Setting up a Multi-Server Security Engine Installation
Mar 09, 2025 pm 12:02 PMThis guide demonstrates how to configure a multi-server CrowdSec Security Engine, enhancing your network's collective security. One server acts as the parent (server-1), receiving alerts from child Log Processors (server-2 and server-3). This architecture allows for distributed threat detection and remediation.
Server-1, the parent, hosts the HTTP REST API (LAPI) and manages signal storage and distribution. Server-2 and server-3, the children, are internet-facing, forwarding alerts to server-1. Remediation, managed by Remediation Components, is independent of detection and relies on server-1's LAPI. Child Log Processors have their LAPI disabled to conserve resources.
Key Considerations:
- A PostgreSQL backend is recommended for server-1's LAPI for enhanced stability (though SQLite with WAL is a viable alternative).
- Requires three Ubuntu 22.04 servers: one parent and two children, connected via a local network.
Setup Steps:
1. Parent LAPI Server (server-1):
-
Install CrowdSec: Follow the installation guide and use the provided commands:
curl -s https:/packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash sudo apt install crowdsec
-
(Optional) PostgreSQL Setup: If using PostgreSQL, install it (
sudo apt install postgresql
), create thecrowdsec
database and user, grant privileges, and update/etc/crowdsec/config.yaml
'sdb_config
section accordingly. Regenerate credentials and restart CrowdSec.sudo -i -u postgres psql # ... PostgreSQL commands ... sudo cscli machines add -a –force sudo systemctl restart crowdsec
-
Expose LAPI Port: Modify
/etc/crowdsec/config.yaml
to expose the LAPI port (e.g.,10.0.0.1:8080
).api: server: listen_uri: 10.0.0.1:8080
2. Child Log Processors (server-2 & server-3):
-
Install CrowdSec: Use the same installation commands as server-1.
-
Register with LAPI: Register each child with server-1's LAPI:
sudo cscli lapi register -u http://10.0.0.1:8080
-
Disable Child LAPI: Disable the local API in
/etc/crowdsec/config.yaml
:api: server: enable: false
-
Validate Registration: On server-1, validate each child using
cscli machines list
andcscli machines validate <machine_id></machine_id>
. -
Restart CrowdSec: Restart CrowdSec on each child.
3. Remediation (server-2 & server-3):
-
Generate API Key: On server-1, generate an API key for each child using
cscli bouncers add <bouncer_name></bouncer_name>
. -
Install Remediation Component: Install the
cs-firewall-bouncer-iptables
component. -
Configure Remediation Component: Configure
/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml
with the API URL and key. -
Restart Remediation Component: Restart the
crowdsec-firewall-bouncer
service.
Important Notes:
- Communication between servers is currently unencrypted HTTP (consider HTTPS for production).
- This setup lacks monitoring and alerting (refer to CrowdSec documentation for details).
- Server-1 is a single point of failure.
This enhanced setup provides a more robust and scalable security posture. Future articles will cover high-availability configurations. Engage with the CrowdSec community for support and feedback.
The above is the detailed content of Setting up a Multi-Server Security Engine Installation. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Are you looking for good software to write mathematical equations? If so, this article provides the top 5 equation editors that you can easily install on your favorite Linux distribution.In addition to being compatible with different types of mathema

Linux administrators should be familiar with the command-line environment. Since GUI (Graphical User Interface) mode in Linux servers is not commonly installed.SSH may be the most popular protocol to enable Linux administrators to manage the servers

Gogo is a remarkable tool to bookmark directories inside your Linux shell. It helps you create shortcuts for long and complex paths in Linux. This way, you no longer need to type or memorize lengthy paths on Linux.For example, if there's a directory

PPA is an important tool for Ubuntu users to expand their software sources. 1. When searching for PPA, you should visit Launchpad.net, confirm the official PPA in the project official website or document, and read the description and user comments to ensure its security and maintenance status; 2. Add PPA to use the terminal command sudoadd-apt-repositoryppa:/, and then run sudoaptupdate to update the package list; 3. Manage PPAs to view the added list through the grep command, use the --remove parameter to remove or manually delete the .list file to avoid problems caused by incompatibility or stopping updates; 4. Use PPA to weigh the necessity and prioritize the situations that the official does not provide or require a new version of the software.

LXD is described as the next-generation container and virtual machine manager that offers an immersive for Linux systems running inside containers or as virtual machines. It provides images for an inordinate number of Linux distributions with support

How to quickly generate test files of a specified size? It can be achieved using command line tools or graphical software. On Windows, you can use fsutilfilecreatenew file name size to generate a file with a specified byte; macOS/Linux can use ddif=/dev/zeroof=filebs=1Mcount=100 to generate real data files, or use truncate-s100M files to quickly create sparse files. If you are not familiar with the command line, you can choose FSUtilGUI, DummyFileGenerator and other tool software. Notes include: pay attention to file system limitations (such as FAT32 file size upper limit), avoid overwriting existing files, and some programs may

Node Version Manager (NVM) is a simple bash script that helps manage multiple Node.js versions on your Linux system. It enables you to install various Node.js versions, view available versions for installation, and check already installed versions.NV

The key to installing dual systems in Linux and Windows is partitioning and boot settings. 1. Preparation includes backing up data and compressing existing partitions to make space; 2. Use Ventoy or Rufus to make Linux boot USB disk, recommend Ubuntu; 3. Select "Coexist with other systems" or manually partition during installation (/at least 20GB, /home remaining space, swap optional); 4. Check the installation of third-party drivers to avoid hardware problems; 5. If you do not enter the Grub boot menu after installation, you can use boot-repair to repair the boot or adjust the BIOS startup sequence. As long as the steps are clear and the operation is done properly, the whole process is not complicated.
