Ubuntu12.04安裝fail2ban防止惡意的破解密碼網路連線

回覆文章
tony
文章: 585
註冊時間: 2012-02-26, 07:04
聯繫:

Ubuntu12.04安裝fail2ban防止惡意的破解密碼網路連線

未閱讀文章 tony »

官方說明:
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures,
seeking for exploits, etc. Generally Fail2Ban then used to update firewall rules to reject the IP addresses for a specified amount of time,
although any arbitrary other action (e.g. sending an email, or ejecting CD-ROM tray) could also be configured.
Out of the box Fail2Ban comes with filters for various services (apache, curier, ssh, etc).
一、安裝
sudo apt-get install fail2ban
二、設定
設定檔在/etc/fail2ban
fail2ban安裝完成預設指監控ssh服務需自行設定監控其他服務
在/etc/fail2ban/jail.conf可找到
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
enabled = true此文字用來設定啟用監控ssh服務
預設監控ssh是啟用的
但為了避免fail2ban升級後覆蓋掉您的設定
在jail.conf中建議複製jail.conf為jail.local
並希望使用者不要直接修改jail.conf
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
jail.conf文內說明
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local

常見參數說明:
maxretry -- 密碼錯誤次數幾次以後就要封鎖ip
bantime -- 要封鎖ip多久時間其單位為(秒)

--排除信任網段 例如內部網段192.168.1.0/24--
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8 192.168.1.0/24
bantime = 600
maxretry = 3
設定管理者信箱有異常時會寄信通知--
#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost
--啟用apache 、postfix 、sasl、 ssh-ddos、 dovecot--
[apache]
enabled = true
[postfix]
enabled = true
[sasl]
enabled = true
[ssh-ddos]
enabled = true
[dovecot]
enabled = true
三、常用指令
.顯示目前設定
fail2ban-client status
.啟動
sudo service fail2ban start
.重新啟動
sudo service fail2ban restart
.停止
sudo service fail2ban stop
四、檢視紀錄檔
紀錄檔位置在 /var/log/fail2ban.log


參考資料:
http://www.fail2ban.org/wiki/index.php/Main_Page
http://www.fail2ban.org/wiki/index.php/ ... figuration
回覆文章

誰在線上

正在瀏覽這個版面的使用者:沒有註冊會員 和 2 位訪客