mydocker/crowdsec/README.md

CrowdSec - Intrusion Prevention System

Analyzes logs from multiple services and blocks malicious IPs via Traefik bouncer. Sends Telegram alerts on detections.

How It Works

Logs → crowdsec (analysis) → BAN decision → traefik-bouncer (enforcement)
                                          → Telegram notification

traefik-bouncer checks every request through Traefik against the CrowdSec API (crowdsec:8080). Returns 403 if the IP has an active ban.

Telegram Notifications

Notifications are sent via the HTTP plugin (conf/notifications/http.yaml) posting to the Telegram Bot API.

Flow

1. CrowdSec detects an attack (SSH brute-force, HTTP scanning, etc.)
2. Profile in conf/profiles.yaml matches the alert → assigns http_default notification
3. HTTP plugin waits 30s to group alerts, then sends POST:

POST https://api.telegram.org/bot<TOKEN>/sendMessage
{
  "chat_id": 5479795256,
  "parse_mode": "HTML",
  "text": "🚨 CrowdSec Alert\n🔒 Scenario: ...\n🌍 IP: ...\n📊 Event count: ..."
}

Environment variables (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) are configured in docker-compose.yaml.

Monitored Log Sources (conf/acquis.yaml)

Source	Type	Path/Container
SSH	syslog	/var/log/auth.log
Traefik	traefik	/var/log/traefik/access.log
Jellyfin	jellyfin	/var/log/jellyfin/log_*.log
Grafana	docker	grafana container
Bitwarden	vaultwarden	bitwarden container

Active Collections (Scenarios + Parsers)

Collection	Purpose
crowdsecurity/linux + sshd	SSH brute-force
crowdsecurity/traefik + nginx	HTTP attacks via Traefik
crowdsecurity/http-cve	Known CVEs (log4j, Spring4Shell, etc.)
crowdsecurity/base-http-scenarios	Scanning, path traversal, bad user agents
crowdsecurity/home-assistant	HA brute-force
crowdsecurity/whitelist-good-actors	SEO bots, CDNs
Dominic-Wagner/vaultwarden	Bitwarden brute-force
LePresidente/grafana + jellyfin	Grafana/Jellyfin brute-force

Whitelist (Never Banned)

IP/Range	Description
127.0.0.1	Localhost
192.168.1.0/24	LAN
10.13.13.0/24	WireGuard VPN
81.201.50.209	Home public IP
212.222.3.226	Work IP

Profiles & Decisions (conf/profiles.yaml)

Profile	Action	Notification
default_ip_remediation	Ban IP for 4h	Telegram
default_range_remediation	Ban entire /24 for 4h	Telegram

Useful Commands

# Helper scripts in crowdsec/bin/
./crowdsec/bin/alerts-list     # List recent alerts
./crowdsec/bin/decisions       # Active bans
./crowdsec/bin/metrics         # Parsing statistics

# Direct cscli commands
docker exec crowdsec cscli alerts list
docker exec crowdsec cscli decisions list
docker exec crowdsec cscli decisions delete --ip 1.2.3.4     # Unban IP
docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 24h  # Manual ban

# Test Telegram notification
docker exec crowdsec cscli notifications test http_default

# Manual ban with custom duration
docker exec crowdsec cscli decisions add --ip 1.2.3.4 --duration 168h --reason "manual"

# Follow logs
docker logs crowdsec --tail 100 -f
docker logs traefik-bouncer --tail 50