Centos 7 使用fail2ban防止暴力破解，启动fail2ban服务后重试多次后IP没被禁用

使用yum安装fail2ban

---

先安装epel

yum -y install epel-release

安装fail2ban

yum -y install fail2ban
 

启动服务

systemctl enable  fail2ban

systemctl start  fail2ban

 

查看版本

fail2ban-client -V
Fail2Ban v0.9.7

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier .
Many contributions by Yaroslav O. Halchenko .

修改配置文件

vim /etc/fail2ban/jail.conf 

在末尾添加

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
#sendmail-whois[name=SSH, dest=your@email.com, sender=fail2ban@email.com]
logpath = /var/log/secure
maxretry = 3
bantime = 300
 

重启服务

systemctl restart  fail2ban

在其他服务器

ssh test@192.168.2.62 -p 222

故意输入三次错误密码

再次尝试连接，还是提示输入密码

怎么会没被禁用了，在fail2ban服务器中查看

fail2ban-client status ssh-iptables
显示如下，发现已经添加了规则，

Status for the jail: ssh-iptables
|- Filter
|  |- Currently failed:    0
|  |- Total failed:    6
|  `- File list:    /var/log/secure
`- Actions
   |- Currently banned:    1
   |- Total banned:    2
   `- Banned IP list:    192.168.2.63
 

经过多次重试，发现是配置文件问题，因为我的sshd端口是222而配置文件中

action = iptables[name=SSH, port=ssh, protocol=tcp] 

port使用的是ssh，这个默认是22，再次修改配置文件

action = iptables[name=SSH, port=222, protocol=tcp] 

重启fail2ban服务

systemctl restart  fail2ban

再次到192.168.2.63中重试

ssh test@192.168.2.62 -p 222

故意输入三次错误密码后提示

ssh: connect to host 192.168.2.62 port 222: Connection refused

 这次成功了！！