Security

CrowdSec Security Engine

IDS/IPS open-source kolaboratif + WAF (AppSec). Deteksi lewat log & HTTP, remediasi via bouncer, manajemen engine di CrowdSec Console.

#Security#Linux#Nginx#DevOps#Docker

Apa itu CrowdSec?

CrowdSec adalah solusi keamanan open-source dan participative untuk mendeteksi serta memblokir IP jahat. Intinya: Security Engine (IDS + opsi WAF) yang menganalisis perilaku, ditambah Remediation Component (bouncer) yang mengeksekusi blokir.

Console / daftar engine: app.crowdsec.net/security-engines
Dokumentasi: docs.crowdsec.net
Repo: github.com/crowdsecurity/crowdsec

Arsitektur singkat

Logs / HTTP traffic
        │
        ▼
┌───────────────────┐
│ Security Engine   │  ← deteksi (scenarios, AppSec/WAF)
│  - log processor  │
│  - AppSec (opsional)
└─────────┬─────────┘
          │ decisions (ban, captcha, …)
          ▼
┌───────────────────┐
│ Bouncer /         │  ← remediasi (Nginx, firewall, Cloudflare, …)
│ Remediation       │
└───────────────────┘
          │
          ▼ (opsional)
   Community CTI / Console

Komponen	Peran
Security Engine	Parse log & request; cocokkan scenario perilaku; keluarkan decision
AppSec / WAF	Inspeksi HTTP L7 (SQLi, XSS, exploit CVE) sebelum request ke app
Bouncer	Blokir/tindak IP di reverse proxy, firewall, CDN, dll.
Console	Kelola Security Engine, pantau, hubungkan CTI

Security Engine vs WAF

	Security Engine (log-based)	WAF (AppSec)
Kapan bereaksi	Setelah request diproses & tercatat di log	Saat request masuk (real-time)
Sumber	SSH, Nginx, mail, app logs, …	HTTP body/headers via bouncer WAF-capable
Kekuatan	Perilaku berulang, brute force, scan	Virtual patch, injection, known attacks

Kombinasi ideal: WAF untuk serangan langsung + engine log untuk pola jangka panjang.

CrowdSec Console (Security Engines)

Dashboard di app.crowdsec.net/security-engines dipakai untuk:

Mendaftarkan / melihat Security Engine yang terpasang
Status kesehatan & aktivitas deteksi
Integrasi threat intelligence komunitas
Sign up gratis untuk mulai

Integrasi reverse proxy

Cocok dipasang bersama:

Nginx / Nginx Proxy Manager (bouncer Nginx)
Caddy (bouncer / plugin ekosistem)
Firewall (iptables/nftables), Cloudflare, Traefik, dll.

Alur tipikal production:

Internet → Reverse Proxy (+ CrowdSec bouncer)
              → App (Laravel, static site, …)
         CrowdSec Engine ← logs / AppSec stream

Instalasi (outline)

# Contoh Ubuntu — ikuti docs resmi untuk distro Anda
curl -s https://install.crowdsec.net | sudo sh
sudo cscli collections install crowdsecurity/nginx
sudo systemctl enable --now crowdsec

Bouncer Nginx (setelah engine jalan):

sudo cscli bouncers add npm-bouncer
# pasang crowdsec-nginx-bouncer / sesuai stack Anda

Lihat panduan WAF + reverse proxy: docs.crowdsec.net — WAF RP howto.

Kapan dipakai

Server VPS self-hosted yang terbuka ke internet
Homelab / multi-service di belakang reverse proxy
Melengkapi (bukan mengganti) hardening OS, TLS, update rutin

Checklist

Install Security Engine + collection sesuai service (nginx, ssh, …)
Pasang bouncer di reverse proxy / firewall
Daftarkan engine ke Console (opsional tapi berguna)
Uji false positive (allowlist admin IP)
Monitor decisions & metrics

Tautan

Console engines: https://app.crowdsec.net/security-engines
Docs intro: https://docs.crowdsec.net/u/getting_started/intro/
AppSec / WAF: https://docs.crowdsec.net/docs/next/appsec/intro/

← Knowledge base