50 lines
1.2 KiB
Markdown
50 lines
1.2 KiB
Markdown
>https://www.cnblogs.com/liujunqiao/p/10719942.html
|
||
|
||
* yum -y install epel-release
|
||
```#epel库里就有fail2ban 直接安装epel库就可以使用```
|
||
* yum -y install fail2ban
|
||
```#安装fail2ban```
|
||
* systemctl enable fail2ban
|
||
* cd /etc/fail2ban
|
||
* cp jail.conf jail.local
|
||
|
||
> 可以删除所有配置，配置以下内容
|
||
|
||
```
|
||
[sshd-iptables]
|
||
enabled = true
|
||
port = 22922
|
||
filter = sshd
|
||
# 过滤参数，对应filter.d 目录下的动作
|
||
action = iptables[name=SSH, port=22922, protocol=tcp]
|
||
# 动作参数 ，对应actioin.d目录下的动作，当前使用iptables
|
||
logpath = %(sshd_log)s
|
||
backend = %(sshd_backend)s
|
||
maxretry = 3
|
||
findtime = 10m
|
||
# 10分钟内输错3次
|
||
bantime = 60m
|
||
# 60分钟内禁止链接，实际为iptables增加了reject规则
|
||
```
|
||
|
||
* systemctl start fail2ban
|
||
* systemctl status fail2ban
|
||
* fail2ban-client status
|
||
|
||
查看fail2ban已经操作的ip
|
||
> iptables -nL
|
||
```
|
||
Chain f2b-SSH (1 references)
|
||
target prot opt source destination
|
||
RETURN all -- 0.0.0.0/0 0.0.0.0/0
|
||
```
|
||
* 解封ip
|
||
```
|
||
fail2ban-client set sshd-iptables unbanip xxx.xxx.xxx.xxx
|
||
|
||
set 后面的参数 为 jail.local 里面 [xxxx] 对应的节点 sshd-iptables
|
||
```
|
||
|
||
|
||
|