Skip to content

CrowdSec Baseline: Debian 13 (Trixie) Public VM

Simple baseline for a fresh public Debian 13 VM:

  • CrowdSec Security Engine
  • Linux and SSH protection
  • nftables firewall bouncer
  • Bash completion
  • Basic verification commands

Run these commands as a normal sudo-enabled user.

Update Debian

sudo apt update
sudo apt upgrade -y
sudo apt install -y curl bash-completion

Add the official CrowdSec repository

curl -s https://install.crowdsec.net | sudo sh

Install and start CrowdSec:

sudo apt install -y crowdsec
sudo systemctl enable --now crowdsec
sudo systemctl status crowdsec --no-pager

Install the standard Linux and SSH collections

The Linux collection already includes SSH protection, but installing both commands is safe and makes the intent explicit.

sudo cscli hub update
sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/sshd
sudo systemctl reload crowdsec

Check the installed collections:

sudo cscli collections list

Install the firewall bouncer

Debian 13 uses nftables, so install the nftables bouncer:

sudo apt install -y crowdsec-firewall-bouncer-nftables

Enable and start it:

sudo systemctl enable --now crowdsec-firewall-bouncer
sudo systemctl status crowdsec-firewall-bouncer --no-pager

Check registered bouncers and CrowdSec nftables rules:

sudo cscli bouncers list
sudo nft list tables

You should normally see CrowdSec tables such as:

table ip crowdsec
table ip6 crowdsec6

Add cscli Bash completion

sudo cscli completion bash > cscli
sudo mv cscli /etc/bash_completion.d/
source /etc/bash_completion

Now TAB completion should work:

sudo cscli <TAB><TAB>

Verify log acquisition

Check what CrowdSec is reading:

sudo cscli metrics

For SSH, look for activity related to sshd, journalctl, or authentication logs.

Also check the acquisition metrics and SSH service:

sudo cscli metrics show acquisition
sudo systemctl status ssh --no-pager

Everyday commands

Show alerts

sudo cscli alerts list

Show active bans and decisions

sudo cscli decisions list

Show CrowdSec metrics

sudo cscli metrics

Show installed collections

sudo cscli collections list

Show firewall bouncers

sudo cscli bouncers list

Follow CrowdSec logs

sudo journalctl -u crowdsec -f

Follow firewall bouncer logs

sudo journalctl -u crowdsec-firewall-bouncer -f

Manually block or unblock an IP

Block an IP:

sudo cscli decisions add --ip 1.2.3.4

Unblock an IP:

sudo cscli decisions delete --ip 1.2.3.4

Update CrowdSec Hub rules

sudo cscli hub update
sudo cscli hub upgrade
sudo systemctl reload crowdsec

Final quick check

sudo systemctl is-active crowdsec
sudo systemctl is-active crowdsec-firewall-bouncer
sudo cscli collections list
sudo cscli bouncers list
sudo cscli decisions list
sudo cscli metrics
sudo nft list tables

Expected:

crowdsec                  -> active
crowdsec-firewall-bouncer -> active
crowdsecurity/linux       -> installed
crowdsecurity/sshd        -> installed
CrowdSec nftables tables  -> present

Minimal install

sudo apt update
sudo apt upgrade -y
sudo apt install -y curl bash-completion

curl -s https://install.crowdsec.net | sudo sh

sudo apt install -y crowdsec
sudo systemctl enable --now crowdsec

sudo cscli hub update
sudo cscli collections install crowdsecurity/linux
sudo cscli collections install crowdsecurity/sshd
sudo systemctl reload crowdsec

sudo apt install -y crowdsec-firewall-bouncer-nftables
sudo systemctl enable --now crowdsec-firewall-bouncer

sudo cscli completion bash > cscli
sudo mv cscli /etc/bash_completion.d/
source /etc/bash_completion

sudo cscli collections list
sudo cscli bouncers list
sudo cscli metrics
sudo nft list tables

This is enough for a clean public Debian 13 VM whose main exposed service is SSH.