1.安装简单,
yum install fail2ban
修改一个参数
31 # Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR
32 #
33 logtarget = /var/log/fail2ban.log
34
35 # Option: socket
把日志输出到文件,这样就可以清晰的看到一些执行输出了
2.启动
/etc/init.d/fail2ban start
3.测试 ssh
[root@test ~]# ssh root@10.210.71.145
root@10.210.71.145's password:
Permission denied, please try again.
root@10.210.71.145's password:
Permission denied, please try again.
root@10.210.71.145's password:
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
[root@test ~]# ssh root@10.210.71.145
root@10.210.71.145's password:
Permission denied, please try again.
root@10.210.71.145's password:
Permission denied, please try again.
root@10.210.71.145's password:
qwqwqw
wqwqwqwqw
qwqwqwqw
iptables
[root@test ~]# cat /etc/hosts|grep 'test.143'
10.210.71.143 test.143
[root@test ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
REJECT all -- test.143 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
日志输出
[root@test log]# tail -f fail2ban.log
From: Fail2Ban <fail2ban@example.com>
To: you@example.com\n
Hi,\n
The IP 10.210.71.143 has just been banned by Fail2Ban after
6 attempts against SSH.\n\n
Here is more information about 10.210.71.143:\n
`/usr/bin/whois 10.210.71.143 || echo missing whois program`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2ban@example.com you@example.com returned 4b00
2014-09-16 10:16:51,246 fail2ban.actions[28550]: WARNING [ssh-iptables] Unban 10.210.71.143
2014-09-16 10:19:50,545 fail2ban.actions[28550]: WARNING [ssh-iptables] Ban 10.210.71.143
2014-09-16 10:19:50,767 fail2ban.actions.action[28550]: ERROR printf %b "Subject: [Fail2Ban] SSH: banned 10.210.71.143 from `uname -n`
Date: `LC_TIME=C date -u +"%a, %d %h %Y %T +0000"`
From: Fail2Ban <fail2ban@example.com>
To: you@example.com\n
Hi,\n
The IP 10.210.71.143 has just been banned by Fail2Ban after
5 attempts against SSH.\n\n
Here is more information about 10.210.71.143:\n
`/usr/bin/whois 10.210.71.143 || echo missing whois program`\n
Regards,\n
Fail2Ban" | /usr/sbin/sendmail -f fail2ban@example.com you@example.com returned 4b00
具体细节根据情况配置
比如Apache的accesslog errorlog 什么的。