# How to Install CrowdSec IDS on Ubuntu 22.04

> URL: https://www.atlantic.net/dedicated-server-hosting/how-to-install-crowdsec-ids-on-ubuntu-22-04/ | Published: 2024-06-21 | Updated: 2024-07-15 | Author: Hitesh Jethva

Intrusion Detection Systems (IDS) play a crucial role in safeguarding your network by monitoring and analyzing traffic for suspicious activities and potential threats. CrowdSec is an open-source, collaborative security platform leveraging community-driven threat intelligence’s power to provide robust protection. It offers an efficient and scalable way to detect and mitigate a wide range of security threats, from brute force attacks to more sophisticated exploits.

In this guide, we will walk you through the process of installing CrowdSec IDS on Ubuntu 22.04.

## Step 1 – Install CrowdSec

First, you need to add the CrowdSec repository to install CrowdSec.

```bash
curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | bash
```

This command downloads and runs a script to add the CrowdSec repository to your system.

Next, install CrowdSec.

```bash
apt install crowdsec
```

You will be asked to select the service that you want to monitor.

![](https://www.atlantic.net/wp-content/uploads/2024/06/p1-9.png)
 Select any service and click on **Continue**. You will see the following page.

![](https://www.atlantic.net/wp-content/uploads/2024/06/p2-8.png)
 Select any service from the above list or click on **Cancel** to finish the installation.

## Step 2 – Install Firewall Bouncer

Next, install the CrowdSec Firewall Bouncer for IPTables. This will enable CrowdSec to interact with your firewall to block malicious IPs.

```bash
apt install -y crowdsec-firewall-bouncer-iptables
```

## Step 3 – Verify Installation

To verify that CrowdSec is installed and running correctly, use the following command:

```bash
cscli collections list
```

This will display a list of installed collections:

```bash
COLLECTIONS
─────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Name                               📦 Status    Version  Local Path                                         
─────────────────────────────────────────────────────────────────────────────────────────────────────────────
 crowdsecurity/apache2              ✔️  enabled  0.1      /etc/crowdsec/collections/apache2.yaml             
 crowdsecurity/base-http-scenarios  ✔️  enabled  1.0      /etc/crowdsec/collections/base-http-scenarios.yaml 
 crowdsecurity/http-cve             ✔️  enabled  2.6      /etc/crowdsec/collections/http-cve.yaml            
 crowdsecurity/linux                ✔️  enabled  0.2      /etc/crowdsec/collections/linux.yaml               
 crowdsecurity/sshd                 ✔️  enabled  0.3      /etc/crowdsec/collections/sshd.yaml                
─────────────────────────────────────────────────────────────────────────────────────────────────────────────
```

## Step 4 – Set Up Dashboard

To set up the CrowdSec dashboard, you will need Docker. First, install Docker:

```bash
apt install -y docker.io
```

Then, set up the CrowdSec dashboard:

```bash
cscli dashboard setup
```

You will be prompted to accept the security responsibility for the Metabase instance and to add a new group called ‘crowdsec’. Accept these prompts by typing Yes. The setup process will pull the necessary Docker image and start the Metabase container. Once it’s ready, you will see the following information:

```bash
? CrowdSec takes no responsibility for the security of your metabase instance. Do you accept these responsibilities ? Yes
? For metabase docker to be able to access SQLite file we need to add a new group called 'crowdsec' to the system, is it ok for you ? Yes
INFO Pulling docker image metabase/metabase:v0.46.6.1 
INFO creating container 'crowdsec-metabase'       
INFO waiting for metabase to be up (can take up to a minute) 
............
INFO Metabase is ready                            

	URL       : 'http://127.0.0.1:3000'
	username  : 'crowdsec@crowdsec.net'
	password  : 'cmC3d6ynmhKqopnY'
```

Note down the username and password from the above output.

## Step 5 – Accessing the Dashboard

By default, the CrowdSec dashboard can be accessed only from the local host. To access the dashboard from a remote machine, you need to forward the local port **3000** to the CrowdSec server’s port **3000** using SSH:

```bash
ssh -L 3000:127.0.0.1:3000 your_username@remote_server_ip
```

Replace **your_username** with your actual username on the remote server and **remote_server_ip** with the IP address or hostname of the remote server.

Open your web browser and navigate to **http://127.0.0.1:3000.** This will forward your local port **3000** to port **3000** on the remote server, allowing you to access the remote web application as if it were running locally.

![](https://www.atlantic.net/wp-content/uploads/2024/06/p4-5.png)

Provide your CrowdSec credential and click on Sign In. The CrowdSec dashboard will appear on the following page.

![](https://www.atlantic.net/wp-content/uploads/2024/06/p5-4.png)

## Step 5 – Enable and Disable Scenarios

You can enable or disable specific scenarios using the **cscli** command. For example, to enable the SSH brute-force scenario in simulation mode:

```bash
cscli simulation enable crowdsecurity/ssh-bf
systemctl reload crowdsec
```

To disable the SSH brute-force scenario:

```bash
cscli simulation disable crowdsecurity/ssh-bf
systemctl reload crowdsec
```

## Conclusion

Congratulations! You have successfully installed and configured CrowdSec IDS on Ubuntu 22.04. With CrowdSec, you now have a powerful tool to protect your server from various cyber threats. The dashboard provides an intuitive interface for monitoring and managing security incidents. Regularly check for updates and new scenarios to keep your system secure. You can start deploying CrowdSec IDS on [dedicated server hosting](https://www.atlantic.net/dedicated-server-hosting/) from Atlantic.Net!