fail2ban实验

文章目录

fail2ban实验
- fail2ban介绍
- 实验准备
- [防止 SSH 爆破](#防止 SSH 爆破)
- [防止 Nginx 恶意访问](#防止 Nginx 恶意访问)
- [防止 Wordpress 爆破](#防止 Wordpress 爆破)
- client端验证

fail2ban介绍

基于Python编写的日志管理工具，主要用于防止恶意软件攻击，它通过监控系统日志，发现异常行为并将其添加到黑名单中，从而阻止这些行为的发生，Fail2Ban可以根据不同的攻击类型和频率自动调整过滤规则，以提高系统的安全性。

实验准备

bash 复制代码

#部署 firewall

[root@server ~ 13:42:48]# systemctl enable firewalld.service --now

#部署 fail2ban

[root@server ~ 13:43:18]# yum install -y fail2ban

[root@server ~ 13:45:36]# systemctl enable fail2ban.service --now
Created symlink from /etc/systemd/system/multi-user.target.wants/fail2bato /usr/lib/systemd/system/fail2ban.service.

#fail2ban 由 epel 仓库提供

#fail2ban 配置文件位于/etc/fail2ban，其中jail.conf是主配置文件，filter.d是相关匹配规则

[root@server ~ 13:45:47]# ls /etc/fail2ban/
action.d       fail2ban.d  jail.conf  paths-common.conf
fail2ban.conf  filter.d    jail.d     paths-fedora.conf

防止 SSH 爆破

bash 复制代码

#新建jail.local覆盖fail2ban的一些默认规则

[root@server ~ 14:08:49]# cat /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime  = 86400
findtime = 60
maxretry = 5
banaction = firewallcmd-ipset
action = %(action_mwl)s

[sshd]
enabled = true
filter  = sshd
port    = 22
action = %(action_mwl)s
logpath = /var/log/secure

[root@server ~ 13:51:54]# ls /etc/fail2ban/filter.d/sshd.conf 
/etc/fail2ban/filter.d/sshd.conf

[root@server ~ 13:52:14]# systemctl restart fail2ban.service 

#验证

[root@server ~ 13:52:26]# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	0
|  `- Journal matches:	_SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions
   |- Currently banned:	0
   |- Total banned:	0
   `- Banned IP list:	

[root@server ~ 13:53:17]# watch 'fail2ban-client status sshd'

#查看新增防火墙规则

[root@server ~ 14:08:52]# firewall-cmd --direct --get-all-rules 
ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports 22 -m set --match-set f2b-sshd src -j REJECT --reject-with icmp-port-unreachable

[root@server ~ 14:09:28]# fail2ban-client unban 10.1.8.11
1

[root@server ~ 14:09:56]# watch 'fail2ban-client status sshd'

防止 Nginx 恶意访问

bash 复制代码

[root@server ~ 15:14:22]# fail2ban-client unban 10.1.8.11
[root@server ~ 15:19:34]# cat /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime  = 86400
findtime = 60
maxretry = 5
banaction = firewallcmd-ipset
action = %(action_mwl)s

[sshd]
enabled = true
filter  = sshd
port    = 22
action = %(action_mwl)s
logpath = /var/log/secure

[nginx-cc]
enabled = true
port = http,https
filter = nginx-cc
action = %(action_mwl)s
maxretry = 5
findtime = 60
bantime = 3600
logpath = /var/log/nginx/access.log

[root@server ~ 15:22:37]# cat /etc/fail2ban/filter.d/nginx-cc.conf
[Definition]
failregex = <HOST> -.*- .*HTTP/1.* .* .*$
ignoreregex =

[root@server ~ 15:11:22]# systemctl restart  fail2ban.service 

[root@server ~ 15:17:49]# firewall-cmd --add-service=http
success

[root@server ~ 15:18:09]# watch fail2ban-client status nginx-cc
You have new mail in /var/spool/mail/root

[root@server ~ 15:19:07]# firewall-cmd --list-all

防止 Wordpress 爆破

bash 复制代码

#touch一个文件代替即可

#新建一个nginx日志匹配规则

[root@server ~]# vim /etc/fail2ban/filter.d/wordpress.conf
[Definition]
failregex = ^<HOST> -.* /wp-login.php.* HTTP/1\.."
ignoreregex =

#在/etc/fail2ban/jail.local中追加如下内容

[wordpress]
enabled = true
port = http,https
filter = wordpress
action = %(action_mwl)s
maxretry = 20
findtime = 60
bantime = 3600
logpath = /usr/local/nginx/logs/access.log

client端验证

bash 复制代码

#ssh远程登陆10.1.8.10
[root@client ~ 13:55:59]# ssh root@10.1.8.10
ssh: connect to host 10.1.8.10 port 22: Connection refused

[root@client ~ 14:10:06]# sshpass -p '456' ssh root@10.1.8.10 hostname
Permission denied, please try again.
[root@client ~ 14:10:15]# sshpass -p '456' ssh root@10.1.8.10 hostname
Permission denied, please try again.
[root@client ~ 14:10:17]# sshpass -p '456' ssh root@10.1.8.10 hostname
Permission denied, please try again.
[root@client ~ 14:10:20]# sshpass -p '456' ssh root@10.1.8.10 hostname
Permission denied, please try again.
[root@client ~ 14:10:23]# sshpass -p '456' ssh root@10.1.8.10 hostname
Permission denied, please try again.
[root@client ~ 14:10:26]# sshpass -p '456' ssh root@10.1.8.10 hostname
ssh: connect to host 10.1.8.10 port 22: Connection refused


#web访问限制

[root@client ~ 15:18:25]# curl 10.1.8.10
xxx
[root@client ~ 15:18:25]# curl 10.1.8.10
xxx
[root@client ~ 15:18:26]# curl 10.1.8.10
xxx
[root@client ~ 15:18:26]# curl 10.1.8.10
xxx
[root@client ~ 15:18:26]# curl 10.1.8.10
curl: (7) Failed connect to 10.1.8.10:80; Connection refused

root@client \~ 15:18:26\]# curl 10.1.8.10 xxx \[root@client \~ 15:18:26\]# curl 10.1.8.10 xxx \[root@client \~ 15:18:26\]# curl 10.1.8.10 curl: (7) Failed connect to 10.1.8.10:80; Connection refused ``` ```