How to Set Up CrowdSec Collaborative Intrusion Prevention on Ubuntu Linux VPS

Why CrowdSec Is the Next-Generation Evolution of Fail2ban

For over fifteen years, Fail2ban has been the standard tool for blocking brute-force attacks on Linux servers. While effective, Fail2ban operates as an isolated island: it only reacts after an attacker targets your specific server, relies on brittle regex expressions, and provides no collective threat intelligence from attacks occurring across the wider internet.

CrowdSec is an open-source, collaborative intrusion prevention system (IPS) written in Go. Operating like a decentralized crowd-sourced cyber defense grid, CrowdSec analyzes system and web server logs using structured YAML behavioral scenarios. When an aggressive botnet or vulnerability scanner attacks any CrowdSec user in the world, that malicious IP address is verified by consensus algorithms and instantly distributed to all CrowdSec nodes globally—blocking attackers before they ever reach your server.

In this cybersecurity tutorial, we will configure CrowdSec on Ubuntu 24.04/22.04 LTS, install firewall remediation bouncers (NFTables/IPTables), configure Nginx web attack detection, and connect to the CrowdSec Console dashboard.

Step 1: Adding CrowdSec Package Repository

Install CrowdSec from the official signed package repository:

# Install prerequisites and download repository script
sudo apt update && sudo apt install -y curl apt-transport-https
curl -s https://packagecloud.io/install/repositories/crowdsecurity/crowdsec/script.deb.sh | sudo bash

# Install CrowdSec Security Engine
sudo apt update && sudo apt install -y crowdsec

# Confirm active status
sudo systemctl status crowdsec --no-pager

Step 2: Installing Remediation Firewall Bouncer

The CrowdSec engine detects attacks; the Bouncer executes active blocking at the Linux kernel firewall layer:

# Install the official NFTables/IPTables firewall bouncer
sudo apt install -y crowdsec-firewall-bouncer-iptables

# Verify bouncer registration
sudo cscli bouncers list

Step 3: Installing Nginx & Web Attack Collections

Protect your web applications from SQL injection, path traversal, WordPress brute force, and aggressive crawler scrapers by installing Hub collections via the cscli CLI:

# Install Nginx log parser and scenario collections
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/http-cve
sudo cscli collections install crowdsecurity/base-http-scenarios
sudo cscli collections install crowdsecurity/whitelist-good-actors

# Reload CrowdSec engine to activate collections
sudo systemctl reload crowdsec

Step 4: Inspecting Real-Time Threat Alerts & Decision Logs

Inspect active bans, triggered attack scenarios, and community blocklist statistics:

# List all currently active IP bans and decisions
sudo cscli decisions list

# Inspect recent detected security alert incidents
sudo cscli alerts list

# View active log acquisition streams
sudo cscli metrics

Step 5: Connecting to CrowdSec Web Console (Optional)

Enrolling your VPS in the free CrowdSec Console provides visual threat maps, CVE alerts, and centralized multi-server management:

# Enroll server with one terminal command
sudo cscli console enroll <YOUR_CONSOLE_TOKEN>
sudo systemctl restart crowdsec

CrowdSec vs Traditional Fail2ban Comparison

Configuring CrowdSec WordPress & Cloudflare Bouncers

Beyond Linux firewall packet drops, CrowdSec offers application-layer bouncers that integrate directly into WordPress and Cloudflare Edge Firewalls:

# Install CrowdSec Cloudflare Bouncer (Blocks bad IPs at Cloudflare Edge before touching VPS)
sudo apt install -y crowdsec-cloudflare-bouncer

# Configure Cloudflare API Key in /etc/crowdsec/bouncers/crowdsec-cloudflare-bouncer.yaml
# Start Cloudflare Bouncer daemon
sudo systemctl enable --now crowdsec-cloudflare-bouncer

Writing Custom Behavioral Security Scenarios

Create tailored detection rules for proprietary API endpoints by writing simple YAML rules in /etc/crowdsec/scenarios/api-flood.yaml:

type: leaky
name: custom/api-flood
description: "Detect aggressive API abuse on sensitive endpoints"
filter: "evt.Meta.service == 'http' && evt.Parsed.request startsWith '/api/v1/auth'"
groupby: evt.Meta.source_ip
capacity: 5
leakspeed: 2s
blackhole: 1m
labels:
  type: brute-force
  remediation: true

CrowdSec Verification & CLI Management

• sudo cscli hub list: View all installed log parsers, scenarios, and collections.
• sudo cscli alerts inspect <alert-id>: Inspect full forensic attack telemetry.

Setting Up CrowdSec Web Application Firewall (AppSec) Component

In addition to log parsing, modern CrowdSec includes an embedded Application Security (AppSec) engine that inspects incoming HTTP request bodies in real time to block OWASP Top 10 vulnerabilities (SQLi, XSS, NoSQLi, RCE, and SSTI) before they ever reach your web application backend:

# Enable AppSec component in CrowdSec
sudo cscli collections install crowdsecurity/appsec-virtual-patching
sudo cscli collections install crowdsecurity/appsec-generic-rules
sudo systemctl reload crowdsec

Automating Threat Reports & Daily Digest Summaries

Generate automated daily security digests of all blocked IP addresses and attack origins:

# Generate daily threat analysis summary
sudo cscli metrics show --since 24h

# Inspect the top offending Autonomous System Numbers (ASNs) and countries
sudo cscli alerts list --limit 50

CrowdSec Threat Intelligence Verification & Hub Best Practices

• Keep Scenarios Updated: Schedule daily cscli hub update && cscli hub upgrade cron jobs to receive the latest CVE signatures.
• Whitelist Trusted DevOps IPs: Always add your home, office, and VPN IP addresses to /etc/crowdsec/parsers/s02-enrich/whitelist.yaml to prevent accidental administrative lockouts.