Fail2Ban简易的封禁SSH爆破恶意扫描CC攻击vsftpd规则等操作

代码:

1. #以Debian为例（别的可以依葫芦画瓢）
2. #更新&安装
3. apt-get update && apt-get upgrade -y
4. apt-get -y install fail2ban

代码:

1. #配置参数
2. fail2ban=”/etc/fail2ban/jail.d/sshd.local”
3. cat>”${fail2ban}”<<EOF
4. [ssh-iptables]
5. enabled  = true
6. filter   = sshd
7. action   = iptables[name=SSH, port=22, protocol=tcp]
8. logpath  = /var/log/auth.log   # 如果是Centos路径要改/var/log/secure这个
9. maxretry = 9   # 最多连接9次失败
10. bantime  = 777600   # 禁止9天（按秒单位1天86400）
11. #阻止恶意扫描
12. [nginx-dir-scan]
13. enabled = true
14. filter = nginx-dir-scan
15. action   = iptables[name=nginx-dir-scan, port=443, protocol=tcp]
16. logpath = /path/to/nginx/access.log
17. maxretry = 1   # 最多扫描1次
18. bantime = 777600   # 禁止9天（按秒单位1天86400）
19. findtime  = 300
20. #防CC攻击
21. [nginx-cc]
22. enabled = true
23. port = http,https
24. filter = nginx-cc
25. action = %(action_mwl)s
26. maxretry = 20   # 最多C20次
27. findtime = 60
28. bantime = 777600   # 禁止9天（按秒单位1天86400）
29. logpath = /usr/local/nginx/logs/access.log
30. #防vsftpd攻击规则
31. [vsftpd-notification]
32. enabled = true
33. filter = vsftpd
34. action = sendmail-whois[name=VSFTPD, dest=you@example.com]
35. logpath = /var/log/vsftpd.log
36. maxretry = 5   # 最多5次
37. bantime = 777600   # 禁止9天（按秒单位1天86400）
38. [vsftpd-iptables]
39. enabled = true
40. filter = vsftpd
41. action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
42.            sendmail-whois[name=VSFTPD, dest=you@example.com]
43. logpath = /var/log/vsftpd.log
44. maxretry = 5   # 最多5次
45. bantime = 777600   # 禁止9天（按秒单位1天86400）
46. EOF

代码:

1. #覆写&启动&开机启动
2. cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.d/sshd.local
3. #先暂停#启动&开机自启
4. systemctl stop fail2ban
5. systemctl start fail2ban.service
6. systemctl enable fail2ban.service

代码:

1. #fail2ban日志 开机自删+定时删日志
2. logdelete=”./fail2banlogdelete.sh”
3. cat>”${logdelete}”<<EOF
4. #!/bin/bash
5. find /path/to/nginx/ -mtime +15 -name “*.log” | xargs -i mv {} /root/RecycleBin/;
6. find /usr/local/nginx/logs/ -mtime +15 -name “*.log” | xargs -i mv {} /root/RecycleBin/;
7. find /var/log/ -mtime +15 -name “*.log” | xargs -i mv {} /root/RecycleBin/;
8. find /root/RecycleBin/ -name “*.log” -exec rm -rf {} \;
9. EOF
10. cp ./fail2banlogdelete.sh /etc/init.d/
11. #读挡并赋予权限
12. chmod +777 /etc/init.d/fail2banlogdelete.sh
13. update-rc.d ./fail2banlogdelete.sh defaults 90
14. cd
15. (echo “0 0 */15 * * bash /etc/init.d/fail2banlogdelete.sh >>/dev/null 2>&1” ; crontab -l )| crontab
16. cd

代码:

1. #启动
2. systemctl start fail2ban
3. #停止
4. systemctl stop fail2ban
5. #开机启动
6. systemctl enable fail2ban
7. #状态
8. systemctl status fail2ban
9. #开机关闭
10. systemctl  disable fail2ban
11. #查看被ban IP，其中sshd为名称，比如上面的[wordpress]
12. fail2ban-client status sshd
13. #删除被ban IP
14. fail2ban-client set sshd delignoreip X.X.X.X
15. #查看日志
16. tail /var/log/fail2ban.log