RousselTMLEARNING
EN
FrançaisEnglishEspañol
Sign in

Proxy & réseau · Courses

CrowdSec: From Discovery to Expertise

Complete CrowdSec course: architecture, difference with Fail2ban, installation, collections, scenarios, bouncers (firewall, Traefik, Nginx, HAProxy, Cloudflare), decisions, AppSec and observability. Tested examples.

8 chapters16 lessonsEN
At your pace, through practice.

By the end of this course you will be able to

  • Understand the CrowdSec architecture and how it differs from Fail2ban
  • Install CrowdSec and declare the logs to analyze
  • Use collections and scenarios, and write your own
  • Deploy bouncers at the firewall, reverse proxy and CDN
  • Manage decisions, allowlists and AppSec, and track activity with Prometheus

🎯 Level : Intermediate👥 Who it is for : System administrators, DevOps engineers and security officers who expose services on the Internet

LEARNING PATH

Course curriculum

0Course overview1 lesson
  1. Assessment quizQuiz · ⏱ 10 min
1Understanding CrowdSec2 lessons

Architecture and comparison with Fail2ban.

  1. CrowdSec: the collaborative firewallArticle · ⏱ 3 min
  2. CrowdSec or Fail2ban?Article · ⏱ 3 min
2Installation and configuration2 lessons

Packages, Docker, acquisition, console.

  1. Installing and configuring CrowdSecArticle · ⏱ 9 min
  2. Lab 1: Install CrowdSec and detect SSH brute forceHands-on lab · ⏱ 40 min · Level 1/5
3Collections, parsers and scenarios2 lessons

The Hub, explain, custom scenarios.

  1. Collections, parsers and scenariosArticle · ⏱ 9 min
  2. Lab 2: Write a scenario and test it in simulationHands-on lab · ⏱ 40 min · Level 2/5
4Bouncers5 lessons

Firewall, Traefik, Nginx, HAProxy, Cloudflare and custom.

  1. Bouncers and the firewall bouncerArticle · ⏱ 9 min
  2. Protecting TraefikArticle · ⏱ 11 min
  3. Nginx, Apache and HAProxy bouncersArticle · ⏱ 7 min
  4. Cloudflare, network devices and custom bouncerArticle · ⏱ 9 min
  5. Lab 3: Protect Traefik with the CrowdSec bouncerHands-on lab · ⏱ 50 min · Level 2/5
5Decisions, profiles and AppSec1 lesson

Remediations, false positives and WAF.

  1. Decisions, profiles, allowlists and AppSecArticle · ⏱ 9 min
6Observability2 lessons

Banned IPs, blocked attacks, Prometheus, Grafana.

  1. CrowdSec observabilityArticle · ⏱ 13 min
  2. Lab 4: Track banned IPs and attacks with PrometheusHands-on lab · ⏱ 40 min · Level 2/5
7Best practices1 lesson

Running CrowdSec in production.

  1. CrowdSec in production: best practicesArticle · ⏱ 4 min

LEARN BY DOING

Use cases & applications

Protect SSH and exposed services

Brute force detected and blocked at the firewall.

Secure a reverse proxy

Ban, captcha and WAF in front of your applications.

Share blocks across servers

One central Local API for all your agents.

Track attacks

Prometheus metrics, Grafana and notifications.

What next?

Traefik: From Discovery to ExpertiseHAProxy: from discovery to expertisePrometheus: From Discovery to Expertise

Frequently asked questions

Is CrowdSec free?

Yes, the engine is free software under the MIT license. Paid offers exist for some lists and console features.

Does CrowdSec replace Fail2ban?

It covers the same need and goes further: detection separated from blocking, several servers, bouncers at the proxy or CDN, shared reputation.

Does CrowdSec block on its own?

No: you need at least one bouncer to enforce decisions.

Are my logs sent to CrowdSec?

No. Only signals are shared: attacker address, scenario and timestamp. This sharing is optional.

Support us

♥ SUPPORT US

Support RousselTM Learning

Courses, articles, labs and certificates stay free with no intrusive ads. A voluntary contribution, of any amount you choose, pays for hosting, lab environments and new content.

Contribute with PayPal Any amount · card or PayPal accountLearn more
QR code PayPal
Or scan this QR code with your phone

Thank you, every contribution counts!