相必大家系统日志中无论是ssh还是ftp等总是经常被人猜口令吧?Fail2ban就是由此而生
源码可以在这里下载到:
http://sourceforge.net/projects/fail2ban/files/
一.安装在RHEL5上
- tar -jxvf fail2ban-0.8.4.tar.bz2
- cd fail2ban-0.8.4/
- 用root用户执行
- ./setup.py install
- cp files/suse-initd /etc/init.d/fail2ban
- chmod 755 /etc/init.d/fail2ban
二.建立”/etc/logrotate.d/fail2ban”:
/var/log/fail2ban.log {
weekly
rotate 7
missingok
compress
postrotate
/usr/bin/fail2ban-client reload 1>/dev/null || true endscript }注：fail2ban-client的路径依据自己系统情况改变，例如我的：
whereis fail2ban-client
fail2ban-client: /usr/bin/fail2ban-client
修改/etc/fail2ban/jail.conf ignoreip = 127.0.0.1 # 忽悠 IP范围 如果有二组以上用空白做为间隔 bantime = 600 # 设定 IP 被封锁的时间(秒)，如果值为 -1，代表永远封锁 findtime = 600 # 设定在多少时间内达到 maxretry 的次数就封锁 maxretry = 3 # 允许尝试的次数 #针对sshd暴力入侵防护 [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] mail-whois[name=SSH, dest=root] logpath = /var/log/secure maxretry = 5 # 如果有个别的次数设定就设在这里 #针对vsftpd暴力入侵防护 [vsftpd-iptables] enabled = true filter = vsftpd action = iptables[name=VSFTPD, port=ftp, protocol=tcp] sendmail-whois[name=VSFTPD, dest=you@mail.com] logpath = /var/log/secure maxretry = 3 建议设置成maxretry为 3 表示3次错误就封锁 bantime = 1800
2.现在启动fail2ban进行测试用一个IP不断尝试登录ssh
下面是secure的一个小段，修改过的
Did not receive identification string from 192.168.11.2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41017 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41096 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41162 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41209 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41267 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41323 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41376 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41433 ssh2 Invalid user test from 192.168.11.2 Failed password for invalid user test from 192.168.11.2 port 41484 ssh2
我们再来看看fail2ban的log
fail2ban.actions: WARNING [ssh-iptables] Ban 192.168.11.2 fail2ban.actions: WARNING [ssh-iptables] Unban 192.168.11.2
http://www.fail2ban.org/
