用fail2ban阻止SSH暴力破解密码

一.下载安装

#wget

#tar xvfj fail2ban-0.8.4.tar.bz2

#cd fail2ban-0.8.4

#python setup.py install

#cd files

# cp ./redhat-initd /etc/init.d/fail2ban

# chkconfig –add fail2ban

#service fail2ban start

注意：如果重起iptables 记的一定还要重起fail2ban，不然他就不能生效，fail2ban的过滤表是在iptables 启动后在加入的。

这点跟DenyHosts不同，denyhosts是通过把ip写进/etc/hosts.deny去禁止别人访问

二、配置

1、fail2ban本身配置

默认fail2ban.conf里面就三个参数，而且都有注释。

#默认日志的级别

loglevel = 3

#日志的存放路径

logtarget = /var/log/fail2ban.log

#socket的位置

socket = /tmp/fail2ban.sock

2、fail2ban防护配置

全局设置

# vi /etc/fail2ban/jail.conf

# 忽悠 IP范围 如果有二组以上用空白做为间隔

ignoreip = 127.0.0.1

# 设定 IP 被封锁的时间(秒)，如果值为 -1，代表永远封锁

bantime = 86400

# 设定在多少时间内达到 maxretry 的次数就封锁

findtime = 600

# 设定在多少时间内达到 maxretry 的次数就封锁

maxretry = 3

# 允许尝试的次数

分类设置

#针对sshd暴力入侵防护

[ssh-iptables]

enabled = true

filter = sshd

action = iptables[name=SSH, port=ssh, protocol=tcp]

sendmail-whois[name=SSH, dest=[e-mail], sender=[e-mail]]

logpath = /var/log/secure

# 如果有个别的次数设定就设在这里

maxretry = 3

然后我们设置启动服务：

#chkconfig –level 345 fail2ban on

#service fail2ban start

三、测试：

查看iptables 的规则多出了 iptables-ssh的规则

# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination 

fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh       //有这条说明已经起作用了

RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere

ACCEPT     icmp --  anywhere             anywhere            icmp any

ACCEPT     esp  --  anywhere             anywhere

ACCEPT     ah   --  anywhere             anywhere

ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns

ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pptp

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql

REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain fail2ban-SSH (1 references)

target     prot opt source               destination

DROP       all  --   xxx.xxx.xxx.xxx     anywhere

RETURN     all  --  anywhere             anywhere

查看阻止状态

# fail2ban-client status

Status

|- Number of jail:      1

`- Jail list:           ssh-iptables

# fail2ban-client status ssh-iptables

Status for the jail: ssh-iptables

|- filter

|  |- File list:        /var/log/secure

|  |- Currently failed: 0

|  `- Total failed:     3

`- action

   |- Currently banned: 1

   |  `- IP list:       xxx.xxx.xxx.xxx

   `- Total banned:     1

参考文档: http://www.esojourn.org/blog/read.php/352.htm