Docs · Intrusion detection

Intrusion detection

Intrusion detection watches a server's logs for attacks such as SSH password guessing and web probes, and can ban the offending addresses at the firewall. It is optional and is installed only when you choose to install it from the dashboard.

What it does

The agent installs CrowdSec together with an nftables firewall bouncer. CrowdSec reads the logs your services already write and recognises attack patterns; the bouncer applies bans at the firewall. Nothing is installed until you click install on the server's Intrusion page, and you can disable it there again.

Monitor and Protect

Intrusion detection starts in Monitor. In Monitor it only watches: the events timeline shows what would have been blocked, and nothing is blocked. When you are satisfied with what you see, switch to Protect, where attacking addresses are banned automatically. Switching to Protect asks you to confirm that bans are automatic and time-limited.

Bans and the safety cap

• ·Every ban is time-limited. The default is 4 hours.
• ·Repeat offenders are banned for progressively longer, with the duration doubling up to 7 days.
• ·A safety cap limits how many different addresses can be banned in a window (100 per 10 minutes by default). If bans spike beyond it, the agent pauses bans from web-scanner rules while brute-force, exploit and every other detection keep banning, and alerts you. If afterwards a single rule alone bans a large number of different addresses — which usually means it is misfiring — that rule is paused too. Pauses lift automatically after an hour at normal levels (longer if the cap keeps tripping within a day). Agents older than 0.2.120 pause Protect entirely and revert to Monitor until the policy is saved again.
• ·Existing bans expire on their own; you can also lift an active ban from the Active bans table.

Allowlists

Addresses on the allowlist are never banned. When you enable intrusion detection, or switch to Protect, you can add your own IP address automatically. You can add further IPs or CIDR ranges, either for the whole organisation or for a single server.

Alongside fail2ban, LFD and cPHulk

Where fail2ban, LFD (csf) or cPHulk already protects a service, CrowdSec stays observe-only for that service in Protect, so the two tools do not compete. You can choose to let CrowdSec block that service as well. It works on cPanel/csf and Plesk servers.

Shared blocklist

Addresses that high-confidence detections see attacking several Astrari-protected servers are shared with the other protected servers, so an attacker can be blocked before reaching you. The Intrusion page shows how many entries are applied and how many recent attacks came from addresses already on the list. In Monitor these are reported as would-have-been-blocked.

Plans

Intrusion detection is not included on Starter. Basic covers SSH and web. Professional, Agency and White-label cover every service: SSH, web, mail, FTP and control panels (cPanel and Plesk).

Supported systems

Ubuntu, Debian, and AlmaLinux, Rocky Linux, RHEL and CloudLinux 8 and 9.

Switching back to Monitor

Open the server's Intrusion page and choose Switch to Monitor. New bans stop immediately and existing ones expire on their own. Disable removes intrusion detection from the server altogether.