How to Install and Configure CrowdSec on Ubuntu for Modern Collaborative Intrusion Prevention

Public-facing Linux servers face constant automated port scans, brute-force SSH authentication attempts, credential stuffing, and web exploit probes. While traditional tools like Fail2ban parse local log files to ban offending IP addresses individually, they remain reactive and isolated. CrowdSec is a modern, open-source security engine written in Go that introduces a collaborative threat intelligence architecture. When an attacker probes one CrowdSec user’s server, the malicious IP address is analysed, verified by a central consensus engine, and distributed to protect all other community members before the attacker can strike them. This guide explains how to install, configure, and manage CrowdSec and its firewall remediation bouncer on Ubuntu.

Understanding the CrowdSec Architecture

CrowdSec operates as a lightweight, modular security framework divided into three distinct layers:

• Parsers and Scenarios: The core CrowdSec daemon reads system logs (such as /var/log/auth.log, Nginx access logs, or systemd journal logs) using declarative YAML parsers. Scenarios detect attack patterns like SSH brute force, HTTP crawl spam, or SQL injection attempts.
• Local API (LAPI) and Community Consensus: When a scenario triggers an alert, CrowdSec submits the telemetry hash to the global consensus engine. If an IP exhibits malicious behaviour across multiple nodes, it is added to the global blocklist shared with all participants.
• Remediation Bouncers: The detection agent does not block traffic itself; instead, it delegates enforcement to specialized standalone plugins called bouncers. Bouncers can block IPs at the firewall level (via nftables or iptables), challenge visitors with CAPTCHAs, or reject requests at the reverse proxy layer (such as Nginx, Traefik, or Caddy).

Step 1: Installing CrowdSec on Ubuntu

CrowdSec provides an official package repository for Ubuntu LTS releases. Run the official setup script to add the repository and GPG signing keys:

curl -s https://install.crowdsec.net | sudo bash

Update your local package lists and install the core CrowdSec security engine:

sudo apt update && sudo apt install -y crowdsec

During installation, CrowdSec automatically scans your system for installed services (like OpenSSH, Nginx, or Apache) and configures the relevant collection profiles out of the box.

Verify that the CrowdSec service is active and running:

sudo systemctl status crowdsec

Step 2: Installing the Firewall Remediation Bouncer

To drop malicious network packets before they reach your system daemons, install the iptables / nftables firewall bouncer:

sudo apt install -y crowdsec-firewall-bouncer-iptables

The installer automatically registers an API token with CrowdSec’s Local API and activates the bouncer systemd daemon. Verify its status:

sudo systemctl status crowdsec-firewall-bouncer

Step 3: Managing Hub Collections and Scenarios

CrowdSec manages threat intelligence via its command-line administration tool, cscli. The CrowdSec Hub offers hundreds of community-maintained collections tailored to specific server workloads.

Listing Installed Collections

sudo cscli collections list

Installing Web Server Protections (Nginx / Apache)

If your Ubuntu server hosts web applications, install specialized scenarios to block common HTTP exploits:

sudo cscli collections install crowdsecurity/nginx
sudo cscli collections install crowdsecurity/http-cve
sudo systemctl reload crowdsec

Step 4: Monitoring Active Alerts and Decisions

Whenever an external client exceeds authentication thresholds or behaves suspiciously, CrowdSec issues a decision (a temporary or permanent ban applied by the firewall bouncer).

Viewing Active IP Bans

sudo cscli decisions list

This command returns a table detailing the banned IP address, country of origin, triggering scenario (such as crowdsecurity/ssh-bf), and the remaining ban duration (defaulting to 4 hours).

Inspecting Historical Attack Alerts

sudo cscli alerts list

Step 5: Testing and Manually Managing Bans

To verify that your firewall bouncer properly drops connections, you can manually simulate an administrative ban on an IP:

Manually Banning an IP Address

sudo cscli decisions add --ip 198.51.100.42 --duration 1h --reason "Manual test"

Manually Removing a Ban

sudo cscli decisions delete --ip 198.51.100.42

Step 6: Enrolling Your Node into the CrowdSec Console

CrowdSec provides a free web-based management dashboard called the CrowdSec Console, allowing administrators to monitor security metrics, receive alerts, and manage multiple servers centrally:

1. Create a free account at app.crowdsec.net.
2. Navigate to Instances and click Add Instance.
3. Copy your unique enrollment command and run it on your Ubuntu server:

   sudo cscli console enroll <your-token-key>

4. Reload the CrowdSec daemon:

   sudo systemctl restart crowdsec

Your server will now synchronize alerts with your cloud dashboard while pulling down prioritized community blocklists automatically.