CrowdSec: Block Attackers Before They Hit Your Apps

Within hours of deploying a new server on the public internet, automated scanners will probe it. They will try common passwords on SSH. They will scan for known vulnerabilities in web applications. They will attempt SQL injection and cross-site scripting on every form. CrowdSec detects and blocks these attacks before they reach your applications.

How CrowdSec Works

CrowdSec is a behaviour-based intrusion prevention system. It watches server logs (SSH, Nginx, and application logs) for patterns that indicate an attack. When it detects a pattern, such as repeated failed SSH login attempts, it blocks the attacking IP address at the firewall level. The block is local to your server.

What makes CrowdSec different from traditional fail2ban is the community component. When an IP address attacks your server, CrowdSec reports it to a central community database. When that same IP address attacks someone else's server, CrowdSec blocks it preemptively on your server based on the community's collective experience. Attackers do not get a free shot at every server individually.

What CrowdSec Blocks

Out of the box, CrowdSec detects and blocks:

• SSH brute force: Repeated failed logins. Block the IP after a configurable number of attempts.
• Web application attacks: SQL injection, cross-site scripting, path traversal, and command injection attempts against your web applications.
• HTTP scraping and probing: Automated tools scanning for WordPress vulnerabilities, exposed configuration files, and sensitive paths.
• DDoS patterns: Unusually high request rates from a single IP.

Custom scenarios can be written to detect application-specific attacks. If your CRM logs failed login attempts, CrowdSec can monitor those logs and block IPs that exhibit brute-force behaviour against your CRM.

Setup in 15 Minutes

1. Deploy the CrowdSec container: The official Docker image starts with a single docker-compose.yml. It installs the CrowdSec engine and the firewall bouncer.
2. Configure log sources: Point CrowdSec at your Nginx access and error logs, your SSH authentication log, and any application logs you want to monitor.
3. Enable the community blocklist: Subscribe to the community threat intelligence feed. Your server now blocks IPs that have attacked other CrowdSec users.
4. Check the dashboard: CrowdSec includes a web dashboard that shows active decisions (blocked IPs), alerts, and metrics. You can see exactly what attacks are being blocked and how frequently.

False Positives and Safe Unblocking

CrowdSec blocks are temporary by default, typically four hours. This means if a legitimate user triggers a false positive, the block expires automatically. For permanent blocks of confirmed malicious IPs, those are managed separately. You can also whitelist IP addresses that should never be blocked, such as your office IP or your VPN IP.

The community threat list is conservative. IPs are only added after confirmed malicious behaviour across multiple CrowdSec instances. False positives from the community list are rare.

Why CrowdSec Over fail2ban

fail2ban is the traditional tool for blocking brute-force attacks. It works by parsing log files and adding firewall rules. CrowdSec does the same thing but adds:

• Community intelligence: IPs that attack others are blocked on your server before they attack you.
• Modern architecture: Written in Go, lighter than fail2ban's Python implementation, and designed for containerised environments.
• Centralised management: If you run multiple servers, CrowdSec can be configured with a central API so that a block on one server propagates to all your servers within seconds.
• Better parsing: CrowdSec understands more log formats natively and requires less custom configuration to be effective.

For a self-hosted stack exposed to the internet, CrowdSec is not optional. It is the first line of defence against the automated attacks that every server receives, every day, continuously.

VPS1 deploys CrowdSec on every managed server by default. We configure it to monitor your specific applications and connect it to the community threat feed. The automated attacks never reach your applications.