Lion Cipher Lab
Set up CrowdSec, the collaborative successor to Fail2Ban
- Cyber / Security Engineer
- Beginner
- ~45 min
- Free · no account required
Why it matters
Fail2Ban proved a durable pattern: watch a log, match a failure signature, ban the source. CrowdSec is the current-generation take on that idea, and it is worth learning because of three deliberate changes. First, it splits the job in two — a local engine parses logs and decides who is malicious, while separate 'bouncers' do the actual blocking (at the firewall, in a web server, at a CDN). That separation lets one detection brain drive many different enforcement points. Second, its detection logic ('scenarios') and log parsers ship as versioned, community-maintained packages from a central…
What you'll learn
- installing CrowdSec
- understanding parsers, scenarios, collections, and bouncers
- enabling the sshd collection from the Hub
- adding a firewall bouncer to enforce blocks
- reading decisions and metrics with cscli
- how the community blocklist and signal-sharing work
- contrasting CrowdSec with Fail2Ban
Steps in this lab
- What CrowdSec is, and how it differs from Fail2Ban
- Install CrowdSec
- The vocabulary: parsers, scenarios, collections, bouncers, and the Hub
- See what is already watching your logs
- Enable the SSH collection from the Hub
- Add a bouncer so decisions actually block traffic
- Read decisions and metrics with cscli
- CrowdSec or Fail2Ban? My take