给ssh服务添加fail2ban安全认证

本文主要讲解在centos8系统中安装fail2ban服务来提供ssh服务的安全性。

本文参考链接

fail2ban用来保护ssh的原理非常简单,主要就是通过检测ssh的日志,记录下频繁登录失败的IP,然后使用iptables来直接禁用掉这个IP对应的请求即可实现ssh的防暴力破解。

1、安装fail2ban

centos中可以直接启用epel源来直接进行安装

1
2
yum install epel-release
yum install fail2ban

2、配置fail2ban

fail2ban的主要配置目录位于/etc/fail2ban

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
[root@tiny-server fail2ban]# cat jail.local
[DEFAULT]
# 以空格分隔的列表,可以是 IP 地址、CIDR 前缀或者 DNS 主机名
# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip = 192.168.0.0/24

# 客户端主机被禁止的时长(秒)
bantime = 8640000

# 客户端主机被禁止前允许失败的次数
maxretry = 3

# 查找失败次数的时长(秒)
findtime = 600

mta = sendmail

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH-Fail2ban, dest=example@mail.com, sender=fail2ban@email.com]
# Red Hat 系的发行版
logpath = /var/log/secure
# ssh 服务的最大尝试次数
maxretry = 3

3、重启服务

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
[root@tiny-server jail.d]# sudo systemctl restart fail2ban
[root@tiny-server jail.d]# sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2020-12-22 16:01:45 +08; 5s ago
Docs: man:fail2ban(1)
Process: 46536 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)
Main PID: 46539 (f2b/server)
Tasks: 5 (limit: 408286)
Memory: 13.4M
CGroup: /system.slice/fail2ban.service
└─46539 /usr/bin/python3.6 -s /usr/bin/fail2ban-server -xf start

Dec 22 16:01:45 tiny-server systemd[1]: Starting Fail2Ban Service...
Dec 22 16:01:45 tiny-server systemd[1]: Started Fail2Ban Service.
Dec 22 16:01:45 tiny-server fail2ban-server[46539]: Server ready

# 测试是否正常运行
[root@tiny-server jail.d]# sudo fail2ban-client ping
Server replied: pong

# 添加服务开机启动
[root@tiny-server jail.d]# sudo systemctl enable fail2ban
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /usr/lib/systemd/system/fail2ban.service.

# 查看fail2ban的日志
[root@tiny-server fail2ban]# tail -f /var/log/fail2ban.log

# 查看fail2ban状态
[root@tiny-server fail2ban]# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: ssh-iptables
[root@tiny-server fail2ban]# fail2ban-client status ssh-iptables
Status for the jail: ssh-iptables
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/secure
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:

# 查看iptables的禁用情况
sudo iptables --list -n

# 解禁一个特定IP
fail2ban-client set ssh-iptables unbanip 192.168.1.8