wget mirrors.linuxeye.com/oneinstack.tar.gz
pushd oneinstack
./addons.sh #选择8,安装fail2ban
[root@OneinStack ~]# cat /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 #指定哪些地址可以忽略 fail2ban 防御
bantime = 86400 #客户端主机被禁止的时长(秒)
findtime = 600 #查找失败次数的时长(秒)
maxretry = 5 #客户端主机被禁止前允许失败的次数
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=22, protocol=tcp]
logpath = /var/log/secure
fail2ban会自动禁止在最近10分钟内有超过5次访问尝试失败的任意IP地址。这个IP地址将会在24小时内一直被禁止访问SSH服务。安装设置启用后,Fail2ban会在iptables添加相关规则,如下:
ssh 你的服务器IP,输错密码5次以上,查看日志/var/log/fail2ban.log [ssh-iptables] Ban 91.195.103.166即被禁用
/usr/local/python/bin/fail2ban-client status ssh-iptables
显示出被禁止IP地址列表
/usr/local/python/bin/fail2ban-client set ssh-iptables unbanip 91.195.103.166
参考链接 https://www.exehack.net/4776.html
转载于:https://blog.51cto.com/adcit/1963410