fail2ban 使用

最新推荐文章于 2024-07-05 11:00:04 发布

xluren

最新推荐文章于 2024-07-05 11:00:04 发布

阅读量1.2k

点赞数 1

分类专栏：个人总结文章标签： ssh fail2ban

本文链接：https://blog.csdn.net/xluren/article/details/39299169

版权

个人总结专栏收录该内容

66 篇文章 0 订阅

订阅专栏

1.安装简单，

yum install fail2ban

修改一个参数

31 # Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
 32 #
 33 logtarget = /var/log/fail2ban.log
 34 
 35 # Option: socket

把日志输出到文件，这样就可以清晰的看到一些执行输出了

2.启动

/etc/init.d/fail2ban start

3.测试 ssh

[root@test ~]# ssh root@10.210.71.145
root@10.210.71.145's password: 
Permission denied, please try again.
root@10.210.71.145's password: 
Permission denied, please try again.
root@10.210.71.145's password: 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
[root@test ~]# ssh root@10.210.71.145
root@10.210.71.145's password: 
Permission denied, please try again.
root@10.210.71.145's password: 
Permission denied, please try again.
root@10.210.71.145's password: 
qwqwqw
wqwqwqwqw
qwqwqwqw

iptables

[root@test ~]# cat /etc/hosts|grep 'test.143'
10.210.71.143   test.143
[root@test ~]#  iptables -L 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
REJECT     all  --  test.143             anywhere            reject-with icmp-port-unreachable 
RETURN     all  --  anywhere             anywhere

日志输出

[root@test log]# tail -f fail2ban.log 
From: Fail2Ban <fail2ban@example.com>
To: you@example.com\n
Hi,\n
The IP 10.210.71.143 has just been banned by Fail2Ban after
6 attempts against SSH.\n\n
Here is more information about 10.210.71.143:\n
`/usr/bin/whois 10.210.71.143 || echo missing whois program`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2ban@example.com you@example.com returned 4b00
2014-09-16 10:16:51,246 fail2ban.actions[28550]: WARNING [ssh-iptables] Unban 10.210.71.143
2014-09-16 10:19:50,545 fail2ban.actions[28550]: WARNING [ssh-iptables] Ban 10.210.71.143
2014-09-16 10:19:50,767 fail2ban.actions.action[28550]: ERROR   printf %b "Subject: [Fail2Ban] SSH: banned 10.210.71.143 from `uname -n`
Date: `LC_TIME=C date -u +"%a, %d %h %Y %T +0000"`
From: Fail2Ban <fail2ban@example.com>
To: you@example.com\n
Hi,\n
The IP 10.210.71.143 has just been banned by Fail2Ban after
5 attempts against SSH.\n\n
Here is more information about 10.210.71.143:\n
`/usr/bin/whois 10.210.71.143 || echo missing whois program`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2ban@example.com you@example.com returned 4b00

具体细节根据情况配置

比如Apache的accesslog errorlog 什么的。