CrowdSec

What it's good for#

Put any server on the internet and within minutes something starts trying passwords on it. CrowdSec reads your server's logs, spots patterns like "fifty failed SSH logins from one address", and bans that address at the firewall for a while. It's the modern cousin of fail2ban.

The other half is the community blocklist. Every CrowdSec server that takes part reports the attackers it sees, and in return gets a list of addresses that are attacking lots of servers right now. Yours can block those before they've knocked once.

If your server is only on your home network and never reachable from outside, CrowdSec has little to do. It earns its place as soon as anything is open to the internet, which is why the setup wizard suggests it with Traefik.

What the install sets up#

CrowdSec isn't a container. It's installed on the server itself from CrowdSec's own package repository, as two services:

• the agent, which reads the logs and decides who to ban. LibrePortal gives it CrowdSec's standard Linux and SSH detections.
• the firewall bouncer, which turns those decisions into firewall rules, so a banned address can't reach anything on the server at all.

If Traefik is installed, LibrePortal also puts a CrowdSec check in front of every app Traefik serves, so banned addresses get turned away at the web level too. Devices on your own network (addresses like 192.168.1.x) are never blocked there.

There's no web page and no login. You see it through its page in LibrePortal: the Services tab shows whether both services are running, and the Logs tab shows what they've been doing. The first install downloads CrowdSec's detection rules and location database, so allow a few minutes.

The community blocklist, and what it shares#

Community blocklist (CAPI) is on to start with. It's a fair trade, and worth knowing about: in return for the list, your server sends CrowdSec anonymous reports of the attacks it sees, meaning the attacking address, what it tried and when. Nothing about you, your apps or your users goes with it. The install's last line says which way it's set.

If you'd rather not share anything, switch it off before you install, for example with sudo -u libreportal libreportal app install crowdsec 'CFG_CROWDSEC_COMMUNITY_BLOCKLIST=false'. Bear in mind that CrowdSec is ticked in the setup wizard's recommended apps, and installed from there it has the list on. At the moment the setting is only applied during the first install; changing it afterwards does nothing until CrowdSec is removed and installed again.

To check: CrowdSec's COMMUNITY_BLOCKLIST / CONSOLE_ENROLL / CONSOLE_TOKEN are only acted on in the first-install branch of crowdsec_install_host.sh; update if they're applied on later config changes

CrowdSec's online console#

CrowdSec also runs a free website, app.crowdsec.net, where you can see your server's alerts on a dashboard. That's separate from the blocklist and off unless you ask for it. To join, make an account there, copy the enrolment key it gives you, and run on the server:

sudo cscli console enroll <your key>

Then accept the server on the website.

Checking on it, and unbanning someone#

CrowdSec's own cscli command is the way in. A few useful ones, run on the server:

sudo cscli decisions list
sudo cscli alerts list
sudo cscli decisions delete --ip 203.0.113.7

The first shows who is banned right now and for how long, the second what CrowdSec has spotted, and the third lifts a ban, which is the one you'll want if you lock yourself out from a hotel by getting your SSH password wrong too often. Bans end on their own after a few hours anyway.

The Traefik bouncer key#

Traefik checks each visitor with CrowdSec using a key that LibrePortal creates at install and keeps in a file only Traefik reads. If you think that key has leaked, or Traefik's CrowdSec check has stopped working, run Rotate Traefik Bouncer Key on the Tools tab. It issues a new key and restarts Traefik to load it, so your web apps blink for a few seconds while that happens.

Good to know#

• It works alongside the server's firewall. CrowdSec's rules need to run before UFW's, or a connection UFW has already let in never reaches the ban. The install checks the order and says if it's wrong, with the fix.
• Switching it off without removing it is one setting, applied with a reinstall: sudo -u libreportal libreportal app install crowdsec 'CFG_CROWDSEC_ENABLED=false'. Both services stop but CrowdSec stays installed, so setting it back to true is quick. To remove it completely, uninstall it from its page or run sudo -u libreportal libreportal app uninstall crowdsec.
• Updates come as system packages. CrowdSec is installed from its own package repository, so a normal sudo apt upgrade on the server updates it along with everything else. LibrePortal's own updater leaves it alone, even though its page says Automatic: there's no container for it to check, so keep the server's packages up to date.
• One per server. One agent watching the whole machine is the point.
• Grafana dashboards come with it if you run Prometheus and Grafana and turn on its monitoring setting.