在 /var/log/secure 中嘗試以 root 帳號登入的錯誤記錄
# grep Failed /var/log/secure | grep -v invalid | tail -5
Jan 1 01:39:54 sshd[6417]: Failed password for root from 192.168.1.1 port 53355 ssh2
Jan 1 01:39:57 sshd[6417]: Failed password for root from 192.168.1.1 port 53355 ssh2
Jan 1 12:18:38 sshd[1556]: Failed password for root from 192.168.1.1 port 54849 ssh2
Jan 1 12:18:41 sshd[1556]: Failed password for root from 192.168.1.1 port 54849 ssh2
Jan 1 12:18:44 sshd[1556]: Failed password for root from 192.168.1.1 port 54849 ssh2
設定方式：
# vim /etc/fail2ban/jail.conf
[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
# sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com]
logpath = /var/log/secure
maxretry = 3
bantime = 86400[@more@]啟用 ssh-iptables
enabled = true
filter 是指使用 sshd 的 filter 來檢查 log 檔中是否有符合判斷規則的樣式(在 /etc/fail2ban/filter.d 目錄之下)
filter = sshd
action 是指偵測到之後要採取的行動，這裡有二種方式，iptables 是使用 iptables 來阻擋，sendmail-whois 是寄信給管理者，這二種行動的設定，可以在 /etc/fail2ban/action.d 目錄下找到相關的設定
action = iptables[name=SSH, port=ssh, protocol=tcp]
這裡只使用 iptables 來阻擋，不寄信給管理者
SSH Server 登錄錯誤的 Log 檔
logpath = /var/log/secure
maxretry 是指嘗試錯誤 3 次，就阻擋，bantime = 86400 是指阻擋的時間，86400 是指秒，所以是阻擋 1 天
maxretry = 3
bantime = 86400
重新啟動 fail2ban 服務
# server fail2ban restart
檢查 fail2ban 的狀態
# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: ssh-iptables
列出目前的防火牆規則
# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-VSFTPD tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
fail2ban-SSH tcp — 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT all — 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp — 0.0.0.0/0 0.0.0.0/0
ACCEPT all — 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
ACCEPT tcp — 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:21
REJECT all — 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all — 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all — 0.0.0.0/0 0.0.0.0/0
以 Client IP 192.168.1.1 嘗試對 Server IP 192.168.1.9 嘗試連線錯誤幾次之後
列出 fail2ban 偵測到的 SSH 攻擊
# fail2ban-client status ssh-iptables
Status for the jail: ssh-iptables
|- filter
| |- File list: /var/log/secure
| |- Currently failed: 0
| `- Total failed: 4
`- action
|- Currently banned: 1
| `- IP list: 192.168.1.1
`- Total banned: 1
列出 fail2ban-SSH 的規則
# iptables -t filter -L fail2ban-SSH -n
Chain fail2ban-SSH (1 references)
target prot opt source destination
DROP all — 192.168.1.1 0.0.0.0/0
RETURN all — 0.0.0.0/0 0.0.0.0/0
解除方式：
# iptables -D fail2ban-SSH -s 192.168.1.1 -j DROP
