使用yum安装fail2ban
先安装epel
yum -y install epel-release
安装fail2ban
yum -y install fail2ban
启动服务
systemctl enable fail2ban
systemctl start fail2ban
查看版本
fail2ban-client -V
Fail2Ban v0.9.7
Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).
Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>.
Many contributions by Yaroslav O. Halchenko <debian@onerussian.com>.
修改配置文件
vim /etc/fail2ban/jail.conf
在末尾添加
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
#sendmail-whois[name=SSH, dest=your@email.com, sender=fail2ban@email.com]
logpath = /var/log/secure
maxretry = 3
bantime = 300
重启服务
systemctl restart fail2ban
在其他服务器
ssh test@192.168.2.62 -p 222
故意输入三次错误密码
再次尝试连接,还是提示输入密码
怎么会没被禁用了,在fail2ban服务器中查看
fail2ban-client status ssh-iptables
显示如下,发现已经添加了规则,
Status for the jail: ssh-iptables
|- Filter
| |- Currently failed: 0
| |- Total failed: 6
| `- File list: /var/log/secure
`- Actions
|- Currently banned: 1
|- Total banned: 2
`- Banned IP list: 192.168.2.63
经过多次重试,发现是配置文件问题,因为我的sshd端口是222而配置文件中
action = iptables[name=SSH, port=ssh, protocol=tcp]
port使用的是ssh,这个默认是22,再次修改配置文件
action = iptables[name=SSH, port=222, protocol=tcp]
重启fail2ban服务
systemctl restart fail2ban
再次到192.168.2.63中重试
ssh test@192.168.2.62 -p 222
故意输入三次错误密码后提示
ssh: connect to host 192.168.2.62 port 222: Connection refused
这次成功了!!