StudyDiary/10-WebClipper/Linux利用fail2ban+iptables加固系统，防止SSH暴力破解 - Terry的技术笔记.md at 126486b0cd3c7a540e1b7919f615387352f9a719 - StudyDiary

gtAdmin/StudyDiary

Fork 0

Files

T

CrazyJasonwell 513b68be8c first commit

2026-07-23 20:36:13 +08:00

7.9 KiB

Raw Blame History

title, source, author, published, created, description, tags

title

source

author

published

created

description

首先准备fail2ban

#开启iptables防火墙

systemctl start iptables

#设置防火墙开机启动

systemctl enable iptables

#安装epel-release

yum install epel-release

#安装fail2ban

yum install fail2ban

#开启iptables防火墙 systemctl start iptables #设置防火墙开机启动 systemctl enable iptables #安装epel-release yum install epel-release #安装fail2ban yum install fail2ban

#开启iptables防火墙
systemctl start iptables

#设置防火墙开机启动
systemctl enable iptables

#安装epel-release
yum install epel-release
#安装fail2ban
yum install fail2ban

配置fail2ban的规则

安装好后fail2ban配置文件在/etc/fail2ban，其中jail.conf为主配置文件，相关的匹配规则位于filter.d目录，这里不做介绍，也没有用到。

新建文件 /etc/fail2ban/jail.local ，内容如下

# vim /etc/fail2ban/jail.local

[DEFAULT]

# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名

# 用于指定哪些地址可以忽略 fail2ban 防御

ignoreip = 127.0.0.1 172.16.0.0 /12 10.0.0.0 /8 192.168.0.0 /24

# 客户端主机被禁止的时长（秒）

bantime = 86400

# 客户端主机被禁止前允许失败的次数

maxretry = 5

# 查找失败次数的时长（秒）

findtime = 600

[sshd]

enabled = true

filter = sshd

action = iptables [name=SSH, port=ssh, protocol=tcp]

# SSH的日志文件路径

logpath = /var/log/secure

# ssh 服务的最大尝试次数

maxretry = 3

# vim /etc/fail2ban/jail.local [DEFAULT] # 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名 # 用于指定哪些地址可以忽略 fail2ban 防御 ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24 # 客户端主机被禁止的时长（秒） bantime = 86400 # 客户端主机被禁止前允许失败的次数 maxretry = 5 # 查找失败次数的时长（秒） findtime = 600 [sshd] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] # SSH的日志文件路径 logpath = /var/log/secure # ssh 服务的最大尝试次数 maxretry = 3

# vim /etc/fail2ban/jail.local

[DEFAULT]
# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24
 
# 客户端主机被禁止的时长（秒）
bantime = 86400
 
# 客户端主机被禁止前允许失败的次数 
maxretry = 5
 
# 查找失败次数的时长（秒）
findtime = 600
 
[sshd]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
# SSH的日志文件路径
logpath = /var/log/secure
# ssh 服务的最大尝试次数 
maxretry = 3

上述配置意思是，fail2ban会自动禁止在最近10分钟内有超过3次访问尝试失败的任意IP地址。一旦被禁，这个IP地址将会在24小时内一直被禁止访问 SSH 服务。

配置好了以后，重启下fail2ban

# 重启fail2ban

systemctl restart fail2ban

# 开机启动

systemctl enable fail2ban

# 重启fail2ban systemctl restart fail2ban # 开机启动 systemctl enable fail2ban

# 重启fail2ban
systemctl restart fail2ban

# 开机启动
systemctl enable fail2ban

检查fail2ban状态并解禁被锁住的IP地址

可以随便找一台不在白名单中的IP地址的机器用错误的密码ssh多次测试

# 查看iptables状态

iptables --list -n

Chain INPUT (policy ACCEPT)

target prot opt source destination

fail2ban-SSH tcp -- 0.0.0.0 / 0 0.0.0.0 / 0 tcp dpt:22

Chain FORWARD (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Chain fail2ban-SSH (1 references)

target prot opt source destination

DROP all -- 192.168.1.8 0.0.0.0 / 0

RETURN all -- 0.0.0.0 / 0 0.0.0.0 / 0

检验fail2ban状态（会显示出当前活动的被ban列表）：

<span class= "pln" >fail2ban<span class= "pun" >-<span class= "pln" >client status

# 查看iptables状态 iptables --list -n Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-SSH (1 references) target prot opt source destination DROP all -- 192.168.1.8 0.0.0.0/0 RETURN all -- 0.0.0.0/0 0.0.0.0/0 检验fail2ban状态（会显示出当前活动的被ban列表）： fail2ban-client status

# 查看iptables状态
iptables --list -n

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-SSH  tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
 
Chain fail2ban-SSH (1 references)
target     prot opt source               destination
DROP       all  --  192.168.1.8          0.0.0.0/0
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

检验fail2ban状态（会显示出当前活动的被ban列表）：
fail2ban-client status

查看fail2ban的SSH状态：

[root@localhost ~]# fail2ban-client status sshd

Status for the jail: sshd

|- Filter

| |- Currently failed: 0

| |- Total failed: 59

| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd

`- Actions

|- Currently banned: 1

|- Total banned: 5

`- Banned IP list: 192.168.1.8

[root@localhost ~]# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:    0
|  |- Total failed:    59
|  \`- Journal matches:    _SYSTEMD_UNIT=sshd.service + _COMM=sshd
\`- Actions
   |- Currently banned:    1
   |- Total banned:    5
   \`- Banned IP list:    192.168.1.8

取消被ban的IP：

# 取消被ban的IP

[root@localhost ~]# fail2ban-client set sshd unbanip 192.168.1.8

# 取消被ban的IP [root@localhost ~]# fail2ban-client set sshd unbanip 192.168.1.8 1

# 取消被ban的IP
[root@localhost ~]#  fail2ban-client set sshd unbanip 192.168.1.8
1

fail2ban的日志路径是：/var/log/fail2ban.log

查看加入黑名单日志：

sudo zgrep 'Ban' /var/log/fail2ban.log*

sudo zgrep 'Ban' /var/log/fail2ban.log*

7.9 KiB Raw Blame History Unescape Escape

首先准备fail2ban

配置fail2ban的规则

检查fail2ban状态并解禁被锁住的IP地址

7.9 KiB

Raw Blame History