> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Install CrowdSec on Linux to Block Attacks

> CrowdSec install on Linux: add the official repository, install the crowdsec package, then add the firewall bouncer so detected attackers get blocked.

To install CrowdSec on Linux, add the official repository with `curl -s https://install.crowdsec.net | sudo sh`, then install the engine with `sudo apt install crowdsec` (Ubuntu/Debian) or `sudo dnf install crowdsec` (AlmaLinux/Rocky). Add a firewall bouncer such as `crowdsec-firewall-bouncer-nftables`, because the engine on its own only detects attacks and does not block them.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 15 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access, outbound HTTPS |

CrowdSec reads your logs (SSH, nginx, Apache and more), spots attacks such as password guessing or web scans, and creates a **decision** to ban the attacking IP. A **bouncer** enforces that decision, for example in your firewall. CrowdSec can also share and receive attacker IPs with its community blocklist.

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* Run CrowdSec **or** [Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md) for SSH, not both, so two tools do not ban the same traffic.
* Know your own public IP address so you can allowlist it.
* If you block yourself, use the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console access.

> [!WARNING]
>
> Ubuntu also has an older `crowdsec` package in its own repository. Install from the CrowdSec repository as shown below so you get a current release. Check with `apt-cache policy crowdsec` that the candidate comes from `packagecloud.io/crowdsec`.

## How to install CrowdSec

**1. Add the CrowdSec repository**

```bash theme={null}
curl -s https://install.crowdsec.net | sudo sh
```

This script adds the official package repository for your distribution ([CrowdSec documentation](https://docs.crowdsec.net/u/getting_started/installation/linux)). If you prefer not to pipe a script into a shell, download it first with `curl -s -o crowdsec-repo.sh https://install.crowdsec.net`, read it, then run `sudo sh crowdsec-repo.sh`.

**2. Install the engine**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt update
> apt-cache policy crowdsec
> sudo apt install crowdsec
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install crowdsec
> ```

CrowdSec tries to detect the services running on your server and set up matching log sources and collections (parsers and attack scenarios). Check the result in the next section.

**3. Install a firewall bouncer**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt install crowdsec-firewall-bouncer-nftables
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo dnf install crowdsec-firewall-bouncer-nftables
> ```

An `-iptables` package also exists for older setups. The bouncer settings are in `/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml`.

**4. Allowlist your own IP address**

```bash theme={null}
sudo cscli allowlists create my_ips -d "Admin addresses"
sudo cscli allowlists add my_ips 203.0.113.10 -d "Office"
```

## How to protect SSH and other services

Check which collections are installed:

```bash theme={null}
sudo cscli collections list
```

SSH protection comes from `crowdsecurity/sshd`. Add it, or others for your web server, if they are missing:

```bash theme={null}
sudo cscli collections install crowdsecurity/sshd
sudo systemctl reload crowdsec
```

For websites behind nginx, Apache, Traefik or HAProxy, CrowdSec also offers web-server bouncers that can show a captcha instead of a hard block ([firewall bouncer documentation](https://docs.crowdsec.net/u/bouncers/firewall/)).

## How to check it worked

**1. Check the service**

```bash theme={null}
sudo systemctl status crowdsec
```

The status line shows `active (running)`.

**2. Check that logs are read**

```bash theme={null}
sudo cscli metrics show acquisition parsers
```

Each log source should show a non-zero number of lines parsed.

**3. Check that the bouncer is connected**

```bash theme={null}
sudo cscli bouncers list
```

Your bouncer is listed with a tick in the **Valid** column and a recent **Last API pull** time.

**4. Trigger the SSH test scenario**

From another computer, run the official test login (it is harmless and only creates an alert):

```bash theme={null}
ssh crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl@203.0.113.10
```

Then on the server:

```bash theme={null}
sudo cscli alerts list -s crowdsecurity/ssh-generic-test
```

The alert appears in the list.

These checks come from the [CrowdSec health check](https://docs.crowdsec.net/u/getting_started/health_check/).

## How to see and remove bans

```bash theme={null}
sudo cscli decisions list
sudo cscli decisions delete --ip 198.51.100.41
```

To ban an address by hand for four hours:

```bash theme={null}
sudo cscli decisions add --ip 198.51.100.41 --duration 4h --reason "manual ban"
```

## CrowdSec vs Fail2Ban: which should I use?

| | CrowdSec | Fail2Ban |
| - | - | - |
| Detects | Logs, with shared scenarios from the CrowdSec Hub | Logs, with local regex filters |
| Blocks | Through a separate bouncer | Through its own firewall actions |
| Shared blocklist | Yes, community blocklist | No |
| Set-up | Repository plus two packages | One package from your distribution |

Both protect SSH well. Choose Fail2Ban for a simple, self-contained setup and CrowdSec if you want shared blocklists or protection for several services from one tool.

## Frequently asked questions

### Does CrowdSec block anything without a bouncer?

No. The engine only creates alerts and decisions. Install a bouncer to enforce them.

### Does CrowdSec send my logs to CrowdSec?

The engine connects to the CrowdSec Central API to download the community blocklist and to report attacks it detected. Check the connection with `sudo cscli capi status`. Read the [CrowdSec documentation](https://docs.crowdsec.net/u/getting_started/next_steps/) for what is shared and how to change it.

### How do I unban myself if I am locked out?

Log in through the VNC console and run `sudo cscli decisions delete --ip` with your IP. Then add your IP to your allowlist.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md)
>
> The simpler alternative.

> [card] [Check login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md)
>
> See failed SSH attempts.

> [card] [nftables and iptables](https://help.freakhosting.com/portals/other/how-to-use-nftables-and-iptables.md)
>
> How the bans are applied.

> [card] [Apply DDoS filters](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md)
>
> Filter traffic before it reaches you.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [CrowdSec documentation](https://docs.crowdsec.net/u/getting_started/installation/linux)** (installation, firewall bouncer, health check and `cscli` reference) on 4 November 2026. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.