fail2ban防护ssh暴力破解

环境:
系统: CentOS 7
fail2ban: 0.11.1-10.el7

安装fail2ban

yum install fail2ban

配置/etc/fail2ban/jail.local

[DEFAULT]
ignoreip = 127.0.0.1 172.18.0.0/16
findtime = 10m
bantime = 24hbanaction = iptables-multiport[sshd]
enabled = true
port = 592
logpath = /var/log/secure
maxretry = 3

功能测试

IP加入黑名单及禁用时间到期后自动解除黑名单
以nginx + naxis为例

1. 在/etc/fail2ban下创建ip.blacklist
2. 修改/etc/fail2ban/action.d/iptables-multiport.conf

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
# Modified by Yaroslav Halchenko for multiport banning
#[INCLUDES]before = iptables-common.conf[Definition]# Option:  actionstart
# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values:  CMD
#
actionstart =  -N f2b- -A f2b- -j  -I  -p  -m multiport --dports  -j f2b-cat /etc/fail2ban/ip.blacklist | sort -u | while read IP; do iptables -I f2b- 1 -s $IP -j DROP; done# Option:  actionstop
# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
# Values:  CMD
#
actionstop =  -D  -p  -m multiport --dports  -j f2b- -X f2b-# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =  -n -L  | grep -q 'f2b-[ \t]'# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban =  -I f2b- 1 -s  -j echo  >> /etc/fail2ban/ip.blacklist# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban =  -D f2b- -s  -j /usr/bin/sed -i "//d" /etc/fail2ban/ip.blacklist[Init]

3. 在/etc/fail2ban/filter.d/nginx-naxsi.conf添加过滤规则

[INCLUDES]
before = common.conf[Definition]
failregex = NAXSI_FMT: ip=&server=.*&uri=.*&learning=0NAXSI_FMT: ip=.*&config=block
ignoreregex = NAXSI_FMT: ip=.*&config=learning

4. 编辑/etc/fail2ban/jail.local并添加监控项

[nginx-naxsi]
enabled = true
port = http,https
filter = nginx-naxsi
logpath = /var/log/nginx/*error.log
findtime = 20m
#bantime = 600m   # 封禁ip 10小时
bantime = 480h   # 封禁ip 480小时
#bantime = -1      # 永久封禁非法访问ip
maxretry = 3

本文来自互联网用户投稿，文章观点仅代表作者本人，不代表本站立场，不承担相关法律责任。如若转载，请注明出处。 如若内容造成侵权/违法违规/事实不符，请点击【内容举报】进行投诉反馈！