ubuntu linux fail2ban相关信息和教程

Sunny

ubuntu linux fail2ban相关信息和教程

安装fail2bank

1. sudo apt update && sudo apt install fail2ban

复制代码

安装完后查看fail2ban运行状态

1. sudo systemctl status fail2ban

复制代码

fail2ban默认两个配置文件

1. /etc/fail2ban/jail.conf
   
2. /etc/fail2ban/jail.d/defaults-debian.conf

复制代码

不推荐直接修改这两个文件, 因为每次升级都是复写这两个文件.
备份配置文件

1. sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf_backup
   

复制代码

配置文件复制一份并全名*.local后缀.

1. sudo cp /etc/fail2ban/jail.{conf,local}

复制代码

然后修改jail.local的配置

[sshd]

enabled = true

port = ssh

filter = sshd

logpath = /var/log/auth.log

maxretry = 3

bantime = 1000d

修改完后重启fail2ban

1. sudo systemctl restart fail2ban

复制代码

解封ip

1. sudo fail2ban-client set sshd unbanip 1.1.1.1

复制代码

封ip

1. sudo fail2ban-client set sshd unbanip 1.1.1.1

复制代码

fail2ban-client status

1. Status
   
2. |- Number of jail:        2
   
3. `- Jail list:        sshd, vsftpd-iptables

复制代码

fail2ban-client status sshd

1. Status for the jail: sshd
   
2. |- Filter
   
3. |  |- Currently failed:        0
   
4. |  |- Total failed:        0
   
5. |  `- File list:        /var/log/auth.log
   
6. `- Actions
   
7.    |- Currently banned:        0
   
8.    |- Total banned:        0
   
9.    `- Banned IP list:

复制代码

fail2ban-client status vsftpd-iptables命令查看 vsftpd相关的信息(banned ip之类):

1. Status for the jail: vsftpd-iptables
   
2. |- Filter
   
3. |  |- Currently failed:        0
   
4. |  |- Total failed:        0
   
5. |  `- File list:        /var/log/vsftpd.log
   
6. `- Actions
   
7.    |- Currently banned:        0
   
8.    |- Total banned:        0
   
9.    `- Banned IP list:        
   

复制代码

---

查看fai2ban ssh相应的log在那个位置

1. fail2ban-client status sshd

复制代码

fail2ban auth.log位置

1. /var/log/auth.log

复制代码