How to Install and Configure CrowdSec on Rocky Linux 9

---

CrowdSec is a modern, open-source security engine that analyzes visitor behavior and provides a collaborative defense by sharing detected malevolent IPs across its network. It is a powerful, lightweight alternative to Fail2Ban, designed to protect modern infrastructure.

Prerequisites

---

• A VPS running Rocky Linux 9
• Root or sudo access to the server.
• Basic familiarity with the Linux command line.

Update the System

---

Before starting, ensure your system is up to date.

dnf update -y

Install CrowdSec Repository

---

CrowdSec provides an installation script to automatically configure the official repository.

dnf install curl -y

curl -s https://install.crowdsec.net | bash

Install CrowdSec Security Engine

---

Once the repository is added, install the main security engine.

dnf install crowdsec -y

Upon installation, CrowdSec will automatically scan your server for running services (like SSH or Nginx) and install the relevant collections (detection rules).

Install a Bouncer (Remediation)

---

The CrowdSec engine detects threats but does not block them by itself. You need a Bouncer to perform the remediation (e.g., dropping packets via the firewall). The most common is the Firewall Bouncer.

dnf install crowdsec-firewall-bouncer-iptables -y

Verify the Installation

---

Check if the CrowdSec service is active and running.

systemctl status crowdsec

To see which collections were automatically installed:

cscli collections list

Enable and Start Services

---

Ensure CrowdSec starts on boot and is running.

systemctl enable crowdsec
systemctl start crowdsec

Basic Configuration & Commands

---

The cscli (CrowdSec CLI) is the primary tool for managing your security stack.

• View active decisions (blocked IPs):

  cscli decisions list

• Manually ban an IP: If you want to manually block an IP (e.g., 1.2.3.4) for 24 hours:

  cscli decisions add --ip 1.2.3.4 --duration 24h --reason "manual block"

• Unban an IP:

  cscli decisions delete --ip 1.2.3.4

Accessing the Local API

---

CrowdSec uses a Local API (LAPI) to communicate. By default, it listens on 127.0.0.1.

cscli lapi status

Troubleshooting & Logs

---

If you encounter issues on your Rocky Linux 9 instance, check the following logs:

• CrowdSec Engine Logs: /var/log/crowdsec.log
• Bouncer Logs: /var/log/crowdsec-firewall-bouncer.log