{"id":18152,"date":"2014-01-10T06:33:40","date_gmt":"2014-01-09T22:33:40","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/01\/10\/%e5%ae%89%e8%a3%9d-fail2ban-%e9%98%bb%e6%93%8b%e4%be%86%e8%87%aa%e7%b6%b2%e8%b7%af%e4%b8%8a%e7%9a%84%e5%98%97%e8%a9%a6%e6%94%bb%e6%93%8a\/"},"modified":"2021-03-18T17:23:48","modified_gmt":"2021-03-18T09:23:48","slug":"%e5%ae%89%e8%a3%9d-fail2ban-%e9%98%bb%e6%93%8b%e4%be%86%e8%87%aa%e7%b6%b2%e8%b7%af%e4%b8%8a%e7%9a%84%e5%98%97%e8%a9%a6%e6%94%bb%e6%93%8a","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/01\/10\/%e5%ae%89%e8%a3%9d-fail2ban-%e9%98%bb%e6%93%8b%e4%be%86%e8%87%aa%e7%b6%b2%e8%b7%af%e4%b8%8a%e7%9a%84%e5%98%97%e8%a9%a6%e6%94%bb%e6%93%8a\/","title":{"rendered":"\u5b89\u88dd fail2ban \u963b\u64cb\u4f86\u81ea\u7db2\u8def\u4e0a\u7684\u5617\u8a66\u653b\u64ca"},"content":{"rendered":"

Server \u5b89\u88dd\u5b8c\u6210\u63d0\u4f9b\u5c0d\u5916\u7684\u670d\u52d9\uff0c\u5982\u679c\u6c92\u6709\u8a2d\u5b9a\u9632\u706b\u7246\uff0c\u6216\u662f\u9650\u5b9a\u9023\u7dda\u4f86\u6e90\uff0c\u96a8\u6642\u96a8\u5730\u90fd\u6703\u53d7\u5230\u4f86\u81ea\u7db2\u8def\u4e0a\u7684\u5404\u7a2e\u5617\u8a66\u653b\u64ca\uff0c\u6240\u4ee5\u5fc5\u9808\u8024\u52a9\u76f8\u95dc\u7684\u5de5\u5177\uff0c\u4f86\u5354\u52a9\u89e3\u6c7a\u9019\u6a23\u7684\u554f\u984c\u3002
\u5e95\u4e0b\u662f\u4f86\u81ea SSH \u7684\u5617\u8a66\u653b\u64ca
# grep Failed \/var\/log\/secure<\/span>
sshd[7935]: Failed password for invalid user cacti from 66.197.211.18 port 39463 ssh2<\/span>
sshd[7937]: Failed password for invalid user test1 from 66.197.211.18 port 40185 ssh2<\/span>
sshd[7939]: Failed password for root from 66.197.211.18 port 40773 ssh2<\/span>
sshd[7966]: Failed password for invalid user git from 66.197.211.18 port 41463 ssh2<\/span>
sshd[7968]: Failed password for invalid user git from 66.197.211.18 port 42190 ssh2<\/span>
sshd[7970]: Failed password for mysql from 66.197.211.18 port 42754 ssh2<\/span>
sshd[7972]: Failed password for mysql from 66.197.211.18 port 43388 ssh2<\/span>[@more@]\u4f86\u81ea\u7db2\u9801\u4e0a\u7684\u653b\u64ca
# grep admin \/var\/log\/httpd\/error_log<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/admin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/dbadmin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/myadmin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/mysqladmin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/phpadmin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/phpmyadmin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/php-my-admin<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/phpmyadmin1<\/span>
[error] [client 70.87.15.74] File does not exist: \/var\/www\/html\/phpmyadmin2<\/span><\/p>\n

\u9019\u4e00\u985e\u7684\u5de5\u5177\u975e\u5e38\u7684\u591a\uff0c\u5982\uff1aSSHBlock \/ DenyHosts \/ Fail2ban \u7b49\u7b49\uff0c\u9019\u4e9b\u5de5\u5177\u90fd\u5f88\u4e0d\u932f\uff0c\u4f46\u9019\u88e1\u6211\u9078\u7528\u7684\u662f fail2ban\uff0c\u56e0\u70ba\u5b83\u652f\u63f4\u591a\u7a2e\u5e38\u898b\u7684\u670d\u52d9\uff0c\u5982\uff1aSSH \/ FTP \/ Apache \u7b49\u7b49\u3002<\/p>\n

\"\"
Fail2ban \u5b98\u65b9\u7db2\u7ad9\uff1ahttp:\/\/www.fail2ban.org\/wiki\/index.php\/Main_Page<\/a>
\u5e95\u4e0b\u662f\u5b83\u7684\u5b89\u88dd\u65b9\u5f0f\uff1a
\u4ee5 CentOS 6.x \u70ba\u4f8b\uff0c\u56e0\u70ba fail2ban \u4e0d\u662f\u5b98\u65b9\u5957\u4ef6\u5eab\u4e2d\u7684\u5957\u4ef6\uff0c\u6240\u4ee5\u5fc5\u9808\u5148\u5b89\u88dd\u7b2c\u4e09\u65b9\u5957\u4ef6\u5eab epel \u6216 rpmforge
\u5b89\u88dd epel \u7b2c\u4e09\u65b9\u5957\u4ef6\u5eab
# wget http:\/\/dl.fedoraproject.org\/pub\/epel\/6\/x86_64\/epel-release-6-8.noarch.rpm<\/span>
# rpm -ivh epel-release-6-8.noarch.rpm
<\/span>
\u66f4\u65b0\u5957\u4ef6\u5eab\u4f86\u6e90
# yum update<\/span><\/p>\n

\u5b89\u88dd fail2ban
# yum install fail2ban<\/span><\/p>\n

fail2ban \u9810\u8a2d\u958b\u6a5f\u5c31\u6703\u555f\u52d5
# chkconfig –list fail2ban<\/span>
fail2ban\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0:off\u00a0\u00a0 1:off\u00a0\u00a0 2:off\u00a0\u00a0 3:on\u00a0\u00a0\u00a0 4:on\u00a0\u00a0\u00a0 5:on\u00a0\u00a0\u00a0 6:off<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Server \u5b89\u88dd\u5b8c\u6210\u63d0\u4f9b\u5c0d\u5916\u7684\u670d\u52d9\uff0c\u5982\u679c\u6c92\u6709\u8a2d\u5b9a\u9632\u706b\u7246\uff0c\u6216\u662f\u9650\u5b9a\u9023\u7dda\u4f86\u6e90\uff0c\u96a8\u6642\u96a8\u5730\u90fd\u6703\u53d7\u5230\u4f86\u81ea\u7db2\u8def\u4e0a\u7684\u5404\u7a2e\u5617 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5b89\u88dd fail2ban \u963b\u64cb\u4f86\u81ea\u7db2\u8def\u4e0a\u7684\u5617\u8a66\u653b\u64ca\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[138,132],"tags":[],"class_list":["post-18152","post","type-post","status-publish","format-standard","hentry","category-c-78483","category-c-78477"],"meta_key":{"_encloseme":["1"],"lt_post_id":["468983"],"_pingme":["1"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18152"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18152"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18152\/revisions"}],"predecessor-version":[{"id":19829,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18152\/revisions\/19829"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}