拾光小筑

1
# 更新软件包列表
2
sudo apt update
3

4
# 安装 Fail2ban
5
sudo apt install fail2ban -y

1
# 安装 EPEL 仓库
2
sudo yum install epel-release -y
3

4
# 安装 Fail2ban
5
sudo yum install fail2ban -y

1
# 启动 Fail2ban
2
sudo systemctl start fail2ban
3

4
# 设置开机自启
5
sudo systemctl enable fail2ban
6

7
# 查看状态
8
sudo systemctl status fail2ban

1
# 编辑主配置文件
2
sudo vim /etc/fail2ban/jail.conf

1
# 创建自定义配置文件
2
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
3

4
# 编辑自定义配置
5
sudo vim /etc/fail2ban/jail.local

1
[DEFAULT]
2
# 封禁时间（秒），默认 600 秒（10分钟）
3
bantime = 600
4

5
# 检测时间窗口（秒），默认 600 秒（10分钟）
6
findtime = 600
7

8
# 最大尝试次数，超过这个次数就封禁
9
maxretry = 5
10

11
# 是否发送邮件通知
12
sendmail-whois = root@localhost
13

14
# 忽略的 IP 地址（不会被封禁）
15
ignoreip = 127.0.0.1/8 192.168.1.0/24

1
[sshd]
2
enabled = true
3
port = ssh
4
filter = sshd
5
logpath = /var/log/auth.log
6
maxretry = 3
7
bantime = 3600  # 封禁1小时

1
# 查看整体状态
2
sudo fail2ban-client status
3

4
# 查看特定服务的状态
5
sudo fail2ban-client status sshd

1
# 查看被 SSH 服务封禁的 IP
2
sudo fail2ban-client status sshd

1
# 解封特定 IP
2
sudo fail2ban-client set sshd unbanip 192.168.1.100

1
# 手动封禁特定 IP
2
sudo fail2ban-client set sshd banip 192.168.1.100

1
# 修改配置后需要重新加载
2
sudo fail2ban-client reload

1
[nginx-http-auth]
2
enabled = true
3
filter = nginx-http-auth
4
logpath = /var/log/nginx/error.log
5
maxretry = 3
6
bantime = 3600

1
[wordpress]
2
enabled = true
3
filter = wordpress
4
logpath = /var/log/nginx/access.log
5
maxretry = 5
6
bantime = 3600

1
[vsftpd]
2
enabled = true
3
filter = vsftpd
4
logpath = /var/log/vsftpd.log
5
maxretry = 3
6
bantime = 3600

1
# 创建过滤器文件
2
sudo vim /etc/fail2ban/filter.d/myapp.conf

1
[Definition]
2
failregex = ^.*Failed login from <HOST>.*$
3
ignoreregex =

1
[myapp]
2
enabled = true
3
filter = myapp
4
logpath = /var/log/myapp.log
5
maxretry = 3
6
bantime = 3600

1
# 检查日志
2
sudo tail -f /var/log/fail2ban.log
3

4
# 检查防火墙是否正常
5
sudo iptables -L
6

7
# 检查配置是否正确
8
sudo fail2ban-client -d

1
# 立即解封
2
sudo fail2ban-client set sshd unbanip 你的IP
3

4
# 将自己的 IP 添加到白名单
5
sudo vim /etc/fail2ban/jail.local
6
# 在 ignoreip 中添加你的 IP

1
# 使用 iptables 永久封禁
2
sudo iptables -A INPUT -s 192.168.1.100 -j DROP
3

4
# 保存规则
5
sudo iptables-save > /etc/iptables/rules.v4

1
# 修改 bantime 参数
2
sudo vim /etc/fail2ban/jail.local
3
# 设置 bantime = 86400  # 封禁一天