--
參考資源
--
安裝
Ununtu
|
1 |
# apt-get install fail2ban |
CentOS 7
|
1 |
# yum install fail2ban |
--
系統服務
例如要控管 ssh 可以這樣設定
編輯 jail.conf
|
1 |
# vi /etc/fail2ban/jail.conf |
設定 sshd 區段
|
1 2 3 4 5 6 7 |
[sshd] port = ssh logpath = %(sshd_log)s backend = %(sshd_backend)s maxretry = 3 findtime = 30 bantime = 300 |
將 fail2ban 服務開啟及啟動
|
1 |
# systemctl enable --now fail2ban |
--
維護
查看有作用
|
1 |
# fail2ban-client status |
查看作用執行細節
|
1 |
# fail2ban-client status web |
|
1 2 3 4 5 6 7 8 9 |
Status for the jail: web |- Filter | |- Currently failed: 0 | |- Total failed: 4 | `- File list: /WEBSite/login_fail.log `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 192.168.0.99 |
解除單一 IP 封鎖
|
1 |
# fail2ban-client set sshd unbanip 172.16.1.100 |
解除全部封鎖
|
1 |
# fail2ban-client unban --all |
--
自訂服務應用 - 以網頁登入為例
如果其他應用也要套用，例如網頁登入，那就要多費點功夫
- fail2ban regex not matching
- Regex not matching for no reason #2078
- jail.conf(5) — fail2ban — Debian testing — Debian Manpages
需要自訂規則建議先使用 fail2ban-regex 指令進行模擬，如此決定 log 格式以及正規式規則
log 至少需要包含 IP 以及時間，時間最好包含時區，例如
|
1 |
192.168.0.99 2020-11-22 00:00:30 CST |
使用 fail2ban-regex 驗證正規式是否可抓取 log 資料格式
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
# fail2ban-regex -d '%Y-%m-%d %H:%M:%S %Z' '192.168.0.99 2020-11-21 14:03:00 CST' '<ADDR> .*' Running tests ============= Use datepattern : Year-Month-Day 24hour:Minute:Second Use failregex line : <ADDR> .* Use single line : 192.168.0.99 2020-11-21 14:03:00 Results ======= Failregex: 1 total |- #) [# of hits] regular expression | 1) [1] <ADDR> .* `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [1] Year-Month-Day 24hour:Minute:Second `- Lines: 1 lines, 0 ignored, 1 matched, 0 missed [processed in 0.00 sec] |
編輯過濾規則設定檔
|
1 |
# vi /etc/fail2ban/filter.d/hoyo-web.conf |
datepattern 的百分比符號在設定檔內是連續 2 個
|
1 2 3 4 |
[Definition] failregex = ^<ADDR> .*$ datepattern = %%Y-%%m-%%d %%H:%%M:%%S %%Z ignoreregex = |
編輯 jail.local
|
1 |
# vi /etc/fail2ban/jail.local |
|
1 2 3 4 5 6 7 |
[web] enabled = true filter = hoyo-web logpath = /WEBSite/login_fail.log maxretry = 3 findtime = 10 bantime = 300 |
再次使用 fail2ban-regex 驗證，這次使用檔案驗證
|
1 |
# fail2ban-regex ./login_fail.log /etc/fail2ban/filter.d/hoyo-web.conf |
--
823 total views, 1 views today