Who This Is For
Intermediate.
Think of it like a neighbourhood watch that actually shares notes. One house spots a suspicious car circling the block, and now the whole street knows to watch for it too.
What You'll Build
CrowdSec detects SSH or web events and applies an enforceable block through the correct bouncer component.
Prerequisites
- A Linux host with SSH and/or Nginx logs to monitor
Detection vs. Enforcement
CrowdSec's security engine only detects events from logs. A separate bouncer component is what actually enforces a block, pick the right one for the job: a firewall bouncer for host-level protection, or an Nginx bouncer for web applications.
Install CrowdSec
Configure Log Acquisition
Point CrowdSec at your SSH logs, Nginx/reverse-proxy logs, and any Docker logs worth watching, then install the matching collections (e.g. crowdsecurity/sshd, crowdsecurity/nginx).
Install a Bouncer
Test Safely
Trigger a controlled failed-login test from a machine you control, then confirm a decision was issued:
Whitelist Trusted Networks
Carefully whitelist your own internal subnets and remote-access IP so you don't accidentally ban yourself.
Send Alerts
Wire up notifications to Discord, email, or another channel so you actually see what CrowdSec is blocking.
Security & Backup Notes
- If the reverse proxy hides the real client IP from CrowdSec, every ban will target the proxy itself, configure trusted proxy headers correctly first
Troubleshooting
- Engine sees logs but blocks nothing, no bouncer is installed, or it's the wrong type for this traffic
- Wrong bouncer type, a firewall bouncer won't help with application-layer web attacks; use the Nginx bouncer for those
- Reverse proxy hides the actual client IP, configure
X-Forwarded-Forhandling correctly, or bans will hit the proxy - Locking yourself out, always whitelist your own management IPs before testing
Lab Finish Line
CrowdSec detects SSH or web events and applies an enforceable decision through a bouncer.