative part. Each installation can send anonymised reports of the attacks it saw to the CrowdSec network, and in return receives a community blocklist of addresses that are currently attacking other participants, so that a server can block an attacker before it ever reaches it.

How it works

The design separates detection from enforcement. The security engine is the core daemon: it parses logs with scenario files from a public hub, keeps a local database of decisions and exposes a small API. Bouncers (now called remediation components) are separate programs that read those decisions and act on them, for example by adding firewall rules through nftables or iptables, returning an error page from Nginx, Traefik or Caddy, or blocking at a cloud load balancer. Because any number of bouncers can follow one engine, a decision taken on a web server can be enforced on the firewall in front of it. The cscli command line tool manages scenarios, lists decisions and shows metrics.

CrowdSec and fail2ban

fail2ban remains a perfectly good tool for a single host with a handful of services. CrowdSec covers the same ground with ready made scenarios for hundreds of applications, supports many log sources at once, understands application level attacks and not only authentication failures, and adds the shared blocklist. The trade off is a larger moving part and an optional connection to a vendor run network; the engine works without it, but then you lose the community data. CrowdSec also runs on Windows and FreeBSD.

How to install it

Packages exist for Debian, Ubuntu, Red Hat based systems, FreeBSD, Windows and Docker. On Debian or Ubuntu the quickest path is the vendor repository followed by the package and a firewall bouncer:

curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec crowdsec-firewall-bouncer-iptables
sudo cscli metrics

The installer detects common services such as SSH and Nginx and enables matching scenarios automatically. The documentation explains how to add a bouncer for your web server or firewall and how to enrol the engine in the console if you want the community blocklist.

Credit

CrowdSec is developed by CrowdSec SAS with a large community that contributes parsers and scenarios to the hub. The engine, the hub content and the official bouncers are published under the MIT licence.