---
title: "Linux利用fail2ban+iptables加固系统，防止SSH暴力破解 - Terry的技术笔记"
source: "https://blog.terrynow.com/2022/02/06/linux-centos-fail2ban-iptables-prevent-ssh-from-brute-force-attack/"
author:
published:
created: 2026-04-15
description: "前面的文章有介绍防火墙是firewalld的情况下，使用fail2ban来防止SSH暴力破解的情况，详见：https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/ 如果系统使用的是iptables防火墙，配置的方法有所不同。 关于如何安装和开启iptables防火墙，详见：https://blog.terrynow.com/2021/02/16/centos7-ub […]"
tags:
- "clippings"
---
前面的文章有介绍防火墙是firewalld的情况下，使用fail2ban来防止SSH暴力破解的情况，详见： [https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/](https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/)
如果系统使用的是iptables防火墙，配置的方法有所不同。
关于如何安装和开启iptables防火墙，详见： [https://blog.terrynow.com/2021/02/16/centos7-ubuntu-iptables-firewall/](https://blog.terrynow.com/2021/02/16/centos7-ubuntu-iptables-firewall/)
## 首先准备fail2ban
#开启iptables防火墙
systemctl start iptables
#设置防火墙开机启动
systemctl enable iptables
#安装epel-release
yum install epel-release
#安装fail2ban
yum install fail2ban
#开启iptables防火墙 systemctl start iptables #设置防火墙开机启动 systemctl enable iptables #安装epel-release yum install epel-release #安装fail2ban yum install fail2ban
```csharp
#开启iptables防火墙
systemctl start iptables
#设置防火墙开机启动
systemctl enable iptables
#安装epel-release
yum install epel-release
#安装fail2ban
yum install fail2ban
```
## 配置fail2ban的规则
安装好后fail2ban配置文件在/etc/fail2ban，其中jail.conf为主配置文件，相关的匹配规则位于filter.d目录，这里不做介绍，也没有用到。
新建文件 `/etc/fail2ban/jail.local` ，内容如下
\# vim /etc/fail2ban/jail.local
\[DEFAULT\]
\# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
\# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip \= 127.0.0.1 172.16.0.0 /12 10.0.0.0 /8 192.168.0.0 /24
\# 客户端主机被禁止的时长（秒）
bantime \= 86400
\# 客户端主机被禁止前允许失败的次数
maxretry \= 5
\# 查找失败次数的时长（秒）
findtime \= 600
\[sshd\]
enabled \= true
filter \= sshd
action \= iptables \[name=SSH, port=ssh, protocol=tcp\]
\# SSH的日志文件路径
logpath \= /var/log/secure
\# ssh 服务的最大尝试次数
maxretry \= 3
\# vim /etc/fail2ban/jail.local \[DEFAULT\] # 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名 # 用于指定哪些地址可以忽略 fail2ban 防御 ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24 # 客户端主机被禁止的时长（秒） bantime = 86400 # 客户端主机被禁止前允许失败的次数 maxretry = 5 # 查找失败次数的时长（秒） findtime = 600 \[sshd\] enabled = true filter = sshd action = iptables\[name=SSH, port=ssh, protocol=tcp\] # SSH的日志文件路径 logpath = /var/log/secure # ssh 服务的最大尝试次数 maxretry = 3
```csharp
# vim /etc/fail2ban/jail.local
[DEFAULT]
# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24
# 客户端主机被禁止的时长（秒）
bantime = 86400
# 客户端主机被禁止前允许失败的次数
maxretry = 5
# 查找失败次数的时长（秒）
findtime = 600
[sshd]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
# SSH的日志文件路径
logpath = /var/log/secure
# ssh 服务的最大尝试次数
maxretry = 3
```
上述配置意思是，fail2ban会自动禁止在最近10分钟内有超过3次访问尝试失败的任意IP地址。一旦被禁，这个IP地址将会在24小时内一直被禁止访问 SSH 服务。
配置好了以后，重启下fail2ban
\# 重启fail2ban
systemctl restart fail2ban
\# 开机启动
systemctl enable fail2ban
\# 重启fail2ban systemctl restart fail2ban # 开机启动 systemctl enable fail2ban
```csharp
# 重启fail2ban
systemctl restart fail2ban
# 开机启动
systemctl enable fail2ban
```
## 检查fail2ban状态并解禁被锁住的IP地址
可以随便找一台不在白名单中的IP地址的机器用错误的密码ssh多次测试
\# 查看iptables状态
iptables --list -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- 0.0.0.0 / 0 0.0.0.0 / 0 tcp dpt:22
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
DROP all -- 192.168.1.8 0.0.0.0 / 0
RETURN all -- 0.0.0.0 / 0 0.0.0.0 / 0
检验fail2ban状态（会显示出当前活动的被ban列表）：
fail2ban-client status
\# 查看iptables状态 iptables --list -n Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-SSH (1 references) target prot opt source destination DROP all -- 192.168.1.8 0.0.0.0/0 RETURN all -- 0.0.0.0/0 0.0.0.0/0 检验fail2ban状态（会显示出当前活动的被ban列表）： fail2ban-client status
```csharp
# 查看iptables状态
iptables --list -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
DROP all -- 192.168.1.8 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
检验fail2ban状态（会显示出当前活动的被ban列表）：
fail2ban-client status
```
查看fail2ban的SSH状态：
\[root@localhost ~\]# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 59
| \`- Journal matches: \_SYSTEMD\_UNIT=sshd.service \+ \_COMM=sshd
\`- Actions
|- Currently banned: 1
|- Total banned: 5
\`- Banned IP list: 192.168.1.8
\[root@localhost ~\]# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 59 | \`- Journal matches: \_SYSTEMD\_UNIT=sshd.service + \_COMM=sshd \`- Actions |- Currently banned: 1 |- Total banned: 5 \`- Banned IP list: 192.168.1.8
```csharp
[root@localhost ~]# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 59
| \`- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
\`- Actions
|- Currently banned: 1
|- Total banned: 5
\`- Banned IP list: 192.168.1.8
```
取消被ban的IP：
\# 取消被ban的IP
\[root@localhost ~\]# fail2ban-client set sshd unbanip 192.168.1.8
1
\# 取消被ban的IP \[root@localhost ~\]# fail2ban-client set sshd unbanip 192.168.1.8 1
```csharp
# 取消被ban的IP
[root@localhost ~]# fail2ban-client set sshd unbanip 192.168.1.8
1
```
fail2ban的日志路径是：/var/log/fail2ban.log
查看加入黑名单日志：
sudo zgrep 'Ban' /var/log/fail2ban.log\*
sudo zgrep 'Ban' /var/log/fail2ban.log\*
```csharp
sudo zgrep 'Ban' /var/log/fail2ban.log*
```