关于设计,生活和电子的二三事

利用fail2ban防止服务器被爆破

最近在帮加固一个服务器,所以一连发了几个关于服务器的文章。这一篇是安装fail2ban防止暴力破解SSH登陆密码。fail2ban用python编写,通过检测软件日志文件发现账号错误的ip,然后根据设定屏蔽错误超过一定次数的ip。除了SSH之外这个软件还可以保护apache,nginx,ftp,webmail等多个软件账号,还可以自己添加规则。这里只用到了SSH功能。
首先登陆服务器,执行apt-get update升级软件包列表,然后执行apt-get install fail2ban安装fail2ban,等待安装完成。

安装完成后,运行vi /etc/fail2ban/jail.conf配置fail2ban。

一般需要配置的是屏蔽时间和密码错误次数。按下箭头键到bantime一项,按Insert键进入编辑模式,修改bantime为屏蔽时间,然后按下键头到findtime,修改为需要的值。这三个参数的含义是在findtime时间内连续输入密码错误maxretry次则屏蔽对应ip bantime时间,时间以秒计。修改好之后继续向下翻。

然后翻到[ssh]部分,确保enabled后面是true。然后按Esc键,输入:wq保存退出。然后输入sudo service fail2ban restart并执行,重启fail2ban进程,应用更改后的配置文件。
fail2ban会自动添加开机启动,要测试fail2ban有没有在运行可以输入sudo fail2ban-client ping并运行。如果fail2ban在运行会回应Server replied: pong。然后就可以找个代理,用代理通过ssh登录服务器测试了。不要用常用的ip以防止自己被ban。

输入几次错误密码之后再登陆时就会连接不上,用另外的ip看iptables已经添加进去被ban的ip了。

附fail2ban配置选项说明。中间省略了一些注释等,对照相应的[***]部分修改即可

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
//设置不被屏蔽的IP,一般是内网IP,此处不用改
ignoreip = 127.0.0.1/8

# "bantime" is the number of seconds that a host is banned.
//设置屏蔽时间,以秒计
bantime  = 86400

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
//设置在多长时间内密码错误次数达到多少次后屏蔽IP,这一项是全局设置,下面还有分程序设置。
findtime = 600
maxretry = 3

# "backend" specifies the backend used to get files modification.
# Available options are "pyinotify", "gamin", "polling" and "auto".
# This option can be overridden in each jail as well.
#
# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
#            If pyinotify is not installed, Fail2ban will use auto.
# gamin:     requires Gamin (a file alteration monitor) to be installed.
#            If Gamin is not installed, Fail2ban will use auto.
# polling:   uses a polling algorithm which does not require external libraries.
# auto:      will try to use the following backends, in order:
#            pyinotify, gamin, polling.
//设置日志文件监视方式,不用改
backend = auto

# "usedns" specifies if jails should trust hostnames in logs,
#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs
#
# yes:   if a hostname is encountered, a reverse DNS lookup will be performed.
# warn:  if a hostname is encountered, a reverse DNS lookup will be performed,
#        but it will be logged as a warning.
# no:    if a hostname is encountered, will not be used for banning,
#        but it will be logged as info.
//对屏蔽的IP进行反向DNS,不用改
usedns = warn

//邮件提醒设置,
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# Name of the sender for mta actions
sendername = Fail2Ban

//中间不用改

//分程序设置屏蔽参数,格式和全局设置一样
#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME]
# enabled = true

#
# in /etc/fail2ban/jail.local.
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

[ssh]

enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3

发表评论

您的电子邮箱地址不会被公开。 必填项已用 * 标注

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据