CrowdSec is an open-source software that detects malicious behavior from various connection sources, including infrastructure, system, and applications. Similar to Fail2Ban, CrowdSec reads logs from several sources (eg: files and streams). It then parses and extracts information such as IPs, time, and environment to match it to patterns called scenarios.
Once a malicious behavior is detected, its IP is stored via the Local API (LAPI), and another software called bouncer, also deployed on your machine, restricts access to this IP on your resources by querying the LAPI every X seconds. Various bouncers exist, blocking IPs with a firewall (iptables, nftables), Cloudflare or Nginx.
Another feature enables every user of CrowdSec to share their banned IPs to a Central API (CAPI) managed by the CrowdSec team. When an IP is identified as being dangerous, it is shared with the whole community and is banned by the bouncers. This feature can be deactivated.
In this tutorial, we will set up CrowdSec on a Dedibox and protect the SSH connection.
To complete the actions presented below, you must have:
rootUpdate the apt package manager and install the dependencies:
Add the CrowdSec GPG key:
Add the address of the CrowdSec repository:
Update the sources and install CrowdSec:
CrowdSec is now installed on your Dedibox. By default, some scenarios and parsers are installed. You can list them using cscli:
Some of these parsers are used to enrich the data from the malicious behaviors, with for example their localization or whitelisting. A real parser called crowdsecurity/sshd-logs allows to parse the logs from SSHD. Let us see the scenarios:
Two scenarios are also installed by default. They are designed to use the data from the sshd-logs parser. In our current set-up, we can easily detect someone who is trying to connect to your machine. We can test that by spamming an SSH connection from your local machine to your Dedibox, or using a software like hydra. The scenario is configured to be banned after 5 iterations from a single IP, but feel free to edit it by following the documentation.
You can find your banned IPs using cscli:
If you banned your local machine on your Dedibox, do not forget to unban it before continuing this tutorial:
At this moment, you can only detect the suspicious behaviors, but these IPs are not banned. You have to install a bouncer on your Dedibox to achieve this.
In this tutorial, we will use a bouncer that can manage iptables and ipset. Once an IP is detected by the CrowdSec Agent, the bouncer will add this IP to an ipset and his connection will be automatically dropped.
Install the firewall bouncer:
Check that your bouncer is correctly installed:
Ban a random IP manually to test it:
We do not recommend banning your local machine, in case you lose your SSH connection.
Run ipset list. You can see that the bouncer did its job and added a lot of IPs. These are the IPs from the CAPI, automatically banned. You can also easily find your manual ban:
This ipset is in reality a hashtable, and thus is adding only one rule to your iptables. You can see it using iptables -L.
You can set up a dashboard on your machine to get a visual overview of all actions taken. However, this dashboard works only with the default database, SQLite. If you want to use PostgreSQL or MySQL, you will not be able to use the dashboard. You can start the dashboard container with:
The flag -l 0.0.0.0 is important for accessing any machine from the dashboard.
You can navigate to http://<your-Dedibox-public-IP>:3000/ and log in with the credentials given. You can list all the decisions and get graphs:
CrowdSec includes metrics that can be used by Prometheus. You can set up with Grafana and Prometheus different dashboards.
In this tutorial, we saw how to easily set up a protection against SSH brute force attacks. CrowdSec has many parsers and scenarios available on the CrowdSec Hub. You can install them with cscli. You can also configure CrowdSec and customize it as you want. For more information, refer to the official documentation.
We saw here how to protect only one machine, but you could protect as many machines as you want with a centralized LAPI and all of your banned IP will be synchronized.