{"id":84188,"date":"2024-03-29T13:53:55","date_gmt":"2024-03-29T05:53:55","guid":{"rendered":"https:\/\/docs.pingcode.com\/?p=84188"},"modified":"2024-03-29T13:53:55","modified_gmt":"2024-03-29T05:53:55","slug":"linux%e7%b3%bb%e7%bb%9f%e4%b8%ad%e5%a6%82%e4%bd%95%e4%bd%bf%e7%94%a8fail2ban%e9%98%b2%e6%ad%a2%e6%9a%b4%e5%8a%9b%e7%a0%b4%e8%a7%a3","status":"publish","type":"post","link":"https:\/\/docs.pingcode.com\/ask\/84188.html","title":{"rendered":"Linux\u7cfb\u7edf\u4e2d\u5982\u4f55\u4f7f\u7528Fail2ban\u9632\u6b62\u66b4\u529b\u7834\u89e3"},"content":{"rendered":"

\"Linux\u7cfb\u7edf\u4e2d\u5982\u4f55\u4f7f\u7528Fail2ban\u9632\u6b62\u66b4\u529b\u7834\u89e3\"<\/p>\n

FAI<\/a>l2ban \u662f\u4e00\u4e2a\u7528\u4ee5\u9632\u6b62\u6076\u610f\u66b4\u529b\u7834\u89e3\u7684\u5de5\u5177\uff0c\u5b83\u901a\u8fc7\u5206\u6790\u65e5\u5fd7\u6587\u4ef6\u6765\u76d1\u63a7\u7cfb\u7edf\u4e0a\u7684\u6076\u610f\u5c1d\u8bd5\uff0c\u5f53\u53d1\u73b0\u8fdd\u89c4\u884c\u4e3a\u65f6\uff0c\u5728\u9632\u706b\u5899\u5c42\u9762\u81ea\u52a8\u6267\u884c\u5c01\u7981\u7b56\u7565\u3002Fail2ban \u4e3b\u8981\u7528\u4e8e\u8bc6\u522b\u91cd\u590d\u7684\u767b\u5f55\u5931\u8d25\u5c1d\u8bd5\uff0c\u5e76\u4e14\u57fa\u4e8e\u9884\u5b9a\u4e49\u7684\u89c4\u5219\u5bf9\u6765\u6e90IP\u5730\u5740\u8fdb\u884c\u5c01\u7981<\/strong>\u3002\u914d\u7f6e Fail2ban \u6700\u4e3a\u91cd\u8981\u7684\u4e00\u70b9\u662f\uff0c\u5b83\u53ef\u4ee5\u81ea\u52a8\u66f4\u65b0\u9632\u706b\u5899\u89c4\u5219\uff0c\u4ee5\u9632\u6b62\u7279\u5b9aIP\u5730\u5740\u5728\u4e00\u5b9a\u65f6\u95f4\u5185\u8bbf\u95ee\u7cfb\u7edf\u8d44\u6e90\uff0c\u4ece\u800c\u5927\u5927\u964d\u4f4e\u88ab\u7834\u89e3\u7684\u98ce\u9669\u3002<\/p>\n

\u4e00\u3001\u5b89\u88c5\u53ca\u57fa\u672c\u914d\u7f6e<\/strong><\/h2>\n

Fail2ban \u53ef\u4ee5\u5728\u591a\u79cd Linux \u53d1\u884c\u7248\u4e0a\u6210\u529f\u5b89\u88c5\u548c\u8fd0\u884c\u3002\u5b89\u88c5\u8fc7\u7a0b\u4e00\u822c\u6765\u8bf4\u5f88\u7b80\u5355\uff1a<\/p>\n

“`sh<\/p>\n

CentOS \u7cfb\u7edf<\/strong><\/h2>\n

sudo yum install fail2ban<\/p>\n

Debian\/Ubuntu \u7cfb\u7edf<\/strong><\/h2>\n

sudo apt-get install fail2ban<\/p>\n

“`<\/p>\n

\u5b89\u88c5\u5b8c\u6bd5\u540e\uff0cFail2ban \u7684\u670d\u52a1\u9700\u8981\u88ab\u542f\u52a8\u5e76\u8bbe\u4e3a\u5f00\u673a\u542f\u52a8\uff1a<\/p>\n

“`sh<\/p>\n

sudo systemctl start fail2ban<\/p>\n

sudo systemctl enable fail2ban<\/p>\n

“`<\/p>\n

Fail2ban \u7684\u57fa\u672c\u914d\u7f6e\u6d89\u53ca\u5230 jail \u6587\u4ef6\uff0c\u901a\u5e38\u5728 `\/etc\/fail2ban\/jail.conf` \u6216 `\/etc\/fail2ban\/jail.local`\u3002\u63a8\u8350\u521b\u5efa\u4e00\u4e2a `jail.local` \u6587\u4ef6\u8fdb\u884c\u4e2a\u6027\u5316\u914d\u7f6e\uff0c\u56e0\u4e3a `jail.conf` \u53ef\u80fd\u4f1a\u5728\u5347\u7ea7\u8fc7\u7a0b\u4e2d\u88ab\u8986\u76d6\u3002<\/p>\n

“`sh<\/p>\n

sudo cp \/etc\/fail2ban\/jail.{conf,local}<\/p>\n

“`<\/p>\n

\u4e4b\u540e\uff0c\u7f16\u8f91 `jail.local` \u6587\u4ef6\uff0c\u5b9a\u5236\u5404\u79cd\u670d\u52a1\u7684\u4fdd\u62a4\u7b56\u7565\uff0c\u4f8b\u5982 SSH \u670d\u52a1\uff1a<\/p>\n

“`ini<\/p>\n

[sshd]<\/p>\n

enabled = true<\/p>\n

port = ssh<\/p>\n

filter = sshd<\/p>\n

logpath = \/var\/log\/auth.log<\/p>\n

maxretry = 5<\/p>\n

bantime = 600<\/p>\n

findtime = 600<\/p>\n

“`<\/p>\n

\u8fd9\u4e2a\u914d\u7f6e\u8868\u793a Fail2ban \u5c06\u76d1\u63a7 SSH \u767b\u5f55\u5c1d\u8bd5\uff0c\u5e76\u5728\u4e00\u5b9a\u65f6\u95f4 (findtime) \u5185\u5931\u8d25\u6b21\u6570 (maxretry) \u8d85\u8fc7\u9608\u503c\u65f6\u5c01\u7981 IP (bantime)\u3002<\/p>\n

\u4e8c\u3001\u81ea\u5b9a\u4e49\u89c4\u5219<\/strong><\/h2>\n

\u867d\u7136 Fail2ban \u9644\u5e26\u4e86\u4e00\u4e9b\u9884\u8bbe\u7684\u8fc7\u6ee4\u89c4\u5219\uff0c\u4f46\u6709\u65f6\u5019\u4f60\u53ef\u80fd\u9700\u8981\u521b\u5efa\u6216\u8c03\u6574\u8fc7\u6ee4\u5668\u4ee5\u5339\u914d\u7279\u5b9a\u5f62\u5f0f\u7684\u653b\u51fb\u3002\u6bd4\u5982\u8bf4\u4e3a\u4e86\u5339\u914d\u4e00\u4e9b\u7279\u6b8a\u7684\u767b\u5f55\u5931\u8d25\u65e5\u5fd7\u683c\u5f0f\uff0c\u4f60\u53ef\u4ee5\u5728 `\/etc\/fail2ban\/filter.d` \u76ee\u5f55\u4e0b\u521b\u5efa\u81ea\u5b9a\u4e49\u7684\u8fc7\u6ee4\u5668\u6587\u4ef6\u3002<\/p>\n

\u4f8b\u5982\uff0c\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a `myservice.conf` \u7684\u6587\u4ef6\uff1a<\/p>\n

“`ini<\/p>\n

[INCLUDES]<\/p>\n

before = common.conf<\/p>\n

[Definition]<\/p>\n

_daemon = myservice<\/p>\n

failregex = ^%(__prefix_line)sFailed login from \\s*$<\/p>\n

ignoreregex =<\/p>\n

“`<\/p>\n

\u8fd9\u4e2a\u81ea\u5b9a\u4e49\u89c4\u5219\u6307\u5b9a\u4e86\u5931\u8d25\u767b\u5f55\u5c1d\u8bd5\u7684\u6b63\u5219\u8868\u8fbe\u5f0f\u6a21\u5f0f\uff08failregex\uff09\u3002\u6bcf\u5f53\u8fd9\u4e2a\u6a21\u5f0f\u88ab\u5339\u914d\u65f6\uff0c\u53d1\u8d77\u8bf7\u6c42\u7684 IP \u5730\u5740\u5c31\u4f1a\u88ab\u8bb0\u5f55\uff0c\u5e76\u5728\u8d85\u8fc7\u5141\u8bb8\u7684\u6700\u5927\u5c1d\u8bd5\u6b21\u6570\u540e\u5c01\u7981\u3002<\/p>\n

\u4e09\u3001\u76d1\u63a7\u591a\u4e2a\u670d\u52a1<\/strong><\/h2>\n

\u4e3a\u4e86\u4fdd\u62a4\u670d\u52a1\u5668\u514d\u53d7\u591a\u4e2a\u670d\u52a1\u7684\u66b4\u529b\u7834\u89e3\u653b\u51fb\uff0cFail2ban \u53ef\u4ee5\u914d\u7f6e\u591a\u4e2a\u76d1\u63a7\u9879\u3002\u9664\u4e86 SSH \u4e4b\u5916\uff0c\u5e38\u89c1\u7684\u8fd8\u5305\u62ec FTP\u3001SMTP\u3001HTTP \u7b49\u670d\u52a1\u3002\u6bcf\u4e2a\u670d\u52a1\u7684\u76d1\u63a7\u7b56\u7565\u53ef\u4ee5\u901a\u8fc7\u5728 `jail.local` \u6587\u4ef6\u4e2d\u5b9a\u4e49\u4e0d\u540c\u7684\u76d1\u72f1 (jail) \u6765\u5b9e\u73b0\uff1a<\/p>\n

“`ini<\/p>\n

[vsftpd]<\/p>\n

enabled = true<\/p>\n

port = ftp<\/p>\n

filter = vsftpd<\/p>\n

logpath = \/var\/log\/vsftpd.log<\/p>\n

maxretry = 5<\/p>\n

[apache-auth]<\/p>\n

enabled = true<\/p>\n

port = http,https<\/p>\n

filter = apache-auth<\/p>\n

logpath = \/var\/log\/apache*\/*error.log<\/p>\n

maxretry = 5<\/p>\n

[postfix]<\/p>\n

enabled = true<\/p>\n

port = smtp<\/p>\n

filter = postfix<\/p>\n

logpath = \/var\/log\/mail.log<\/p>\n

“`<\/p>\n

\u5728\u8fd9\u91cc\uff0c\u6211\u4eec\u7684 Fail2ban \u670d\u52a1\u88ab\u8bbe\u7f6e\u4e3a\u76d1\u63a7 VSFTPD\u3001Apache \u548c Postfix \u7684\u65e5\u5fd7\u6587\u4ef6\uff0c\u82e5\u53d1\u73b0\u6709\u5931\u8d25\u7684\u767b\u5f55\u5c1d\u8bd5\u5219\u6267\u884c\u5c01\u7981\u64cd\u4f5c\u3002<\/p>\n

\u56db\u3001\u5904\u7406\u5c01\u7981<\/strong><\/h2>\n

\u4e00\u65e6 Fail2ban \u5c01\u7981\u4e86\u4e00\u4e2a IP \u5730\u5740\uff0c\u76f8\u5173\u7684\u4fe1\u606f\u4f1a\u88ab\u8bb0\u5f55\u5728\u65e5\u5fd7\u6587\u4ef6\u4e2d\u3002\u4f60\u53ef\u4ee5\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u67e5\u770b\u5c01\u7981\u7684 IP \u5217\u8868\uff1a<\/p>\n

“`sh<\/p>\n

sudo fail2ban-client status sshd<\/p>\n

“`<\/p>\n

\u8fd9\u6761\u547d\u4ee4\u4f1a\u663e\u793a\u51fa\u6240\u6709\u56e0 SSH \u767b\u5f55\u5931\u8d25\u800c\u88ab Fail2ban \u5c01\u7981\u7684 IP \u5730\u5740\u3002\u5982\u679c\u4f60\u786e\u4fe1\u67d0\u4e2a IP \u5730\u5740\u88ab\u9519\u8bef\u5730\u5c01\u7981\u4e86\uff0c\u53ef\u4ee5\u4f7f\u7528 `fail2ban-client` \u5de5\u5177\u89e3\u5c01\uff1a<\/p>\n

“`sh<\/p>\n

sudo fail2ban-client set sshd unbanip 1.2.3.4<\/p>\n

“`<\/p>\n

\u8fd9\u4e2a\u547d\u4ee4\u5c06\u4f1a\u4ece SSH \u7684\u76d1\u72f1\u4e2d\u79fb\u9664\u6307\u5b9a\u7684 IP \u5730\u5740\u3002<\/p>\n

\u4e94\u3001\u9ad8\u7ea7\u914d\u7f6e<\/strong><\/h2>\n

\u9ad8\u7ea7\u7528\u6237\u53ef\u4ee5\u5bf9 Fail2ban \u8fdb\u884c\u7ec6\u81f4\u7684\u8c03\u4f18\u3002\u53ef\u4ee5\u901a\u8fc7\u7f16\u8f91 `\/etc\/fail2ban\/fail2ban.conf` \u6587\u4ef6\u6765\u8c03\u6574 Fail2ban \u672c\u8eab\u7684\u8fd0\u884c\u53c2\u6570\uff0c\u5982\u65e5\u5fd7\u7ea7\u522b\u3001\u65e5\u5fd7\u76ee\u6807\u7b49\u3002<\/p>\n

“`ini<\/p>\n

[Definition]<\/p>\n

loglevel = INFO<\/p>\n

logtarget = \/var\/log\/fail2ban.log<\/p>\n

socket = \/var\/run\/fail2ban\/fail2ban.sock<\/p>\n

pidfile = \/var\/run\/fail2ban\/fail2ban.pid<\/p>\n

“`<\/p>\n

\u53e6\u5916\uff0c\u5728`filter.d`\u76ee\u5f55\u4e0b\uff0c\u6bcf\u4e2a\u670d\u52a1\u7684\u8fc7\u6ee4\u5668\u4e5f\u53ef\u4ee5\u88ab\u8be6\u7ec6\u81ea\u5b9a\u4e49\uff0c\u5141\u8bb8\u66f4\u7cbe\u786e\u5730\u5339\u914d\u6076\u610f\u5c1d\u8bd5\u7684\u6a21\u5f0f\u3002<\/p>\n

\u516d\u3001\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1<\/strong><\/h2>\n

\u5bf9\u4e8e\u4efb\u4f55\u5b89\u5168\u76f8\u5173\u7684\u914d\u7f6e\uff0c\u6d4b\u8bd5\u4e0e\u9a8c\u8bc1\u90fd\u662f\u975e\u5e38\u91cd\u8981\u7684\u73af\u8282\u3002Fail2ban \u63d0\u4f9b\u4e86\u6d4b\u8bd5\u5de5\u5177\u6765\u68c0\u67e5\u4f60\u7684\u89c4\u5219\u662f\u5426\u80fd\u591f\u6b63\u786e\u5339\u914d\u65e5\u5fd7\u4e2d\u7684\u884c\u4e3a\uff1a<\/p>\n

“`sh<\/p>\n

sudo fail2ban-regex \/var\/log\/auth.log \/etc\/fail2ban\/filter.d\/sshd.conf<\/p>\n

“`<\/p>\n

\u8fd9\u4e2a\u547d\u4ee4\u4f1a\u4f7f\u7528\u4f60\u7684 SSHD \u8fc7\u6ee4\u5668\u89c4\u5219\u6765\u6d4b\u8bd5 `\/var\/log\/auth.log` \u65e5\u5fd7\u6587\u4ef6\uff0c\u5e2e\u52a9\u4f60\u786e\u8ba4\u662f\u5426\u6240\u6709\u7684\u6076\u610f\u5c1d\u8bd5\u90fd\u88ab\u6b63\u786e\u5730\u8bc6\u522b\u3002<\/p>\n

\u4e03\u3001\u7ef4\u62a4\u4e0e\u76d1\u63a7<\/strong><\/h2>\n

\u5728 Fail2ban \u6210\u529f\u90e8\u7f72\u540e\uff0c\u5b9a\u671f\u7ef4\u62a4\u548c\u76d1\u63a7\u662f\u5fc5\u8981\u7684\u3002\u8fd9\u5305\u62ec\u4f46\u4e0d\u9650\u4e8e\u66f4\u65b0 Fail2ban \u7684\u8fc7\u6ee4\u89c4\u5219\u3001\u76d1\u63a7\u5176\u65e5\u5fd7\u6587\u4ef6\u4ee5\u67e5\u627e\u65b0\u7684\u653b\u51fb\u6a21\u5f0f\u3001\u786e\u4fdd Fail2ban \u670d\u52a1\u6301\u7eed\u8fd0\u884c\u4ee5\u53ca\u5728\u7cfb\u7edf\u5347\u7ea7\u65f6\u786e\u4fdd\u76f8\u5173\u914d\u7f6e\u6587\u4ef6\u7684\u6b63\u786e\u6027\u3002<\/p>\n

\u603b\u7ed3\u8d77\u6765\uff0cFail2ban \u662f\u4e00\u4e2a\u5f3a\u5927\u7684\u5de5\u5177\uff0c\u53ef\u4ee5\u663e\u8457\u589e\u5f3a\u670d\u52a1\u5668\u9762\u5bf9\u66b4\u529b\u7834\u89e3\u653b\u51fb\u7684\u9632\u5fa1\u80fd\u529b\u3002\u901a\u8fc7\u5408\u7406\u914d\u7f6e\u548c\u5b9a\u671f\u7ef4\u62a4\uff0c\u7cfb\u7edf\u7ba1\u7406\u5458\u53ef\u4ee5\u786e\u4fdd\u5b83\u5728\u4fdd\u62a4\u670d\u52a1\u5668\u4e0a\u7684\u5404\u7c7b\u670d\u52a1\u65b9\u9762\u53d1\u6325\u6700\u5927\u6548\u7528\u3002<\/p>\n

\u76f8\u5173\u95ee\u7b54FAQs\uff1a<\/strong><\/h2>\n

\u5982\u4f55\u5728Linux\u7cfb\u7edf\u4e2d\u5b89\u88c5Fail2ban\uff1f<\/strong><\/p>\n

\u8981\u5728Linux\u7cfb\u7edf\u4e2d\u5b89\u88c5Fail2ban\uff0c\u60a8\u53ef\u4ee5\u901a\u8fc7\u5305\u7ba1\u7406\u5de5\u5177\uff08\u5982apt\u3001yum\u6216zypper\uff09\u6765\u5b89\u88c5\u3002\u9996\u5148\uff0c\u60a8\u9700\u8981\u4f7f\u7528\u7ba1\u7406\u5458\u6743\u9650\u767b\u5f55\u5230\u7cfb\u7edf\uff0c\u5e76\u8fd0\u884c\u76f8\u5e94\u7684\u547d\u4ee4\u6765\u5b89\u88c5Fail2ban\u8f6f\u4ef6\u5305\u3002<\/p>\n

Fail2ban\u5982\u4f55\u5de5\u4f5c\u6765\u9632\u6b62\u66b4\u529b\u7834\u89e3\uff1f<\/strong><\/p>\n

Fail2ban\u901a\u8fc7\u76d1\u89c6\u7cfb\u7edf\u65e5\u5fd7\u6587\u4ef6\u4e2d\u7684\u767b\u5f55\u5931\u8d25\u5c1d\u8bd5\u6765\u5de5\u4f5c\u3002\u5982\u679cFail2ban\u68c0\u6d4b\u5230\u8fde\u7eed\u7684\u767b\u5f55\u5931\u8d25\u5c1d\u8bd5\uff0c\u5b83\u5c06\u81ea\u52a8\u7981\u6b62\u8fdc\u7a0b\u4e3b\u673a\u5c1d\u8bd5\u8bbf\u95ee\u7cfb\u7edf\u7684IP\u5730\u5740\u3002\u8fd9\u79cd\u81ea\u52a8\u5316\u7684\u54cd\u5e94\u6709\u6548\u5730\u9632\u6b62\u4e86\u66b4\u529b\u7834\u89e3\u653b\u51fb\u3002<\/p>\n

\u5982\u4f55\u914d\u7f6eFail2ban\u6765\u63d0\u9ad8\u7cfb\u7edf\u5b89\u5168\u6027\uff1f<\/strong><\/p>\n

\u8981\u914d\u7f6eFail2ban\u4ee5\u63d0\u9ad8\u7cfb\u7edf\u5b89\u5168\u6027\uff0c\u60a8\u53ef\u4ee5\u7f16\u8f91Fail2ban\u7684\u914d\u7f6e\u6587\u4ef6\u6765\u6307\u5b9a\u76d1\u89c6\u7684\u65e5\u5fd7\u6587\u4ef6\u548c\u8bbe\u7f6e\u89e6\u53d1\u7981\u6b62IP\u7684\u6761\u4ef6\u3002\u60a8\u8fd8\u53ef\u4ee5\u5b9a\u5236Fail2ban\u7684\u54cd\u5e94\u52a8\u4f5c\uff0c\u4f8b\u5982\u8bbe\u7f6e\u7981\u6b62\u7684\u65f6\u95f4\u957f\u5ea6\u548c\u5141\u8bb8\u7684\u6700\u5927\u5c1d\u8bd5\u6b21\u6570\u3002\u786e\u4fdd\u60a8\u7684\u914d\u7f6e\u7b26\u5408\u60a8\u7cfb\u7edf\u7684\u5b89\u5168\u9700\u6c42\uff0c\u5e76\u5b9a\u671f\u76d1\u63a7Fail2ban\u7684\u6d3b\u52a8\u65e5\u5fd7\u4ee5\u4fdd\u6301\u7cfb\u7edf\u7684\u5b89\u5168\u6027\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"FAIl2ban \u662f\u4e00\u4e2a\u7528\u4ee5\u9632\u6b62\u6076\u610f\u66b4\u529b\u7834\u89e3\u7684\u5de5\u5177\uff0c\u5b83\u901a\u8fc7\u5206\u6790\u65e5\u5fd7\u6587\u4ef6\u6765\u76d1\u63a7\u7cfb\u7edf\u4e0a\u7684\u6076\u610f\u5c1d\u8bd5\uff0c\u5f53\u53d1\u73b0\u8fdd\u89c4\u884c\u4e3a\u65f6 […]","protected":false},"author":1,"featured_media":84189,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[37],"tags":[384],"acf":[],"_links":{"self":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts\/84188"}],"collection":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/comments?post=84188"}],"version-history":[{"count":0,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/posts\/84188\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/media\/84189"}],"wp:attachment":[{"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/media?parent=84188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/categories?post=84188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/docs.pingcode.com\/wp-json\/wp\/v2\/tags?post=84188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}