crowdsec blocks attackers before they reach you

fail2ban vs crowdsec, quick gut check

fail2ban has been the go to for years. it watches your logs, sees someone hammering ssh, and bans their ip locally. it works, it's lightweight, and it's still worth running. but it only reacts after someone already knocked on your door. crowdsec does the same log watching trick but adds something fail2ban never had, a shared brain across thousands of servers. if an ip gets caught attacking someone else's box first, your box can block it before it ever sends you a single packet.

how the pieces fit together

crowdsec is split into two jobs on purpose. the engine reads your logs (ssh, nginx, apache, whatever you point it at), matches patterns against known attack scenarios, and decides "this ip is bad." but the engine itself doesn't block anything. that's the job of a bouncer, a small separate program that actually enforces the ban, usually by talking to your firewall (iptables, nftables, or even cloudflare if you're using that bouncer). detection and enforcement are decoupled so you can swap in different bouncers depending on your setup.

installing the engine

on debian/ubuntu it's a repo add and an apt install:

curl -s https://install.crowdsec.net | sudo sh
sudo apt install crowdsec

this pulls in the engine and a default set of "collections," which are prebuilt rule packs for common services like sshd, nginx, and http auth. you can add more later depending on what's running on your box.

adding a bouncer so it actually enforces

the engine without a bouncer is just a very smart notepad. it'll notice the attack and log a decision, but nothing gets blocked until you install a bouncer:

sudo apt install crowdsec-firewall-bouncer-iptables

this bouncer polls the engine for new decisions and drops the traffic at the firewall level. once it's running, detections turn into actual blocks instead of just entries in a database.

the community blocklist, the actual upgrade over fail2ban

this is the part that changes the game. crowdsec lets you opt into a shared, crowdsourced feed of malicious ips reported by other users running the same setup. if an ip gets flagged as a brute forcer or scanner on someone else's server in argentina, your server in ohio can pull that same block before that ip ever probes you. it's basically a neighborhood watch for the internet, minus the awkward small talk.

checking what's actually being blocked

you don't have to guess what crowdsec is doing behind the scenes, there's a command for that:

cscli decisions list

this prints every active ban on your machine, the ip, the reason it was flagged (like an ssh bruteforce scenario), the source (local detection vs community blocklist), and how long the ban lasts. it's the single best way to sanity check that the whole pipeline, log parsing, scenario matching, bouncer enforcement, is actually working end to end and not just installed and quietly doing nothing.

a few other commands worth knowing while you're in there:

cscli metrics
cscli bouncers list
cscli collections list

metrics shows you what's being parsed and detected, bouncers list confirms your enforcement layer is alive and checking in, and collections list shows which rule packs are active so you know what attack patterns you're actually covered against.

the takeaway

fail2ban is still fine for a simple box, don't rip it out if it's working for you. but if you want protection that improves the more people use it, crowdsec is worth the ten minutes of setup. install the engine, add a bouncer so it can actually enforce, and run cscli decisions list regularly to see what your server has quietly turned away. the goal isn't to watch attacks happen faster, it's to make sure most of them never get the chance to knock at all.