Skip to main content
To install CrowdSec on Linux, add the official repository with curl -s https://install.crowdsec.net | sudo sh, then install the engine with sudo apt install crowdsec (Ubuntu/Debian) or sudo dnf install crowdsec (AlmaLinux/Rocky). Add a firewall bouncer such as crowdsec-firewall-bouncer-nftables, because the engine on its own only detects attacks and does not block them. CrowdSec reads your logs (SSH, nginx, Apache and more), spots attacks such as password guessing or web scans, and creates a decision to ban the attacking IP. A bouncer enforces that decision, for example in your firewall. CrowdSec can also share and receive attacker IPs with its community blocklist.

​
Before you start

  • You need root or a sudo user. Root users can leave out sudo.
  • Run CrowdSec or Fail2Ban for SSH, not both, so two tools do not ban the same traffic.
  • Know your own public IP address so you can allowlist it.
  • If you block yourself, use the VNC console. On a dedicated server, open a ticket if you need console access.
Ubuntu also has an older crowdsec package in its own repository. Install from the CrowdSec repository as shown below so you get a current release. Check with apt-cache policy crowdsec that the candidate comes from packagecloud.io/crowdsec.

​
How to install CrowdSec

1

Add the CrowdSec repository

This script adds the official package repository for your distribution (CrowdSec documentation). If you prefer not to pipe a script into a shell, download it first with curl -s -o crowdsec-repo.sh https://install.crowdsec.net, read it, then run sudo sh crowdsec-repo.sh.
2

Install the engine

CrowdSec tries to detect the services running on your server and set up matching log sources and collections (parsers and attack scenarios). Check the result in the next section.
3

Install a firewall bouncer

An -iptables package also exists for older setups. The bouncer settings are in /etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml.
4

Allowlist your own IP address

​
How to protect SSH and other services

Check which collections are installed:
SSH protection comes from crowdsecurity/sshd. Add it, or others for your web server, if they are missing:
For websites behind nginx, Apache, Traefik or HAProxy, CrowdSec also offers web-server bouncers that can show a captcha instead of a hard block (firewall bouncer documentation).

​
How to check it worked

1

Check the service

The status line shows active (running).
2

Check that logs are read

Each log source should show a non-zero number of lines parsed.
3

Check that the bouncer is connected

Your bouncer is listed with a tick in the Valid column and a recent Last API pull time.
4

Trigger the SSH test scenario

From another computer, run the official test login (it is harmless and only creates an alert):
Then on the server:
The alert appears in the list.
These checks come from the CrowdSec health check.

​
How to see and remove bans

To ban an address by hand for four hours:

​
CrowdSec vs Fail2Ban: which should I use?

Both protect SSH well. Choose Fail2Ban for a simple, self-contained setup and CrowdSec if you want shared blocklists or protection for several services from one tool.

​
Frequently asked questions

​
Does CrowdSec block anything without a bouncer?

No. The engine only creates alerts and decisions. Install a bouncer to enforce them.

​
Does CrowdSec send my logs to CrowdSec?

The engine connects to the CrowdSec Central API to download the community blocklist and to report attacks it detected. Check the connection with sudo cscli capi status. Read the CrowdSec documentation for what is shared and how to change it.

​
How do I unban myself if I am locked out?

Log in through the VNC console and run sudo cscli decisions delete --ip with your IP. Then add your IP to your allowlist.

VPS and dedicated server guides

Every guide in this section.

Set up Fail2Ban

The simpler alternative.

Check login history

See failed SSH attempts.

nftables and iptables

How the bans are applied.

Apply DDoS filters

Filter traffic before it reaches you.

Security checklist

Harden the rest of your server.
Checked against the official CrowdSec documentation (installation, firewall bouncer, health check and cscli reference) on 4 November 2026. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026