一：简单介绍
fail2ban是一款实用软件，可以监视你的系统日志，然后匹配日志的错误信息（正则式匹配）执行相应的屏蔽动作
在企业中，有些很多人会开放root登录，这样就有机会给黑客造成暴力破解的机会，root用户是众所周知的超级管理员，
即使是黑客来暴力破解没有成功，但是也可以造成你的Linux主机一直回应，这样一来你的主机负载就会很高，我们有什么
办法来控制呢，下面实验简单说明使用fail2ban工具的使用，如果深究的同学请登录fail2ban的官方文档熟悉详细操作。
二：实验环境
系统：CentOS6.4_x64
版本：fail2ban-0.8.14.tar.gz
IP：192.168.182.128
三：开始安装
首先安装依赖包
yum install vim gcc gcc-c++ wget -y yum install shorewall gamin-python shorewall-shell shorewall-perl shorewall-common python-inotify python-ctypes -y
下载fail2ban包，官网为http://www.fail2ban.org/wiki/index.php/Main_Page
tar zxvf fail2ban-0.8.14.tar.gz cd fail2ban-0.8.14 python setup.py install
默认安装路径在/etc/fail2ban，jail.conf为主配置文件。
vim /etc/fail2ban/jail.conf ####修改###### 32 ignoreip = 127.0.0.1 94 [ssh-iptables] 95 96 enabled = ture 97 filter = sshd 98 action = iptables[name=SSH, port=ssh, protocol=tcp] 99 sendmail-whois[name=SSH, [email protected], [email protected], sendername="Fail2Ban"] 100 logpath = /var/log/sshd.log 101 maxretry = 3 40 # "bantime" is the number of seconds that a host is banned. 41 bantime = 300 42 43 # A host is banned if it has generated "maxretry" during the last "findtime" 44 # seconds. 45 findtime = 600 46 47 # "maxretry" is the number of failures before a host get banned. 48 maxretry = 3 49
vim /etc/fail2ban/jail.conf ####修改###### 32 ignoreip = 127.0.0.1 94 [ssh-iptables] 95 96 enabled = ture ###开启ssh-iptables 97 filter = sshd 98 action = iptables[name=SSH, port=ssh, protocol=tcp] 99 sendmail-whois[name=SSH, [email protected], [email protected], sendername="Fail2Ban"] 100 logpath = /var/log/secure ##ssh默认登录的日志存放信息 101 maxretry = 3 40 # "bantime" is the number of seconds that a host is banned. 41 bantime = 300 #####锁定300秒/5分钟 42 43 # A host is banned if it has generated "maxretry" during the last "findtime" 44 # seconds. 45 findtime = 600 ####发现时间10分钟 46 47 # "maxretry" is the number of failures before a host get banned. 48 maxretry = 3 ###三次错误 49 #########在10分钟内发现有三次ssh链接错误则锁定5分钟
配置好了我们要怎么启动源码安装的程序呢，首先先把这个程序加到程序启动里面。
[[email protected]129-Slave fail2ban-0.8.14]# grep chkconfig ./* -R --color
./files/redhat-initd:# chkconfig: - 92 08
[[email protected] fail2ban-0.8.14]# cp ./files/redhat-initd /etc/init.d/fail2ban
[[email protected] fail2ban-0.8.14]# /etc/init.d/fail2ban start
Starting fail2ban: WARNING Wrong value for ‘enabled‘ in ‘ssh-iptables‘. Using default one: ‘‘false‘‘
[ OK ]
[[email protected] fail2ban-0.8.14]# ps -aux | grep fail2ban
Warning: bad syntax, perhaps a bogus ‘-‘? See /usr/share/doc/procps-3.2.8/FAQ
root 1533 0.4 1.6 342148 8404 ? Sl 06:37 0:00 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x
root 1558 0.0 0.1 103248 868 pts/0 S+ 06:37 0:00 grep fail2ban
接下来可以看到是有fail2ban的进程，我们进行测试。
[[email protected]129-Slave fail2ban-0.8.14]# ssh 192.168.182.129 The authenticity of host ‘192.168.182.129 (192.168.182.129)‘ can‘t be established. RSA key fingerprint is 29:90:34:7b:a0:05:99:af:79:91:0e:ed:86:ad:cf:75. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added ‘192.168.182.129‘ (RSA) to the list of known hosts. [email protected]192.168.182.129‘s password: Permission denied, please try again. [email protected]192.168.182.129‘s password: Permission denied, please try again. [email protected]192.168.182.129‘s password: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password). [[email protected]129-Slave fail2ban-0.8.14]# ssh 192.168.182.129 ssh: connect to host 192.168.182.129 port 22: Connection refused
########这里我故意输错3次密码，可以见到我第二次链接的时候直接被锁定了。#########
时间： 2024-10-24 09:52:57