Use SSH brute force fail2ban defense

Preface:

Just use the server, which has been someone to break, although they ** 99% ** not crack, but has been swept, the load has increased, looking very uncomfortable on the Baidu fail2ban, O thief fun ah ~ ( ¯ ▽ ¯ ) o, so to sum up.

0x01: Fail2ban Introduction

fail2ban operating mechanism: In simple terms its function is to prevent brute force. The principle is by analyzing logs related services within a certain time, will meet action related to IP using the iptables added to the dorp (discarded) list a certain time

0x02: install linux on Fail2ban

I am using a server ubuntu, so here I list only Ubuntudownload mode:

$ sudo apt-get install fail2ban

0x03: Configuring Fail2ban

Edit the configuration file jail.localfor anti brute force

$ vim /etc/fail2ban/jail.d/jail.local

Edit the file content:

#defalut这里是设定全局设置，如果下面的监控没有设置就以全局设置的值设置。
[DEFAULT]
# 用于指定哪些地址ip可以忽略 fail2ban 防御,以空格间隔。
ignoreip = 127.0.0.1/8 #后面添加你自己的IP以免被误封
# 客户端主机被禁止的时长（默认单位为秒）
bantime  = 3600
# 过滤的时长（秒）
findtime  = 600
# 匹配到的阈值（次数）
maxretry = 3

[ssh-iptables]
# 是否开启
enabled  = true
# 过滤规则
filter   = sshd
# 动作
action   = iptables[name=SSH, port=ssh, protocol=tcp]
# 日志文件的路径
logpath  = /var/log/secure
# 匹配到的阈值（次数）
maxretry = 3

Note port=sshthat the default port, if you change the port number that sshd service, you need to set the corresponding port number here, otherwise the configuration does not take effect.

Let configuration to take effect

$ fail2ban-client reload

Restart fail2banService

$ sudo service fail2ban restart

This will complete the installation

must be in the configuration file to its own IP address filling in, if it is sealed by mistake, then it does not matter Ali cloud console connected remotely modified.

0x04: commonly used commands

Unlock a specific IP address

$ sudo fail2ban-client set ssh-iptables unbanip 192.168.x.x

Check the status of a particular prison

$ sudo fail2ban-client status ssh-iptables

Monitor fail2banany sensitive events in

$ sudo tail -f /var/log/fail2ban.log

Basically that is commonly used in these orders, have to say, looking at a lot of the ban, I feel kinda fun