HowTo: CrowdSec from scratch on Debian

CrowdSec = a collaborative IPS: it reads logs, applies behavioral scenarios and blocks hostile IPs, with global reputation. Full install, step by step.

1. Install

curl -s https://install.crowdsec.net | sudo sh
sudo apt -y install crowdsec
sudo systemctl status crowdsec

2. Acquisition (which logs)

# ce loguri citeste (auto-detectat la instalare); adaugi nginx manual:
sudo tee -a /etc/crowdsec/acquis.yaml >/dev/null <<'EOF'
---
filenames:
  - /var/log/nginx/access.log
  - /var/log/nginx/error.log
labels:
  type: nginx
EOF
sudo systemctl reload crowdsec

3. Collections (scenarios)

sudo cscli collections install crowdsecurity/nginx crowdsecurity/sshd \
  crowdsecurity/http-cve crowdsecurity/base-http-scenarios
sudo cscli collections list

4. nftables bouncer

# bouncer = aplica blocarea in nftables
sudo apt -y install crowdsec-firewall-bouncer-nftables
sudo cscli bouncers list

5. Operations

sudo cscli metrics
sudo cscli decisions list
sudo cscli alerts list

6. Console + testing

# test: adauga o decizie manuala si verifica blocarea
sudo cscli decisions add --ip 1.2.3.4 --duration 4h --reason test
sudo cscli decisions list
# consola (dashboard + blocklists comunitare):
sudo cscli console enroll <ENROLL_KEY>

Conclusion

You now have a collaborative IPS that auto-blocks attacks from logs, with community intelligence. We configure and tune it for you.