Self-Hosted Intrusion Prevention: CrowdSec in 15 Minutes

Within hours of deploying a server on the public internet, automated scanners begin probing it for vulnerabilities. They try common SSH passwords, scan for exposed ports, and test for known web application exploits. CrowdSec detects these patterns and blocks the attacking IP addresses at the firewall level automatically.

Step 1: Install CrowdSec

CrowdSec provides an official installation script:

curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash
sudo apt install crowdsec -y

The installation automatically detects your running services (SSH, Nginx, iptables) and configures the appropriate detection scenarios.

Step 2: Install the Firewall Bouncer

The bouncer is the component that actually blocks IPs:

sudo apt install crowdsec-firewall-bouncer-iptables -y

Restart CrowdSec:

sudo systemctl restart crowdsec

CrowdSec is now monitoring your logs and will block attacking IPs automatically. You can verify it is working:

sudo cscli metrics

Step 3: Add Nginx Log Monitoring

CrowdSec automatically detected SSH logs during installation. Add Nginx monitoring manually:

sudo cscli collections install crowdsecurity/nginx

This adds detection for: SQL injection attempts, cross-site scripting, path traversal, command injection, and HTTP probing. Restart CrowdSec to apply:

sudo systemctl restart crowdsec

Step 4: Configure Custom Bans

Ban durations are configurable. The default is a 4-hour ban for most scenarios. For SSH brute force, you might want a longer ban:

# Edit /etc/crowdsec/profiles.yaml
# Increase SSH brute force ban to 24 hours
name: default_ip_remediation_ssh
filters:
  - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
  - type: ban
    duration: 24h

Step 5: Enable the Community Blocklist

CrowdSec's community shares threat intelligence. Enabling this means IPs blocked by other CrowdSec users are preemptively blocked on your server:

sudo cscli console enroll your_email@yourdomain.com

This subscribes your instance to the community threat feed. IPs that attacked other CrowdSec users are blocked on your server before they attempt anything.

Check Your Dashboard

The CrowdSec metrics command shows you what is being blocked:

sudo cscli metrics

You will see categories like: SSH brute force attempts blocked, web application attacks detected, HTTP scanners blocked, and community IPs preemptively blocked. For a typical small business server, CrowdSec blocks hundreds of attacks per week without manual intervention.

CrowdSec is deployed on every VPS1-managed server by default. We configure it for your specific applications and connect it to the community threat feed. The automated attacks never reach your applications, and you never have to think about it.