Quick reference

• Documentation and help: [***]
• Crowdsec concepts: [***]
• Where to file issues: [***]

What is Crowdsec

Crowdsec - An open-source, lightweight agent to detect and respond to bad behaviors. It also automatically benefits from our global community-wide IP reputation database.

How to use this image

Image flavors

All the following images are available on Docker Hub for the architectures 386, amd64, arm/v6, arm/v7, arm64.

Alpine

• crowdsecurity/crowdsec:{version}

Latest stable release recommended for production usage. Also available on GitHub (ghcr.io).

• crowdsecurity/crowdsec:dev

For development and testing, from the master branch.

since v1.4.2:

• crowdsecurity/crowdsec:slim

Reduced size by 60%, it does not include the notifier plugins nor the GeoIP database. If you need these details on decisions, run cscli hub upgrade inside the container to download the GeoIP database at runtime.

Debian (since v1.3.3)

• crowdsecurity/crowdsec:{version}-debian
• crowdsecurity/crowdsec:latest-debian

The debian version includes support for systemd and journalctl.

Custom

You can build your custom images with Dockerfile and Dockerfile-debian.

For example, if you need a Debian version without plugin notifiers:

console
$ docker build -f Dockerfile.debian --target slim .

The supported values for target are: full, geoip, plugins, slim.

Note: for crowdsec versions < 1.5.0, the syntax is

console
$ docker build -f Dockerfile.debian --build-arg=BUILD_ENV=slim .

Required configuration

Volumes

Since CrowdSec 1.7.0, /var/lib/crowdsec/data/ is required to be mounted in a volume. If this directory is not mounted, the container will refuse to start.

Journalctl (only for debian image)

To use journalctl as a log stream, with or without the DSN environment variable, you need to mount the journal log from the host to the container itself. This can be done by adding the following volume mount to the docker command:

-v /var/log/journal:/run/log/journal

Logs ingestion and processing

Collections are a good place to start: [***]

Find collections, scenarios, parsers and postoverflows in the hub: [***]

• Specify collections | scenarios | parsers | postoverflows to install via the environment variables (by default crowdsecurity/linux is installed)
• Mount volumes to specify which log files should be ingested by crowdsec

Acquisition (one file per datasource - recommended)

The files in /etc/crowdsec/acquis.d/ map the logs to the provided parsers. Find out more here: [***]

The directory might contain for example

ssh.yaml:

yaml
filenames:
 - /logs/auth.log
 - /logs/syslog
labels:
  type: syslog

apache.yaml:

yaml
filename: /logs/apache2/*.log
labels:
  type: apache2

labels.type: use syslog if the logs come from syslog, otherwise check the collection's documentation for the relevant type.

You can bind the directory from the host or have it in a Docker volume, the former is easier to update as you add more applications.

Note: In versions < 1.5, the acquisition directory is not configured by default. You can add it by mounting the /etc/crowdsec/config.yaml.local file:

yaml
crowdsec_service:
  acquisition_dir: /etc/crowdsec/acquis.d

Acquisition (single file - deprecated)

Before 1.5.0, it was recommended to put your acquisition configuration in /etc/crowdsec/acquis.yaml. You can still do it if you prefer but it's more effective to have one file per datasource.

yaml
filenames:
 - /logs/auth.log
 - /logs/syslog
labels:
  type: syslog
---
filename: /logs/apache2/*.log
labels:
  type: apache2

Recommended configuration

Volumes

We strongly suggest persisting the Crowdsec configuration and database in named volumes, or bind-mount them from the host, to avoid losing credentials and decision data in case of container destruction and recreation, version update, etc.

• Credentials and configuration: /etc/crowdsec
• Acquisition: /etc/crowdsec/acquis.d and/or /etc/crowdsec.acquis.yaml (yes, they can be nested in /etc/crowdsec)
• Database when using SQLite (default): /var/lib/crowdsec/data

Start a Crowdsec instance

shell
docker run -d \
    -v crowdsec_config:/etc/crowdsec \
    -v local_path_to_crowdsec_config/acquis.d:/etc/crowdsec/acquis.d \
    -v local_path_to_crowdsec_config/acquis.yaml:/etc/crowdsec/acquis.yaml \
    -v crowdsec_data:/var/lib/crowdsec/data \
    -v /var/log/auth.log:/logs/auth.log:ro \
    -v /var/log/syslog.log:/logs/syslog.log:ro \
    -v /var/log/apache:/logs/apache:ro \
    -e COLLECTIONS="crowdsecurity/apache2 crowdsecurity/sshd" \
    -p 8080:8080 -p 6060:6060 \
    --name crowdsec crowdsecurity/crowdsec

... or docker-compose

Check this full-stack example using docker-compose: [***]

How to extend this image

Full configuration

The container is built with a specific docker configuration. If you need to change it and the docker variables (see below) are not enough, you can mount /etc/crowdsec/config.yaml.local from the host. The file should contain only the options from config.yaml that you want to change, as documented in Overriding values.

It is not recommended anymore to bind-mount the full config.yaml file and you should not need to do it.

Notifications

If you want to use the notification system, you have to use the full image (not slim) and mount at least a custom profiles.yaml and a notification configuration to /etc/crowdsec/notifications

shell
docker run -d \
    -v ./profiles.yaml:/etc/crowdsec/profiles.yaml \
    -v ./http_notification.yaml:/etc/crowdsec/notifications/http_notification.yaml \
    -p 8080:8080 -p 6060:6060 \
    --name crowdsec crowdsecurity/crowdsec

Deployment use cases

Crowdsec is composed of an agent that parses logs and creates alerts, and a local API (LAPI) that transforms these alerts into decisions. Both functions are provided by the same executables, so the agent and the LAPI can run in the same or separate containers. In complex configurations, it makes sense to have agents on each machine that runs the protected applications, and a LAPI that gathers all signals from agents and communicates with the central API.

Register a new agent with LAPI

Without TLS authentication:

shell
docker exec -it crowdsec_lapi_container_name cscli machines add agent_user_name --password agent_password

With TLS authentication:

Agents are automatically registered and don't need a username or password. The agents' names are derived from the IP address from which they connect.

Run an agent connected to LAPI

Add the following environment variables to the docker run command:

• DISABLE_LOCAL_API=true
• AGENT_USERNAME="agent_user_name" - agent_user_name previously registered with LAPI
• AGENT_PASSWORD="agent_password" - agent_password previously registered with LAPI
• LOCAL_API_URL="[***]"

Next steps

Bouncers

Crowdsec being a detection component, the remediation is implemented using bouncers. Each bouncer protects a specific component. Find out more:

[***]

[***]

Automatic Bouncer Registration

Without TLS authentication:

You can register bouncers with the crowdsec container at startup, using environment variables or Docker secrets. You cannot use this process to update an existing bouncer without first deleting it.

To use environment variables, they should be in the format BOUNCER_KEY_<name>=<key>. e.g. BOUNCER_KEY_nginx=mysecretkey***.

To use Docker secrets, the secret should be named bouncer_key_<name> with a content of <key>. e.g. bouncer_key_nginx with content mysecretkey***.

A bouncer key can be any string but we recommend an alphanumeric value for consistency with the keys generated by crowdsec and to avoid problems with escaping special characters.

With TLS authentication:

Bouncers are automatically registered and don't need an API key. The bouncers' names are derived from the IP address from which they connect.

Console

We provide a web-based interface to get more from Crowdsec: [***]

Subscribe here: [***]

Caveats

Using binds rather than named volumes (complete explanation here) results in more complexity as you'll have to bind the relevant files one by one whereas with named volumes you can mount full configuration and data folders. On the other hand, named volumes are less straightforward to navigate.

Reference

Environment Variables

Note for persistent configurations (i.e. bind mount or volumes): when a variable is set, its value may be written to the appropriate file (usually config.yaml) each time the container is run.