CrowdSec
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license. | — | Active | ❌ | Unlimited | ❌ |
Description
CrowdSec is a behavior-based intrusion prevention system — it watches logs for attack patterns, correlates them against a crowdsourced blocklist contributed by its whole user base, and hands off the actual blocking to "bouncers" for specific targets (iptables/nftables, Traefik, Nginx, and others).
Features
- Crowdsourced blocklist — an IP flagged by one CrowdSec instance's log analysis can get blocked by every other instance subscribed to the community feed, not just the one that saw the attack.
- Bouncers, not just detection — the engine only decides who's malicious; a separate bouncer component does the actual blocking, decoupling "what counts as an attack" from "how to stop it." A Traefik bouncer exists alongside the standard
iptables/nftablesone — the same tool can cover HTTP-layer abuse, not just SSH. - Log parsers for common services — SSH, Traefik/Nginx, and other common self-hosted stack components ship with ready-made detection scenarios, not just a blank framework to configure from scratch.
Usage patterns
- fail2ban replacement with correlation — same core job (watch logs, ban repeat offenders) but pattern-matches against a live, shared threat feed rather than only counting failures from a single box's own logs.
- One tool across SSH and HTTP — since bouncers exist for both
iptables(network-level, e.g. SSH) and Traefik (HTTP-level), a single CrowdSec install can plug the rate-limiting/banning gap on both fronts, wherefail2banalone only ever covered SSH in this catalog.
License and governance
MIT — the Security Engine itself carries no feature gating; everything CrowdSec sells (premium curated blocklists, enterprise CTI API access, a managed console) sits alongside the free engine, not inside it, so a fork remains fully viable if that ever changed. Built by a French company, placing it under EU/GDPR jurisdiction rather than the US CLOUD Act — the same jurisdictional shape that made Proton Pass an acceptable exception elsewhere in this catalog, though CrowdSec is genuinely self-hostable where Proton Pass isn't.
Conclusion
Why you would — a real, un-gated, MIT-licensed log-based intrusion prevention tool, with the same engine covering both SSH and HTTP via separate bouncers instead of needing two different tools for two different protocols.
Why you wouldn't — depends on an internet connection to a third party (the community CTI feed) to get its full value; still useful purely on local log analysis without it, just less than advertised.