CrowdSec 1.8 on Debian (1/3): leaving the distro package

CrowdSec protects all my servers: it reads logs, detects hostile behaviour (SSH brute force, web scans…) and has offending addresses blocked by a “bouncer” at the firewall. Five Rocky Linux machines were already on 1.8.1, installed from CrowdSec’s official repository. That left the Raspberry Pi doing DNS and DHCP, on Debian 12, with 1.4.6 from the Debian repositories.

Why not keep the Debian version

• 1.4.6 is years behind: scenarios, parsers and the community list have moved on a lot since;
• a uniform fleet: one Ansible role, one version, one behaviour to know;
• the Debian bouncer (0.0.25) needed workarounds (systemd service type, a stray config file) that the official version no longer requires.

Why reinstall rather than upgrade

You can’t just add the CrowdSec repo and run apt upgrade. The Debian bouncer is called crowdsec-firewall-bouncer, and the official repo’s is crowdsec-firewall-bouncer-nftables: two different packages shipping the same files, so they conflict. And with state: present, Ansible wouldn’t replace an installed version. The clean way is to uninstall, then reinstall from the official repository.

Step 1: back up

systemctl stop crowdsec-firewall-bouncer crowdsec
tar czf /root/backup/crowdsec-pre18.tgz /etc/crowdsec
sqlite3 /var/lib/crowdsec/data/crowdsec.db ".backup /root/backup/crowdsec-pre18.db"
sqlite3 /root/backup/crowdsec-pre18.db "PRAGMA integrity_check;"     # must answer ok

The SQLite database holds local decisions and alert history. .backup uses SQLite’s backup API, which gives a consistent copy even if a process still has it open. The integrity_check confirms the copy is sound before going further.

Step 2: purge, keeping a way back

DEBIAN_FRONTEND=noninteractive apt-get purge -y crowdsec crowdsec-firewall-bouncer
for d in /etc/crowdsec /etc/systemd/system/crowdsec-firewall-bouncer.service.d; do
  [ -e "$d" ] && mv "$d" "$d.old-deb"
done
systemctl daemon-reload

Two notes. purge also deletes the package’s config files, unlike remove: you start from a clean base. And the purge deletes /var/lib/crowdsec itself, hence the importance of backing up the database in step 1.

During this window, the Pi has no CrowdSec protection. DNS keeps working: it doesn’t depend on CrowdSec. It’s a matter of minutes, the time for the next step, covered in the next post… with an unexpected trap.

---

This post is part of a series of sysadmin notes (tag “sysadmin notebook”).
Series “CrowdSec 1.8 on Debian”, part 1/3. · Next post → (coming 4 Nov) · Version française