Intrusion Prevention: CrowdSec instead of fail2ban

fail2ban blocks IPs after repeated failed attempts — locally, alone, reactively. CrowdSec does the same, but it shares the information with all other CrowdSec instances. An attacker who fails against another server in Helsinki won’t even get in here in Kufstein.

The Principle: Crowdsourced Threat Intelligence

CrowdSec analyzes logs — SSH, HTTP, SMTP, name it. If it detects an attack (brute-force, scanner, exploit attempt), it blocks the IP locally — and sends an anonymized report to the central API. All other instances pull this blocklist and also fend off the IP.

This is no intelligence agency, but lived community: Whoever shares, benefits.

Installation: Docker, one command

docker run -d --name crowdsec \
  -v /var/log:/var/log:ro \
  -v crowdsec-config:/etc/crowdsec \
  crowdsecurity/crowdsec

Plus a Bouncer — for example the firewall Bouncer for iptables/nftables or the Caddy-Bouncer — and the logs are evaluated live. Setup takes half an hour, then it runs.

What CrowdSec does better than fail2ban

• Central blocklist management instead of individual jail.conf tinkering — one config file, all services
• Reputation: Not just failed attempts count, but the global history of the IP
• Modern parsing engine: Understands JSON logs, syslog, even custom formats
• No regex agony: fail2ban filters are regex puzzles. CrowdSec parsers are YAML and logical

More than IP blocking: AppSec/WAF

CrowdSec has grown beyond pure IP blocking. The AppSec component acts as an application‑near Web Application Firewall (among others with CRS-/ModSecurity‑compatible rules) and catches attack patterns directly at the HTTP request — useful for exposed web applications behind the reverse proxy.

NIS2‑compliant: on‑prem data retention

The threat data comes from an external API, but log evaluation and blocking run locally. No own log data leaves the premises — only anonymized signals ("IP X performed brute‑force against SSH"). NIS2-compliant threat sharing hardly gets better.

What fail2ban can still do better

For a single service on a single server that is never reachable from the internet, fail2ban is enough. The complexity of CrowdSec pays off only from the point where you are truly exposed — reverse proxy, mail server, SSH with internet access.

Conclusion

CrowdSec does not replace fail2ban as a niche tool, but as a standard IDS. Whoever operates more than two services publicly should use it. The swarm is stronger than the lone individual — that holds in security just as in biology.