# Newbie questions before installation

**URL:** <https://discourse.crowdsec.net/t/newbie-questions-before-installation/465>\
**Category:** crowdsec\
**Created:** [December 18, 2021, 9:17pm UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465 "2021-12-18T21:17:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![martin.schaible](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/martin.schaible/32/223_2.png) [@martin.schaible](https://discourse.crowdsec.net/u/martin.schaible)\
**Post date:** [December 18, 2021, 9:17pm UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465/1 "2021-12-18T21:17:48Z")

</div>

Hello

We are running some CentOS servers with Plesk and running the “usual stuff”. Other servers are running tomcat with Lucee (CFML engine).

I’m quite familiary with Fail2Ban, but honestly i don’t like it much 🙂

I have spend some time for your the documention, but i haven’t found some specific information about these topics:

- Does CrowdSec protect already SSH Logins?

- I have seen a bouncer for nginx, but what is about apache webserver (httpd)? Protected by default?

- I know, that i can create my own bouncers. Can “cscli bouncers example” used as a template or should i use the custom-bouncer? Also new parsers or scenarios might be needed, i guess

- I would like to protect the logins for several Web applications like NextCloud, Shopware, Plesk, preside CMS and others. Can i take the WordPress Bouncer as a role model for this? Sometimes it’s easier to learn from a template as an addition for the docs, at least in my case.

- I have already seen a post regarding blocking known IP addresses, which isn’t possible out of the box. Any idea, how to do this or is this maybe already on your roadmap?

Thank you very much

Cheers

Martin

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [December 19, 2021, 8:30am UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465/2 "2021-12-19T08:30:19Z")

</div>

Hi Martin and thanks for your questions!

> [@martin.schaible](#):
>
> - Does CrowdSec protect already SSH Logins?
> 
> Yes when you install CrowdSec it detects relevant services to protect. And since ssh typically is installed on a Linux/FreeBSD server, it installs protecting by those by default.
> 
> - I have seen a bouncer for nginx, but what is about apache webserver (httpd)? Protected by default?
> 
> There’s no bouncer for Apache. But there’s an apache logparser which, together with the firewall bouncer can be used to protect it.
> 
> - I know, that i can create my own bouncers. Can “cscli bouncers example” used as a template or should i use the custom-bouncer? Also new parsers or scenarios might be needed, i guess
> 
> Could you elaborate what you mean by ‘cscli bouncer example’?. It depends on what you’re trying to do. I admit the naming of this is a bit confusing but the intention of the custom bouncer is that it can execute a custom script whenever a scenario triggers. For example we have a user that uses it to execute a custom script that adds an ip to an Apache blocklist and reload Apache. I am not sure it scales very well but it’s a quick and dirty way to get an Apache bouncer. New parsers would probably be needed but not nescessarily new scenarions as those operate on a higher level of abstraction.
> 
> - I would like to protect the logins for several Web applications like NextCloud, Shopware, Plesk, preside CMS and others. Can i take the WordPress Bouncer as a role model for this? Sometimes it’s easier to learn from a template as an addition for the docs, at least in my case.
> 
> I don’t know the programming language of all those but you would have a few possibilities here. If they’re made with php it would be possible to protect them with the [generic php bouncer](https://crowdsec.net/blog/protect-php-websites/). Another solution would be to put a reverse proxy such as nginx, traefik or haproxy in from of Plesk and protect that with CrowdSec. All are supported in one way or another, check our [hub](https://hub.crowdsec.net/) for details.
> 
> - I have already seen a post regarding blocking known IP addresses, which isn’t possible out of the box. Any idea, how to do this or is this maybe already on your roadmap?
> 
> Could you elaborate on this? I am not sure I understand. What do you mean by ‘known ip adresses’?

I hope my reply on those questions I knew the reply to made sense. If not, feel free to ask again.

---

<div class="post-metadata">

**Author:** ![martin.schaible](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/martin.schaible/32/223_2.png) [@martin.schaible](https://discourse.crowdsec.net/u/martin.schaible)\
**Post date:** [December 26, 2021, 1:07pm UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465/3 "2021-12-26T13:07:37Z")

</div>

Hi Klaus

Thanks for your answers. I think, i need to clarify some questions 🙂

- I have already seen a post regarding blocking known IP addresses, which isn’t possible out of the box. Any idea, how to do this or is this maybe already on your roadmap?

I have some notorious hacker attacks from several networks. Instead of blocking them directly in the firewall, which is silly work in Plesk, i wanted to block IP addresses or even whole ranges in CrowdSec.

- I would like to protect the logins for several Web applications like NextCloud, Shopware, Plesk, preside CMS and others. Can i take the WordPress Bouncer as a role model for this? Sometimes it’s easier to learn from a template as an addition for the docs, at least in my case.

You answer sounds complicated to this question. With Fail2Ban we’re checking the log files for failed login attemps. I think, the basics of these pattern can be reused with CrowdSec.

Since i’m not really fit with the used terms in CrowdSec in like to have kinda custom “module” or however it is named for each action.

Maybe it would make sense to start with CrowSec to learn things 🙂

Many Thanks

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [December 27, 2021, 2:20pm UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465/4 "2021-12-27T14:20:54Z")

</div>

Hi Martin

I am sure the replies to your question is a bit limited by me not knowing anything at all about Plesk. If it runs in a webserver supported by CrowdSec (e.g. Apache, nginx or Caddy), attacks can be detected and blocked on whatever level the bouncer you choose, blocks traffic at.

I don’t know how patterns are made with fail2ban but with CrowdSec they’re made with Grok. But you’re at least right that you can get a certain understanding of how logs are constructed from fail2ban parsers. If f2b parsers are made in regexp it should be relatively easy to convert.

I think you’re right in that you should be installing. To me that is the best way to get to understand a new technology.

Feel free to ask again if my replies weren’t sufficient.

---

<div class="post-metadata">

**Author:** ![martin.schaible](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/martin.schaible/32/223_2.png) [@martin.schaible](https://discourse.crowdsec.net/u/martin.schaible)\
**Post date:** [December 28, 2021, 6:11pm UTC](https://discourse.crowdsec.net/t/newbie-questions-before-installation/465/5 "2021-12-28T18:11:14Z")

</div>

Hi Klaus!

Thanks for the update! I’m sure, i can learn a lot from the stuff from the hub 🙂