CrowdSec: log-based protection for a public VPS

Security · Host

Not studied

Added 2026-10-29.

Problem

Nginx and sshd logs are full of password brute-forcing and path scanning. Nobody reads them by hand, and fail2ban rules go stale.

Solution

CrowdSec is "an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs". Its Security Engine parses logs, recognizes attack scenarios and hands blocking decisions to a bouncer (remediation component) — on the firewall or in Nginx. Detection and blocking are separate, so you can start with observation only.

Example

/etc/crowdsec/acquis.yaml — which logs to read:

filenames:
  - /var/log/nginx/*.log
labels:
  type: nginx
---
filenames:
  - /var/log/auth.log
labels:
  type: syslog

cscli collections install crowdsecurity/nginx
cscli allowlists create admins -d "own addresses"
cscli allowlists add admins 203.0.113.10 -d "work IP"
cscli alerts list          # watch what gets detected for a week
cscli decisions list       # which blocks would have been issued

Enable blocking only after checking the allowlist: the bouncer is a separate package with its own updates. By default CrowdSec exchanges signals with a central API for the community blocklist — decide whether you're fine with that.

When to use

On any server with public ports.

Source

• crowdsecurity/crowdsec
• allowlists commands
• acquis.yaml format

How to apply it yourself

1. Install it without a bouncer, wire up the Nginx and sshd logs.
2. Add your own addresses to the allowlist.
3. Watch cscli alerts list for a week, then enable the firewall bouncer.
4. Mark it "Studied" once blocking works and has never hit your own IP.