CrowdSec Intrusion Detection

Summary

A public server was under continuous SSH brute-force attempts and the existing Fail2ban only blocked single IPs, so CrowdSec was deployed with community threat intel, integrating bouncers on Nginx and SSH.

System Context

• •1 public-facing VPS running Nginx reverse proxy + non-default SSH port
• •Existing logs: ~200 SSH brute-force attempts/day per auth.log
• •Ran alongside Fail2ban to compare effectiveness

Checklist

• ☑cscli metrics shows accurate real-time block counts
• ☑Bouncer blocks IPs found in the CrowdSec community blocklist
• ☑Compared brute-force attempts that slipped through: CrowdSec vs Fail2ban over 48h
• ☑No false positives against legitimate traffic (internal IP allowlist checked)

Commands

curl -s https://install.crowdsec.net | sudo sh

cscli collections install crowdsecurity/linux

cscli collections install crowdsecurity/nginx

cscli bouncers add nginx-bouncer

Conclusion

CrowdSec's community-driven threat intelligence significantly reduces brute-force attempts within hours of deployment. The bouncer ecosystem integrates well with existing infrastructure.