系统为centos 6.4 64位fail2banhttp://www.fail2ban.org/wiki/index.php/Main_PageFail2Ban is able to reduce
.
系统为centos 6.4 64位
fail2ban http://www.fail2ban.org/wiki/index.php/Main_Page
Fail2Ban is able to reduce the rate of incorrect authentications attempts however it cannot eliminate the risk that weak authentication presents. Configure services to use only two factor or public/private authentication mechanisms if you really want to protect services.
http://www.onerussian.com/tmp/fail2ban-pycon2014.pdf 这个是pdf的说明文档，不过较简单
fail2ban可以监视你的系统日志，然后匹配日志的错误信息（正则式匹配）执行相应的屏蔽动作（一般情况下是调用防火墙屏蔽），如:当有人在试探你的SSH、SMTP、FTP密码，只要达到你预设的次数，fail2ban就会调用防火墙屏蔽这个IP，而且可以发送e-mail通知系统管理员
我们需要对ssh的非法登陆有一定的机制，fail2ban就可以做到
下载：https://codeload.github.com/fail2ban/fail2ban/tar.gz/0.8.13
安装：
tar -xzf fail2ban-0.8.13.tar.gzcd fail2ban-0.8.13python setup.py install cd files/cp ./redhat-initd /etc/init.d/fail2banchkconfig --add fail2ban
配置目录：/etc/fail2ban
/etc/fail2ban/action.d #firewall、iptables、mail、sendmail等配置文件
/etc/fail2ban/filter.d #apache、nagios、nginx-http-auth、php-url-fopen、selinux-ssh等防护策略
/etc/fail2ban/jail.conf #主要配置文件
编辑配置文件:
vim /etc/fail2ban/jail.conf #在#[ssh-iptables] #enabled = true 两行的下面添加
[ssh-iptables]enabled = truefilter = sshdaction = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH,[email protected],sender=root@localhost,sendername="Fail2Ban"]logpath = /var/log/secure #提供分析的日志，centos默认是这个路径axretry = 5 #尝试次数bantime = 172800 #拒绝时间/秒 [DEFAULT] #以下是约束下面的全局配置，不要添加ignoreip = 127.0.0.1/8 #忽略的ipbantime = 600 #屏蔽时间findtime = 600 #在这个时间段内maxretry = 3 #错误次数backend = autousedns = warn
如果修改上面的[ssh-iptables]选项，那么将下面的[ssh-iptables]选项注释或删除，要不两个相同的选项设置，服务会不起作用
下面还有好多选项，enabled = false 改为enabled = true 就会生效
相应的配置文件路径： /etc/fail2ban/filter.d/ 也需要修改一下
启动服务：
service fail2ban restart
fail2ban的进程
/usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x
查看状态：
fail2ban-client status
查看被阻止的ip
iptables -L
REJECT all -- 192.168.22.236 anywhere reject-with icmp-port-unreachable
如果重起iptables 记的一定还要重起fail2ban，不然不能生效，fail2ban的过滤表是在iptables 启动后在加入的
如果有这个错误提示，把[ssh-iptables]前面的空格去掉
Starting fail2ban: ERROR Failed during configuration: File contains no section headers.
file: /etc/fail2ban/jail.conf, line: 17
' [ssh-iptables]/n'
.