Linux安装Fail2Ban防止SSH被暴力破解
Tags： Fail2BanLinuxssh加固安全暴力破解
👉 本文共约1331个字，系统预计阅读时间或需6分钟。
1.准备工作
1.1禁用firewalld开机启动
1 2 3 4 5 | [root@newdocker2 ~]# systemctl disable firewalld Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service. Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service. [root@newdocker2 ~]# systemctl stop firewalld [root@newdocker2 ~]# |
1.2安装iptables
安装iptables：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | [root@newdocker2 ~]# yum install -y iptables-services 已加载插件：fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * epel: mirrors.bfsu.edu.cn * extras: mirrors.huaweicloud.com * updates: mirrors.aliyun.com 正在解决依赖关系 --> 正在检查事务 ---> 软件包 iptables-services.x86_64.0.1.4.21-35.el7 将被 安装 --> 正在处理依赖关系 iptables = 1.4.21-35.el7，它被软件包 iptables-services-1.4.21-35.el7.x86_64 需要 --> 正在检查事务 ---> 软件包 iptables.x86_64.0.1.4.21-34.el7 将被 升级 ---> 软件包 iptables.x86_64.0.1.4.21-35.el7 将被 更新 --> 解决依赖关系完成 …… |
然后设置开机启动：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | [root@newdocker2 ~]# systemctl start iptables [root@newdocker2 ~]# systemctl status iptables ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled) Active: active (exited) since 五 2023-04-07 14:54:38 CST; 8s ago Process: 23340 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS) Main PID: 23340 (code=exited, status=0/SUCCESS) 4月 07 14:54:38 newdocker2 systemd[1]: Starting IPv4 firewall with iptables... 4月 07 14:54:38 newdocker2 iptables.init[23340]: iptables: Applying firewall rules: [ 确定 ] 4月 07 14:54:38 newdocker2 systemd[1]: Started IPv4 firewall with iptables. [root@newdocker2 ~]# systemctl enable iptables Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service. [root@newdocker2 ~]# |
查看当前iptables规则：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | [root@newdocker2 ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@newdocker2 ~]# |
1.3清空iptables规则
1 2 | [root@newdocker2 ~]# iptables -F [root@newdocker2 ~]# |
1.4设置新的放行规则
根据应用访问需求，这里开放80和22端口：
1 2 3 | [root@newdocker2 ~]# iptables -I INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT [root@newdocker2 ~]# iptables -I INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT [root@newdocker2 ~]# |
1.5确认新规则生效
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | [root@newdocker2 ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:bootps ACCEPT tcp -- anywhere anywhere tcp dpt:bootps ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT icmp -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED ACCEPT all -- 192.168.122.0/24 anywhere ACCEPT all -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable REJECT all -- anywhere anywhere reject-with icmp-port-unreachable REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:bootpc [root@newdocker2 ~]# |
1.6保存规则
1 2 | [root@newdocker2 ~]# iptables-save > /etc/sysconfig/iptables [root@newdocker2 ~]# |
2.软件安装
2.1安装EPEL源
1 2 3 4 5 6 | [root@newdocker2 ~]# yum install -y epel-release 已加载插件：fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * epel: mirrors.bfsu.edu.cn …… |
2.2安装fail2ban
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | [root@newdocker2 ~]# yum install -y fail2ban-all 已加载插件：fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * epel: mirrors.bfsu.edu.cn * extras: mirrors.huaweicloud.com * updates: mirrors.aliyun.com 正在解决依赖关系 --> 正在检查事务 ---> 软件包 fail2ban-all.noarch.0.0.11.2-3.el7 将被 安装 --> 正在处理依赖关系 fail2ban-hostsdeny = 0.11.2-3.el7，它被软件包 fail2ban-all-0.11.2-3.el7.noarch 需要 --> 正在处理依赖关系 fail2ban-mail = 0.11.2-3.el7，它被软件包 fail2ban-all-0.11.2-3.el7.noarch 需要 --> 正在处理依赖关系 fail2ban-shorewall = 0.11.2-3.el7，它被软件包 fail2ban-all-0.11.2-3.el7.noarch 需要 --> 正在处理依赖关系 gamin-python，它被软件包 fail2ban-all-0.11.2-3.el7.noarch 需要 --> 正在处理依赖关系 /usr/bin/whois，它被软件包 fail2ban-all-0.11.2-3.el7.noarch 需要 …… |
3.不同情况下封禁配置
3.1只封禁IP
假设情况：如果在1小时内，同一IP登陆失败3次，则将其封禁24小时。
这里配置/etc/fail2ban/jail.local文件，先创建jail.local：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 | [root@newdocker2 fail2ban]# cat jail.local [DEFAULT] #IP白名单 ignoreip = 127.0.0.1/8 ::1 #封禁时间 bantime = 24h #在这个时间段内,超过最大重试次数,就封禁该操作的IP findtime = 1h #最大重试次数 maxretry = 3 #使用的防火墙规则 #Firewall（firewallcmd-ipset）； #Iptables（iptables-multiport）； #对应/etc/fail2ban/action.d目录下的文件 banaction = iptables-multiport #触发规则后的选择行为: #只封禁IP：action_ #封禁IP+邮件通知：action_mw #封禁IP+邮件通知+报告相关日志：action_mwl action = %(action_)s [sshd] #需要监听的项，对应/etc/fail2ban/filter.d目录下的文件 filter = sshd enabled = true port = 22 #监听的日志路径： #Debian系：/var/log/auth.log #RedHat系：/var/log/secure logpath = /var/log/secure [root@newdocker2 fail2ban]# |
本人提供Oracle(OCP、OCM)、MySQL(OCP)、PostgreSQL(PGCA、PGCE、PGCM)等数据库的培训和考证业务，私聊QQ646634621或微信db_bao，谢谢！
配置完成后做如下操作：
1）启动fail2ban服务
启动并设置开机自启：
1 2 3 4 | [root@newdocker2 fail2ban]# systemctl start fail2ban [root@newdocker2 fail2ban]# systemctl enable fail2ban Created symlink from /etc/systemd/system/multi-user.target.wants/fail2ban.service to /usr/lib/systemd/system/fail2ban.service. [root@newdocker2 fail2ban]# |
2）查看日志
1 2 3 4 5 6 7 8 9 10 11 | [root@newdocker2 ~]# tail -f /var/log/fail2ban.log 2023-04-07 15:34:14,191 fail2ban.jail [2386]: INFO Initiated 'systemd' backend 2023-04-07 15:34:14,194 fail2ban.filter [2386]: INFO maxLines: 1 2023-04-07 15:34:14,245 fail2ban.filtersystemd [2386]: INFO [sshd] Added journal match for: '_SYSTEMD_UNIT=sshd.service + _COMM=sshd' 2023-04-07 15:34:14,246 fail2ban.filter [2386]: INFO maxRetry: 3 2023-04-07 15:34:14,246 fail2ban.filter [2386]: INFO encoding: UTF-8 2023-04-07 15:34:14,247 fail2ban.filter [2386]: INFO findtime: 3600 2023-04-07 15:34:14,247 fail2ban.actions [2386]: INFO banTime: 86400 2023-04-07 15:34:14,252 fail2ban.jail [2386]: INFO Jail 'sshd' started 2023-04-07 15:34:14,254 fail2ban.filter [2386]: WARNING [sshd] Simulate NOW in operation since found time has too large deviation 1680851586.19 ~ 1680852854.25 +/- 60 2023-04-07 15:34:14,255 fail2ban.filter [2386]: WARNING [sshd] Please check jail has possibly a timezone issue. Line with odd timestamp: ('', '2023-04-07T15:13:06.185241', 'newdocker2 sshd[1112]: Server listening on 0.0.0.0 port 22.') |
3）查看黑名单
1 2 3 4 5 6 7 8 9 10 11 | [root@newdocker2 ~]# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: [root@newdocker2 ~]# |
目前没有失败的记录。
4）设置黑名单
先添加一个IP的黑名单：
1 2 3 | [root@newdocker2 ~]# fail2ban-client set sshd banip 192.16.20.2/24 1 [root@newdocker2 ~]# |
然后查看：
1 2 3 4 5 6 7 8 9 10 11 | [root@newdocker2 ~]# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 3 `- Banned IP list: 192.16.20.0/24 [root@newdocker2 ~]# |
然后删除相应的黑名单：
直接用fail2ban-client set sshd unbanip IP_ADDRESS。
3.2封禁IP同时发送邮箱
1）安装与配置邮箱
1 2 3 4 5 6 7 8 9 10 | [root@newdocker2 ~]# yum install -y mailx 已加载插件：fastestmirror, langpacks Loading mirror speeds from cached hostfile * base: mirrors.huaweicloud.com * epel: mirrors.bfsu.edu.cn * extras: mirrors.huaweicloud.com * updates: mirrors.aliyun.com 软件包 mailx-12.5-19.el7.x86_64 已安装并且是最新版本 无须任何处理 [root@newdocker2 ~]# |
配置mailx：
打开/etc/mail.rc，增加配置：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 | #发件人邮箱 set from=netskyman@163.com #发件人邮箱的SMTP地址 set smtp=smtp.163.com #发件人邮箱登陆账号 set smtp-auth-user=netskyman@163.com #发件人邮箱的授权码 set smtp-auth-password=C00DTYQCVATOYOWIFH #认证方式 set smtp-auth=login #忽略证书警告 set ssl-verify=ignore #证书所在目录 set nss-config-dir=/etc/pki/nssdb |
接着进行测试：
1 2 | [root@newdocker2 ~]# echo "Content" | mail -s "Title" netskyman@163.com [root@newdocker2 ~]# |
检查邮箱里邮件，发送成功：
2）配置fail2ban
同样编辑/etc/fail2ban/jail.local文件：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | [DEFAULT] ignoreip = 127.0.0.1/8 ::1 bantime = 24h findtime = 1h maxretry = 3 banaction = iptables-multiport #邮件发送软件 mta = mail #发件人地址 sender = netskyman@163.com #收件人地址 destemail = 1900130736@qq.com #封禁IP+邮件通知：action_mw action = %(action_mw)s [sshd] filter = sshd enabled = true port = 22 logpath = /var/log/secure |
3）配置警告内容
编辑/etc/fail2ban/action.d/mail-whois.conf文件：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | [INCLUDES] before = mail-whois-common.conf [Definition] actionban = printf "警告！！！\n 被攻击机器名：`uname -n` \n 被攻击机器IP：`/bin/curl ifconfig.co` \n 攻击服务：<name> \n 时间范围：<findtime> 内 \n 攻击次数：<failures> 次 \n 攻击者IP：<ip> \n 攻击方式：暴力破解，尝试弱口令。\n 处理方式：已将<ip>加入防火墙黑名单，封禁时间为 <bantime> 秒。\n\n \t ——来自fail2ban邮箱 " | /bin/mailx -s "[<name>]服务器遭到<ip>暴力攻击" <dest> [Init] name = default dest = root |
4）重载配置
1 2 3 | [root@newdocker2 ~]# fail2ban-client reload OK [root@newdocker2 ~]# |
5）测试
管理员收箱收到下列信息
