--<\/p>\n
--<\/p>\n
Ununtu<\/p>\n
# apt-get install fail2ban<\/pre>\nCentOS 7<\/p>\n
# yum install fail2ban<\/pre>\n--<\/p>\n
\u7cfb\u7d71\u670d\u52d9<\/h2>\n
\u4f8b\u5982\u8981\u63a7\u7ba1 ssh \u53ef\u4ee5\u9019\u6a23\u8a2d\u5b9a<\/p>\n
\u7de8\u8f2f jail.conf<\/p>\n
# vi \/etc\/fail2ban\/jail.conf<\/pre>\n\u8a2d\u5b9a sshd \u5340\u6bb5<\/p>\n
[sshd]\r\nport = ssh\r\nlogpath = %(sshd_log)s\r\nbackend = %(sshd_backend)s\r\nmaxretry = 3\r\nfindtime = 30\r\nbantime = 300<\/pre>\n\u5c07 fail2ban \u670d\u52d9\u958b\u555f\u53ca\u555f\u52d5<\/p>\n
# systemctl enable --now fail2ban<\/pre>\n--<\/p>\n
\u7dad\u8b77<\/h2>\n
\u67e5\u770b\u6709\u4f5c\u7528<\/p>\n
# fail2ban-client status<\/pre>\n\u67e5\u770b\u4f5c\u7528\u57f7\u884c\u7d30\u7bc0<\/p>\n
# fail2ban-client status web<\/pre>\nStatus for the jail: web\r\n|- Filter\r\n| |- Currently failed: 0\r\n| |- Total failed: 4\r\n| `- File list: \/WEBSite\/login_fail.log\r\n`- Actions\r\n |- Currently banned: 1\r\n |- Total banned: 1\r\n `- Banned IP list: 192.168.0.99<\/pre>\n\u89e3\u9664\u55ae\u4e00 IP \u5c01\u9396<\/p>\n
# fail2ban-client set sshd unbanip 172.16.1.100<\/pre>\n\u89e3\u9664\u5168\u90e8\u5c01\u9396<\/p>\n
# fail2ban-client unban --all<\/pre>\n--<\/p>\n
\u81ea\u8a02\u670d\u52d9\u61c9\u7528 - \u4ee5\u7db2\u9801\u767b\u5165\u70ba\u4f8b<\/h2>\n
\u5982\u679c\u5176\u4ed6\u61c9\u7528\u4e5f\u8981\u5957\u7528\uff0c\u4f8b\u5982\u7db2\u9801\u767b\u5165\uff0c\u90a3\u5c31\u8981\u591a\u8cbb\u9ede\u529f\u592b<\/p>\n
\u9700\u8981\u81ea\u8a02\u898f\u5247\u5efa\u8b70\u5148\u4f7f\u7528 fail2ban-regex \u6307\u4ee4\u9032\u884c\u6a21\u64ec\uff0c\u5982\u6b64\u6c7a\u5b9a log \u683c\u5f0f\u4ee5\u53ca\u6b63\u898f\u5f0f\u898f\u5247<\/p>\n
log \u81f3\u5c11\u9700\u8981\u5305\u542b IP \u4ee5\u53ca\u6642\u9593\uff0c\u6642\u9593\u6700\u597d\u5305\u542b\u6642\u5340\uff0c\u4f8b\u5982<\/p>\n
192.168.0.99 2020-11-22 00:00:30 CST<\/pre>\n\u4f7f\u7528 fail2ban-regex \u9a57\u8b49\u6b63\u898f\u5f0f\u662f\u5426\u53ef\u6293\u53d6 log \u8cc7\u6599\u683c\u5f0f<\/p>\n
# fail2ban-regex -d '%Y-%m-%d %H:%M:%S %Z' '192.168.0.99 2020-11-21 14:03:00 CST' '<ADDR> .*'\r\n\r\nRunning tests\r\n=============\r\n\r\nUse datepattern : Year-Month-Day 24hour:Minute:Second\r\nUse failregex line : <ADDR> .*\r\nUse single line : 192.168.0.99 2020-11-21 14:03:00\r\n\r\n\r\nResults\r\n=======\r\n\r\nFailregex: 1 total\r\n|- #) [# of hits] regular expression\r\n| 1) [1] <ADDR> .*\r\n`-\r\n\r\nIgnoreregex: 0 total\r\n\r\nDate template hits:\r\n|- [# of hits] date format\r\n| [1] Year-Month-Day 24hour:Minute:Second\r\n`-\r\n\r\nLines: 1 lines, 0 ignored, 1 matched, 0 missed\r\n[processed in 0.00 sec]<\/pre>\n\u7de8\u8f2f\u904e\u6ffe\u898f\u5247\u8a2d\u5b9a\u6a94<\/p>\n
# vi \/etc\/fail2ban\/filter.d\/hoyo-web.conf<\/pre>\ndatepattern \u7684\u767e\u5206\u6bd4\u7b26\u865f\u5728\u8a2d\u5b9a\u6a94\u5167\u662f\u9023\u7e8c 2 \u500b<\/p>\n
[Definition]\r\nfailregex = ^<ADDR> .*$\r\ndatepattern = %%Y-%%m-%%d %%H:%%M:%%S %%Z\r\nignoreregex =<\/pre>\n\u7de8\u8f2f jail.local<\/p>\n
# vi \/etc\/fail2ban\/jail.local\r\n<\/pre>\n[web]\r\nenabled = true\r\nfilter = hoyo-web\r\nlogpath = \/WEBSite\/login_fail.log\r\nmaxretry = 3\r\nfindtime = 10\r\nbantime = 300\r\n<\/pre>\n\u518d\u6b21\u4f7f\u7528 fail2ban-regex \u9a57\u8b49\uff0c\u9019\u6b21\u4f7f\u7528\u6a94\u6848\u9a57\u8b49<\/p>\n
# fail2ban-regex .\/login_fail.log \/etc\/fail2ban\/filter.d\/hoyo-web.conf<\/pre>\n--<\/p>\n
<\/div>\n