CrowdSec setup

Architecture Overview

flowchart LR
    A[System / App Logs] --> B[CrowdSec Agent / LAPI]
    B -->|Analyzes Patterns| C[Scenario Engine]
    C -->|Trigger Decision| D[Local Remediation Bouncer]
    D -->|Block / Captcha| E[Iptables / Nginx / Cloudflare]
    B <-->|Federated Blocklists| F[CrowdSec Central API / CAPI]

CrowdSec Agent & Local API (LAPI): Parses logs, correlates events, matches scenarios, and issues remediation decisions.
Bouncers (Remediation Components): Standalone plugins that enforce decisions at the firewall (nftables/iptables), reverse proxy (Nginx/Traefik), or CDN level (Cloudflare).
Central API (CAPI): Synchronizes global community blocklists and pushes verified threat telemetry.

Installation & Setup

Add Repository and Install Agent
- Debian / Ubuntu
- RHEL / Rocky Linux
Terminal window
curl -s https://install.crowdsec.net | sudo bash sudo apt-get install crowdsec -y
Terminal window
curl -s https://install.crowdsec.net | sudo bash sudo dnf install crowdsec -y
Verify Acquired Log Sources CrowdSec automatically discovers local services (Nginx, SSH, systemd):
Terminal window
```
sudo cscli collections list
sudo cscli metrics
```
Install Firewall Remediation Bouncer Install the kernel firewall bouncer (nftables or iptables):
Terminal window
```
sudo apt-get install crowdsec-firewall-bouncer-iptables -y
```
The bouncer registers with LAPI and creates an automated kernel drop rule for blocked IPs.

Installing Essential Collections

Collections bundle parsers and behavioral attack scenarios:

# SSH brute force protection
sudo cscli collections install crowdsecurity/sshd

# Web application protection (Nginx, HTTP crawl, bad user agents, CVE scanners)
sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/http-cve
sudo cscli collections install crowdsecurity/base-http-scenarios

# Reload crowdsec to activate
sudo systemctl reload crowdsec

CLI Management & Inspection

Common administrative commands with cscli:

# View active ban decisions
sudo cscli decisions list

# Manually ban an abusive IP for 24 hours
sudo cscli decisions add --ip 198.51.100.42 --duration 24h --reason "targeted scanning"

# Remove a ban
sudo cscli decisions delete --ip 198.51.100.42

# Check alerts and telemetry
sudo cscli alerts list

Integrating with Reverse Proxies (Nginx Bouncer)

To return custom 403 or challenge pages rather than dropping TCP connections at the firewall:

sudo apt-get install crowdsec-nginx-bouncer -y

This installs Lua-based integration directly into /etc/nginx/conf.d/crowdsec.conf, intercepting HTTP requests before they reach application upstreams.