How is it different from fail2ban?

fail2ban blocks locally after repeated failures. CrowdSec adds a collaborative dimension (a community list of malicious IPs) and a more modular agent/bouncer architecture. The two are complementary.

Does CrowdSec share my data?

CrowdSec shares only malicious-IP signals (address, attack type, timestamp), not the contents of your logs. Community sharing can be disabled.

Which services does CrowdSec protect?

SSH, web servers (Nginx, Apache), firewalls and many applications, via scenario collections you can install according to your needs.

Client Area

Cybersecurity & Bastion

CrowdSec

Name: CrowdSec
Availability: InStock

Collaborative protection against attacks — behavioural detection and shared threat intelligence.

Official documentation Source code

root@mon-serveur — ssh

# when the VPS is created
✓ CrowdSec installedroot@mon-serveur:~#

About CrowdSec

CrowdSec is an open-source security engine that analyses the logs of your services (SSH, web, applications) to detect malicious behaviour, then blocks the offending IPs through a "bouncer". Its strength is collaborative: every reported IP feeds a community threat-intelligence database, and in return you benefit from the reports of thousands of other instances.

Deployed on your VPS, CrowdSec installs the detection agent, the scenarios (collections) suited to your services, and a firewall bouncer (iptables) that enforces the blocking decisions. Where fail2ban acts locally, CrowdSec adds a network dimension: you proactively block IPs known to be malicious before they even attack you.

What gets installed

Ready when the VPS starts

Compatible OS: Ubuntu 24.04
Application: CrowdSec
Tech stack: CrowdSecFirewall Bounceriptables
Minimum RAM: 1 GB
Minimum CPU: 1 vCPU
Access: root over SSH

Key features

Behavioural detection through log analysis (SSH, web, applications)
Collaborative threat intelligence: benefit from the community's reports
Firewall bouncer (iptables) that applies blocks automatically
Ready-to-use scenarios and collections tailored to your services
Optional centralised console to supervise multiple machines
Lightweight and production-ready, complementary to fail2ban

When to use this solution?

Protect an exposed server

Automatically detect and block SSH brute-force attacks and web scans on your public servers.

Proactive blocking

Leverage the community list of malicious IPs to block known threats before they target you.

Server fleet

Centralise the monitoring of multiple machines through the CrowdSec console and share blocking decisions.

Guide

Deploy CrowdSec on your VPS

Create the VPS
A VPS with 1 GB RAM, Ubuntu 24.04. The "CrowdSec" template installs the agent and the iptables firewall bouncer automatically.
Check detection
Check the status with cscli metrics and cscli decisions list: the agent is already analysing the SSH and system logs.
Add collections
Install the scenarios suited to your services (cscli collections install crowdsecurity/nginx, etc.) according to what you host.
Connect the console (optional)
Register the instance with the CrowdSec console to supervise alerts and decisions from a centralised interface.

Frequently asked questions

Questions about CrowdSec

← Back to Cybersecurity & Bastion All applications

CrowdSec is an open-source security engine that detects malicious behaviour in logs and blocks the offending IPs, drawing on a collaborative threat-intelligence database.

Embed the deploy button

Maintaining a project that uses CrowdSec? This button lets your readers deploy it on a VPS in one click, without reading Docker documentation.

Markdown

[![Deploy CrowdSec on ServOrbit](https://servorbit.com/brand/deploy/button.svg)](https://servorbit.com/vps-cloud?template=crowdsec&utm_source=deploy-badge&utm_medium=referral&utm_campaign=crowdsec)

HTML

<a href="https://servorbit.com/vps-cloud?template=crowdsec&utm_source=deploy-badge&utm_medium=referral&utm_campaign=crowdsec"><img src="https://servorbit.com/brand/deploy/button.svg" alt="Deploy CrowdSec on ServOrbit" height="40"></a>

The button points to a VPS order with the template preselected. The image is served from servorbit.com — nothing to host on your side.