14,962 stars · MIT — the LICENSE file was opened directly on 2026-09-25 and is the plain MIT text, 'Copyright (c) 2020-2023 Crowdsec' · v1.8.1 (2026-09-03), read from /releases/latest and confirmed by ungh · Track this in Scout
It reads a server's own log files, decides who is attacking, blocks them, and shares what it found with everyone else running it.
▶Repo detailsthe review · specs · pros & cons · install
What it is
CrowdSec is an intrusion detection and prevention system written in Go. It parses logs from a web server, an SSH daemon or a firewall, applies community-written detection rules called scenarios, and hands decisions to separate small programs called bouncers that do the actual blocking.
What it is good for. Any machine with a public address and nobody watching it — a small web server, a mail server, a home machine with a port open. The older answer to this problem blocks an address only after that address has already attacked you. The shared list means an address that attacked somebody else last night is refused here this morning.
- MIT licence, read from the LICENSE file directly. That is about as permissive as a licence gets: use it, change it, ship it, no conditions beyond keeping the notice.
- Blocking is separated from detecting. CrowdSec decides, and a small bouncer for your firewall, web server or CDN carries the decision out. You can change one without touching the other.
- Very actively maintained. Version 1.8.1 was published on 3 September 2026 and code landed on 24 September 2026.
- It is two pieces, not one. Installing the engine gets you decisions and nothing enforced until a bouncer is installed as well. People stop after the first half and think it is not working.
- Sharing is part of the design. The free service expects you to send signals about the attacks you see. What is sent is deliberately narrow, but it is a trade you should decide on knowingly.
- A detection rule that is too eager can lock out a real person, including you. The allow-list for your own addresses is something to set up before, not after.
- fail2ban/fail2ban
18,676 stars, the long-established tool for the same job; it bans on your own logs alone, with no shared list and no separate blocking programs.
Track this in Scout - wazuh/wazuh
16,533 stars, a much larger security platform that collects and correlates events across many machines; heavier to run and aimed at teams with an analyst.
Track this in Scout - OISF/suricata
6,552 stars, inspects network traffic itself rather than log files, which catches different things and costs far more processing.
Track this in Scout
# Debian and Ubuntu curl -s https://install.crowdsec.net | sudo sh sudo apt install crowdsec # then install something that actually blocks — here, for nftables/iptables sudo apt install crowdsec-firewall-bouncer-iptables # see what it has decided sudo cscli decisions list sudo cscli metrics
