267 lines
7.9 KiB
Markdown
267 lines
7.9 KiB
Markdown
---
|
||
title: "Linux利用fail2ban+iptables加固系统，防止SSH暴力破解 - Terry的技术笔记"
|
||
source: "https://blog.terrynow.com/2022/02/06/linux-centos-fail2ban-iptables-prevent-ssh-from-brute-force-attack/"
|
||
author:
|
||
published:
|
||
created: 2026-04-15
|
||
description: "前面的文章有介绍防火墙是firewalld的情况下，使用fail2ban来防止SSH暴力破解的情况，详见：https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/ 如果系统使用的是iptables防火墙，配置的方法有所不同。 关于如何安装和开启iptables防火墙，详见：https://blog.terrynow.com/2021/02/16/centos7-ub […]"
|
||
tags:
|
||
- "clippings"
|
||
---
|
||
前面的文章有介绍防火墙是firewalld的情况下，使用fail2ban来防止SSH暴力破解的情况，详见： [https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/](https://blog.terrynow.com/2021/09/17/linux-centos-fail2ban-firwalld-prevent-ssh-from-brute-force-attack/)
|
||
|
||
如果系统使用的是iptables防火墙，配置的方法有所不同。
|
||
|
||
关于如何安装和开启iptables防火墙，详见： [https://blog.terrynow.com/2021/02/16/centos7-ubuntu-iptables-firewall/](https://blog.terrynow.com/2021/02/16/centos7-ubuntu-iptables-firewall/)
|
||
|
||
## 首先准备fail2ban
|
||
|
||
#开启iptables防火墙
|
||
|
||
systemctl start iptables
|
||
|
||
#设置防火墙开机启动
|
||
|
||
systemctl enable iptables
|
||
|
||
#安装epel-release
|
||
|
||
yum install epel-release
|
||
|
||
#安装fail2ban
|
||
|
||
yum install fail2ban
|
||
|
||
#开启iptables防火墙 systemctl start iptables #设置防火墙开机启动 systemctl enable iptables #安装epel-release yum install epel-release #安装fail2ban yum install fail2ban
|
||
|
||
```csharp
|
||
#开启iptables防火墙
|
||
systemctl start iptables
|
||
|
||
#设置防火墙开机启动
|
||
systemctl enable iptables
|
||
|
||
#安装epel-release
|
||
yum install epel-release
|
||
#安装fail2ban
|
||
yum install fail2ban
|
||
```
|
||
|
||
## 配置fail2ban的规则
|
||
|
||
安装好后fail2ban配置文件在/etc/fail2ban，其中jail.conf为主配置文件，相关的匹配规则位于filter.d目录，这里不做介绍，也没有用到。
|
||
|
||
新建文件 `/etc/fail2ban/jail.local` ，内容如下
|
||
|
||
\# vim /etc/fail2ban/jail.local
|
||
|
||
\[DEFAULT\]
|
||
|
||
\# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
|
||
|
||
\# 用于指定哪些地址可以忽略 fail2ban 防御
|
||
|
||
ignoreip \= 127.0.0.1 172.16.0.0 /12 10.0.0.0 /8 192.168.0.0 /24
|
||
|
||
\# 客户端主机被禁止的时长（秒）
|
||
|
||
bantime \= 86400
|
||
|
||
\# 客户端主机被禁止前允许失败的次数
|
||
|
||
maxretry \= 5
|
||
|
||
\# 查找失败次数的时长（秒）
|
||
|
||
findtime \= 600
|
||
|
||
\[sshd\]
|
||
|
||
enabled \= true
|
||
|
||
filter \= sshd
|
||
|
||
action \= iptables \[name=SSH, port=ssh, protocol=tcp\]
|
||
|
||
\# SSH的日志文件路径
|
||
|
||
logpath \= /var/log/secure
|
||
|
||
\# ssh 服务的最大尝试次数
|
||
|
||
maxretry \= 3
|
||
|
||
\# vim /etc/fail2ban/jail.local \[DEFAULT\] # 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名 # 用于指定哪些地址可以忽略 fail2ban 防御 ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24 # 客户端主机被禁止的时长（秒） bantime = 86400 # 客户端主机被禁止前允许失败的次数 maxretry = 5 # 查找失败次数的时长（秒） findtime = 600 \[sshd\] enabled = true filter = sshd action = iptables\[name=SSH, port=ssh, protocol=tcp\] # SSH的日志文件路径 logpath = /var/log/secure # ssh 服务的最大尝试次数 maxretry = 3
|
||
|
||
```csharp
|
||
# vim /etc/fail2ban/jail.local
|
||
|
||
[DEFAULT]
|
||
# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
|
||
# 用于指定哪些地址可以忽略 fail2ban 防御
|
||
ignoreip = 127.0.0.1 172.16.0.0/12 10.0.0.0/8 192.168.0.0/24
|
||
|
||
# 客户端主机被禁止的时长（秒）
|
||
bantime = 86400
|
||
|
||
# 客户端主机被禁止前允许失败的次数
|
||
maxretry = 5
|
||
|
||
# 查找失败次数的时长（秒）
|
||
findtime = 600
|
||
|
||
[sshd]
|
||
enabled = true
|
||
filter = sshd
|
||
action = iptables[name=SSH, port=ssh, protocol=tcp]
|
||
# SSH的日志文件路径
|
||
logpath = /var/log/secure
|
||
# ssh 服务的最大尝试次数
|
||
maxretry = 3
|
||
```
|
||
|
||
上述配置意思是，fail2ban会自动禁止在最近10分钟内有超过3次访问尝试失败的任意IP地址。一旦被禁，这个IP地址将会在24小时内一直被禁止访问 SSH 服务。
|
||
|
||
配置好了以后，重启下fail2ban
|
||
|
||
\# 重启fail2ban
|
||
|
||
systemctl restart fail2ban
|
||
|
||
\# 开机启动
|
||
|
||
systemctl enable fail2ban
|
||
|
||
\# 重启fail2ban systemctl restart fail2ban # 开机启动 systemctl enable fail2ban
|
||
|
||
```csharp
|
||
# 重启fail2ban
|
||
systemctl restart fail2ban
|
||
|
||
# 开机启动
|
||
systemctl enable fail2ban
|
||
```
|
||
|
||
## 检查fail2ban状态并解禁被锁住的IP地址
|
||
|
||
可以随便找一台不在白名单中的IP地址的机器用错误的密码ssh多次测试
|
||
|
||
\# 查看iptables状态
|
||
|
||
iptables --list -n
|
||
|
||
Chain INPUT (policy ACCEPT)
|
||
|
||
target prot opt source destination
|
||
|
||
fail2ban-SSH tcp -- 0.0.0.0 / 0 0.0.0.0 / 0 tcp dpt:22
|
||
|
||
Chain FORWARD (policy ACCEPT)
|
||
|
||
target prot opt source destination
|
||
|
||
Chain OUTPUT (policy ACCEPT)
|
||
|
||
target prot opt source destination
|
||
|
||
Chain fail2ban-SSH (1 references)
|
||
|
||
target prot opt source destination
|
||
|
||
DROP all -- 192.168.1.8 0.0.0.0 / 0
|
||
|
||
RETURN all -- 0.0.0.0 / 0 0.0.0.0 / 0
|
||
|
||
检验fail2ban状态（会显示出当前活动的被ban列表）：
|
||
|
||
<span class= "pln" \>fail2ban</span><span class= "pun" \>-</span><span class= "pln" \>client status</span>
|
||
|
||
\# 查看iptables状态 iptables --list -n Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-SSH (1 references) target prot opt source destination DROP all -- 192.168.1.8 0.0.0.0/0 RETURN all -- 0.0.0.0/0 0.0.0.0/0 检验fail2ban状态（会显示出当前活动的被ban列表）： <span class="pln">fail2ban</span><span class="pun">-</span><span class="pln">client status</span>
|
||
|
||
```csharp
|
||
# 查看iptables状态
|
||
iptables --list -n
|
||
|
||
Chain INPUT (policy ACCEPT)
|
||
target prot opt source destination
|
||
fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
|
||
|
||
Chain FORWARD (policy ACCEPT)
|
||
target prot opt source destination
|
||
|
||
Chain OUTPUT (policy ACCEPT)
|
||
target prot opt source destination
|
||
|
||
Chain fail2ban-SSH (1 references)
|
||
target prot opt source destination
|
||
DROP all -- 192.168.1.8 0.0.0.0/0
|
||
RETURN all -- 0.0.0.0/0 0.0.0.0/0
|
||
|
||
检验fail2ban状态（会显示出当前活动的被ban列表）：
|
||
fail2ban-client status
|
||
```
|
||
|
||
查看fail2ban的SSH状态：
|
||
|
||
\[root@localhost ~\]# fail2ban-client status sshd
|
||
|
||
Status for the jail: sshd
|
||
|
||
|- Filter
|
||
|
||
| |- Currently failed: 0
|
||
|
||
| |- Total failed: 59
|
||
|
||
| \`- Journal matches: \_SYSTEMD\_UNIT=sshd.service \+ \_COMM=sshd
|
||
|
||
\`- Actions
|
||
|
||
|- Currently banned: 1
|
||
|
||
|- Total banned: 5
|
||
|
||
\`- Banned IP list: 192.168.1.8
|
||
|
||
\[root@localhost ~\]# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 59 | \`- Journal matches: \_SYSTEMD\_UNIT=sshd.service + \_COMM=sshd \`- Actions |- Currently banned: 1 |- Total banned: 5 \`- Banned IP list: 192.168.1.8
|
||
|
||
```csharp
|
||
[root@localhost ~]# fail2ban-client status sshd
|
||
Status for the jail: sshd
|
||
|- Filter
|
||
| |- Currently failed: 0
|
||
| |- Total failed: 59
|
||
| \`- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd
|
||
\`- Actions
|
||
|- Currently banned: 1
|
||
|- Total banned: 5
|
||
\`- Banned IP list: 192.168.1.8
|
||
```
|
||
|
||
取消被ban的IP：
|
||
|
||
\# 取消被ban的IP
|
||
|
||
\[root@localhost ~\]# fail2ban-client set sshd unbanip 192.168.1.8
|
||
|
||
1
|
||
|
||
\# 取消被ban的IP \[root@localhost ~\]# fail2ban-client set sshd unbanip 192.168.1.8 1
|
||
|
||
```csharp
|
||
# 取消被ban的IP
|
||
[root@localhost ~]# fail2ban-client set sshd unbanip 192.168.1.8
|
||
1
|
||
```
|
||
|
||
fail2ban的日志路径是：/var/log/fail2ban.log
|
||
|
||
查看加入黑名单日志：
|
||
|
||
sudo zgrep 'Ban' /var/log/fail2ban.log\*
|
||
|
||
sudo zgrep 'Ban' /var/log/fail2ban.log\*
|
||
|
||
```csharp
|
||
sudo zgrep 'Ban' /var/log/fail2ban.log*
|
||
``` |