本文主要讲解在centos8系统中安装fail2ban服务来提供ssh服务的安全性。

本文参考链接。

fail2ban用来保护ssh的原理非常简单，主要就是通过检测ssh的日志，记录下频繁登录失败的IP，然后使用iptables来直接禁用掉这个IP对应的请求即可实现ssh的防暴力破解。

1、安装fail2ban

centos中可以直接启用epel源来直接进行安装

yum install epel-release
yum install fail2ban

2、配置fail2ban

fail2ban的主要配置目录位于/etc/fail2ban

image

[root@tiny-server fail2ban]# cat jail.local
[DEFAULT]
# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip = 192.168.0.0/24

# 客户端主机被禁止的时长（秒）
bantime = 8640000

# 客户端主机被禁止前允许失败的次数
maxretry = 3

# 查找失败次数的时长（秒）
findtime = 600

mta = sendmail

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH-Fail2ban, dest=example@mail.com, sender=fail2ban@email.com]
# Red Hat 系的发行版
logpath = /var/log/secure
# ssh 服务的最大尝试次数
maxretry = 3

3、重启服务

[root@tiny-server jail.d]# sudo systemctl restart fail2ban
[root@tiny-server jail.d]# sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2020-12-22 16:01:45 +08; 5s ago
     Docs: man:fail2ban(1)
  Process: 46536 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)
 Main PID: 46539 (f2b/server)
    Tasks: 5 (limit: 408286)
   Memory: 13.4M
   CGroup: /system.slice/fail2ban.service
           └─46539 /usr/bin/python3.6 -s /usr/bin/fail2ban-server -xf start

Dec 22 16:01:45 tiny-server systemd[1]: Starting Fail2Ban Service...
Dec 22 16:01:45 tiny-server systemd[1]: Started Fail2Ban Service.
Dec 22 16:01:45 tiny-server fail2ban-server[46539]: Server ready

# 测试是否正常运行
[root@tiny-server jail.d]# sudo fail2ban-client ping
Server replied: pong

# 添加服务开机启动
[root@tiny-server jail.d]# sudo systemctl enable fail2ban
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /usr/lib/systemd/system/fail2ban.service.

# 查看fail2ban的日志
[root@tiny-server fail2ban]# tail -f /var/log/fail2ban.log

# 查看fail2ban状态
[root@tiny-server fail2ban]# fail2ban-client status
Status
|- Number of jail:      1
`- Jail list:   ssh-iptables
[root@tiny-server fail2ban]# fail2ban-client status ssh-iptables
Status for the jail: ssh-iptables
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/secure
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

# 查看iptables的禁用情况
sudo iptables --list -n
    
# 解禁一个特定IP
fail2ban-client set ssh-iptables unbanip 192.168.1.8