用fail2ban阻止ssh暴力破解root密码
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
⽤fail2ban阻⽌ssh暴⼒破解root密码
安装fail2ban⼯具来实现防暴⼒破解，防⽌恶意攻击，锁定恶意攻击IP。
1、如果是centos系统，先yum安装fail2ban
[root@VM_152_184_centos /]# yum -y install fail2ban
2、为了更好的看到有哪些IP在尝试暴利破解，先定义好⽇志⽂件路径
[root@VM_152_184_centos /]# cat /etc/fail2ban/fail2ban.conf |grep -v ^#
[Definition]
loglevel = 3
logtarget = SYSLOG //这⾥是⽇志路径，可以⾃定义，⽐如：/var/log/fail2ban.log
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
3、⾃定义主配置⽂件（当然，也可以不修改，保持默认配置）
[root@VM_152_184_centos /]# cat /etc/fail2ban/jail.conf |grep -v ^# |less
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 600 //屏蔽、锁定时间，单位：s
findtime = 600 //600s内尝试登陆失败超过规定次数将被锁定
maxretry = 3 //最⼤登陆失败次数
backend = auto
usedns = warn
4、最后，启动fail2ban，使其配置⽣效
[root@VM_152_184_centos /]# service fail2ban start
最后，再查看⼀下fail2ban⽇志⽂件，可以看到已经屏蔽的IP列表（Ban ip是屏蔽/锁定的IP，Unban ip是⾃动解锁的IP）[root@VM_152_184_centos /]# cat /var/log/fail2ban.log | grep "ban"
2014-04-15 21:12:18,053 fail2ban.actions: WARNING [ssh-iptables] Ban 198.104.137.151
2014-04-15 21:42:19,037 fail2ban.actions: WARNING [ssh-iptables] Unban 198.104.137.151
2014-04-15 22:12:16,001 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.218
2014-04-15 22:42:16,305 fail2ban.actions: WARNING [ssh-iptables] Unban 116.10.191.218
2014-04-15 23:02:02,609 fail2ban.actions: WARNING [ssh-iptables] Ban 117.34.91.170
2014-04-15 23:26:10,651 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.172
2014-04-15 23:28:02,391 fail2ban.actions: WARNING [ssh-iptables] Ban 198.104.137.151
2014-04-15 23:32:03,428 fail2ban.actions: WARNING [ssh-iptables] Unban 117.34.91.170
2014-04-15 23:46:07,364 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.205
2014-04-15 23:56:10,893 fail2ban.actions: WARNING [ssh-iptables] Unban 116.10.191.172。