fail2ban安装及使用(debian)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189

我的博客已迁移到xdoujiang.com请去那边和我交流 一、基础环境 1、fail2ban可以监视你的系统日志，然后匹配日志的错误信息（正则式匹配）执行相应的屏蔽动作 （一般情况下是调用防火墙屏蔽），如:当有人在试探你的SSH、SMTP、FTP密码，只要达到你预设的次数， fail2ban就会调用防火墙屏蔽这个IP，而且可以发送e-mail通知系统管理员，是一款很实用、很强大的软件！ 2、版本 cat /etc/debian_version 7.4 3、ip 10.131.172.202 二、安装fail2ban 1、apt或dpkg安装 apt-get -y install fail2ban 或 dpkg -i fail2ban_0.8.6-3wheezy3_all.deb PS:下载地址 http: //ftp .cn.debian.org /debian/pool/main/f/fail2ban/fail2ban_0 .8.6-3wheezy3_all.deb 2、查看配置 ll /etc/fail2ban/ drwxr-xr-x 2 root root 4096 Jun 19 14:15 action.d -rw-r--r-- 1 root root 853 Nov 29 2011 fail2ban.conf drwxr-xr-x 2 root root 4096 Jun 19 15:43 filter.d -rw-r--r-- 1 root root 7347 Jun 19 15:51 jail.conf 3、修改配置支持 ssh 和apache cat /etc/fail2ban/jail . local (PS:这个配置文件一定是以. local 结尾的) [DEFAULT] ignoreip = 127.0.0.1 /8 172.31.0.0 /24 10.0.0.0 /8 192.168.0.0 /24 bantime = 86400 maxretry = 10 findtime = 600 [ ssh -iptables] enabled = true port = 55000 filter = sshd logpath = /var/log/auth .log maxretry = 5 [apache] enabled = true port = 80,443 filter = apache-auth logpath = /var/log/apache */*error.log maxretry = 6 [apache-noscript] enabled = true port = 80,443 filter = apache-noscript logpath = /var/log/apache */*error.log maxretry = 6 [apache-overflows] enabled = true port = 80,443 filter = apache-overflows logpath = /var/log/apache */*error.log maxretry = 2 [apache-nohome] enabled = true port = 80,443 filter = apache-nohome logpath = /var/log/apache */*error.log maxretry = 2 PS:我这里 ssh 端口是55000 apache是80 netstat -tupnl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID /Program name tcp 0 0 0.0.0.0:55000 0.0.0.0:* LISTEN 29921 /sshd tcp 0 0 127.0.0.1:9898 0.0.0.0:* LISTEN 30949 /barad_agent tcp6 0 0 :::80 :::* LISTEN 3964 /apache2 tcp6 0 0 :::55000 :::* LISTEN 29921 /sshd 4、重启服务 /etc/init .d /fail2ban restart [ ok ] Restarting authentication failure monitor: fail2ban. 5、查看日志 2015-06-19 22:06:37,139 fail2ban.server : INFO Changed logging target to /var/log/fail2ban .log for Fail2ban v0.8.6 2015-06-19 22:06:37,140 fail2ban.jail : INFO Creating new jail 'apache' 2015-06-19 22:06:37,140 fail2ban.jail : INFO Jail 'apache' uses Gamin 2015-06-19 22:06:37,149 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error .log 2015-06-19 22:06:37,150 fail2ban.filter : INFO Set maxRetry = 6 2015-06-19 22:06:37,151 fail2ban.filter : INFO Set findtime = 600 2015-06-19 22:06:37,151 fail2ban.actions: INFO Set banTime = 86400 2015-06-19 22:06:37,154 fail2ban.jail : INFO Creating new jail 'apache-noscript' 2015-06-19 22:06:37,154 fail2ban.jail : INFO Jail 'apache-noscript' uses Gamin 2015-06-19 22:06:37,155 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error .log 2015-06-19 22:06:37,155 fail2ban.filter : INFO Set maxRetry = 6 2015-06-19 22:06:37,156 fail2ban.filter : INFO Set findtime = 600 2015-06-19 22:06:37,157 fail2ban.actions: INFO Set banTime = 86400 2015-06-19 22:06:37,161 fail2ban.jail : INFO Creating new jail 'apache-overflows' 2015-06-19 22:06:37,161 fail2ban.jail : INFO Jail 'apache-overflows' uses Gamin 2015-06-19 22:06:37,161 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error .log 2015-06-19 22:06:37,162 fail2ban.filter : INFO Set maxRetry = 2 2015-06-19 22:06:37,163 fail2ban.filter : INFO Set findtime = 600 2015-06-19 22:06:37,163 fail2ban.actions: INFO Set banTime = 86400 2015-06-19 22:06:37,166 fail2ban.jail : INFO Creating new jail 'ssh-iptables' 2015-06-19 22:06:37,167 fail2ban.jail : INFO Jail 'ssh-iptables' uses Gamin 2015-06-19 22:06:37,167 fail2ban.filter : INFO Added logfile = /var/log/auth .log 2015-06-19 22:06:37,167 fail2ban.filter : INFO Set maxRetry = 5 2015-06-19 22:06:37,169 fail2ban.filter : INFO Set findtime = 600 2015-06-19 22:06:37,169 fail2ban.actions: INFO Set banTime = 86400 2015-06-19 22:06:37,188 fail2ban.jail : INFO Creating new jail 'apache-nohome' 2015-06-19 22:06:37,188 fail2ban.jail : INFO Jail 'apache-nohome' uses Gamin 2015-06-19 22:06:37,189 fail2ban.filter : INFO Added logfile = /var/log/apache2/svn_error .log 2015-06-19 22:06:37,189 fail2ban.filter : INFO Set maxRetry = 2 2015-06-19 22:06:37,190 fail2ban.filter : INFO Set findtime = 600 2015-06-19 22:06:37,191 fail2ban.actions: INFO Set banTime = 86400 2015-06-19 22:06:37,194 fail2ban.jail : INFO Jail 'apache' started 2015-06-19 22:06:37,196 fail2ban.jail : INFO Jail 'apache-noscript' started 2015-06-19 22:06:37,197 fail2ban.jail : INFO Jail 'apache-overflows' started 2015-06-19 22:06:37,198 fail2ban.jail : INFO Jail 'ssh-iptables' started 2015-06-19 22:06:37,200 fail2ban.jail : INFO Jail 'apache-nohome' started 6、查看iptables已经生效了 iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-apache-nohome tcp -- 0.0.0.0 /0 0.0.0.0 /0 multiport dports 80,443 fail2ban- ssh -iptables tcp -- 0.0.0.0 /0 0.0.0.0 /0 multiport dports 55000 fail2ban-apache-overflows tcp -- 0.0.0.0 /0 0.0.0.0 /0 multiport dports 80,443 fail2ban-apache-noscript tcp -- 0.0.0.0 /0 0.0.0.0 /0 multiport dports 80,443 fail2ban-apache tcp -- 0.0.0.0 /0 0.0.0.0 /0 multiport dports 80,443 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-apache (1 references) target prot opt source destination RETURN all -- 0.0.0.0 /0 0.0.0.0 /0 Chain fail2ban-apache-nohome (1 references) target prot opt source destination RETURN all -- 0.0.0.0 /0 0.0.0.0 /0 Chain fail2ban-apache-noscript (1 references) target prot opt source destination RETURN all -- 0.0.0.0 /0 0.0.0.0 /0 Chain fail2ban-apache-overflows (1 references) target prot opt source destination RETURN all -- 0.0.0.0 /0 0.0.0.0 /0 Chain fail2ban- ssh -iptables (1 references) target prot opt source destination RETURN all -- 0.0.0.0 /0 0.0.0.0 /0 7、使用fail2ban-client命令查看状态 fail2ban-client status Status |- Number of jail: 5 - Jail list: apache, apache-overflows, apache-nohome, apache-noscript, ssh -iptables 8、更细致的查看某个项 fail2ban-client status ssh -iptables Status for the jail: ssh -iptables |- filter | |- File list: /var/log/auth .log | |- Currently failed: 0 | `- Total failed: 0 `- action |- Currently banned: 0 | `- IP list: `- Total banned: 0 9、将服务加入到开机启动 update-rc.d fail2ban defaults update-rc.d: using dependency based boot sequencing 10、查看下日志轮询信息 cat /etc/logrotate .d /fail2ban /var/log/fail2ban .log { weekly rotate 4 compress delaycompress missingok postrotate fail2ban-client set logtarget /var/log/fail2ban .log > /dev/null endscript # If fail2ban runs as non-root it still needs to have write access # to logfiles. # create 640 fail2ban adm create 640 root adm } 三、参考文章 http: //xmodulo .com /how-to-protect-ssh-server-from-brute-force-attacks-using-fail2ban .html https: //linux .cn /article-5068-qqmail .html

本文转自 xdoujiang 51CTO博客，原文链接：http://blog.51cto.com/7938217/1652970，如需转载请自行联系原作者