Fail2Ban 是一个广泛使用的工具,用于检测恶意登录尝试和其他异常活动,并自动封锁攻击者的IP地址。您可以配置它来检测过多的连接请求,然后暂时封锁来自恶意IP地址的访问。

安装与启动

Debian/Ubuntu安装:

ruby

apt update -y && apt install -y fail2ban
Ruby
CentOS安装:

ruby

yum update -y yum install -y epel-release yum install -y fail2ban yum install -y nano
Ruby
启动:

ruby

systemctl start fail2ban
Ruby
开机自启:

ruby

systemctl enable fail2ban
Ruby
查看状态:

ruby

systemctl status fail2ban
Ruby

主配置文件

主配置文件创建本地副本:

ruby

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Ruby
编辑本地副本:

ruby

nano /etc/fail2ban/jail.local
Ruby
重启服务:

ruby

systemctl restart fail2ban
Ruby

SSH防御 防止暴力破解

ruby

rm -rf /etc/fail2ban/jail.d/* nano /etc/fail2ban/jail.d/sshd.local
Ruby
插入以下文本:

ruby

[sshd] enabled = truemode = normalbackend = systemd
Ruby
重启服务:

ruby

systemctl restart fail2ban
Ruby
查看封锁列表:

ruby

fail2ban-client status
Ruby
查看SSH封锁情况:

ruby

fail2ban-client status sshd
Ruby

网站防御

采用科技lion的LDNMP建站方案可以使用该防御
删除之前nginx容器:

ruby

docker rm -f nginx
Ruby
部署新容器我们把log映射出来:

ruby

docker run -d --name nginx --restart always --network web_default -p 80:80 -p 443:443 -v /home/web/conf.d:/etc/nginx/conf.d -v /home/web/certs:/etc/nginx/certs -v /home/web/html:/var/www/html -v /home/web/log/nginx:/var/log/nginx nginx
Ruby
开启目录权限:

ruby

docker exec -it nginx chmod -R 777 /var/www/html
Ruby
开启NGINX速率限制:

ruby

docker exec -it nginx sh -c "sed -i '/http {/a \ limit_req_zone \$binary_remote_addr zone=example_zone:10m rate=1r/s;' /etc/nginx/nginx.conf"
Ruby
重启nginx:

ruby

docker restart nginx
Ruby
创建网站拦截规则:

ruby

nano /etc/fail2ban/jail.d/nginx.local
Ruby
插入规则:

ruby

[nginx-http-auth] enabled = true mode = fallback port = http,https logpath = /home/web/log/nginx/access.log [nginx-limit-req] enabled = true port = http,https logpath = /home/web/log/nginx/access.log [nginx-botsearch] enabled = true port = http,https logpath = /home/web/log/nginx/access.log [nginx-bad-request] enabled = true port = http,https logpath = /home/web/log/nginx/access.log [php-url-fopen] enabled = true port = http,https logpath = /home/web/log/nginx/access.log
Ruby
notion image
重启服务:

ruby

systemctl restart fail2ban
Ruby
查看nginx封锁情况:

ruby

fail2ban-client status nginx-http-auth
Ruby
查看总日志:

ruby

tail -f /var/log/fail2ban.log
Ruby

卸载

ruby

systemctl disable fail2ban systemctl stop fail2ban apt remove -y --purge fail2ban find / -name "fail2ban" -type d rm -rf /etc/fail2ban
Ruby

引用脚本

ruby

curl -sS -O https://raw.githubusercontent.com/kejilion/sh/main/kejilion.sh && chmod +x kejilion.sh && ./kejilion.sh
Ruby
用Certbot申请免费的域名证书GoForward:使用golang实现的tcp udp端口转发
Loading...
hexo