Просмотр кода страницы Fail2ban. Centos 7. Installation and configuring

= Links =
https://losst.ru/nastrojka-fail2ban-centos-7

= Installation and configuring =
<code>yum install epel-release</code>

<code>yum install fail2ban</code>

Backup original config '''/etc/fail2ban/jail.conf'''

<code>mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.ORIG</code>

It will be rewrited on update, so don't use it

Use /etc/fail2ban/jail.local config instead

Copy orig conf to custom conf

<code>cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local</code>

Edit conf

<code>nano /etc/fail2ban/jail.local</code>
 ...
 # enable fail2ban
 enabled = true
 ...
 
 # "maxretry" is the number of failures before a host get banned.
 maxretry = 5
 ...
 
 # time to ban IP
 bantime  = 10m
 
 # A host is banned if it has generated "maxretry" during the last "findtime"
 findtime  = 10m
 ...
 
 # DELETE ALL SERVICES, EXCEPT SERVICES WE WILL USE
 # as example - SSHD
 
 [sshd]
 # To use more aggressive sshd modes set filter parameter "mode" in jail.local:
 # normal (default), ddos, extra or aggressive (combines all).
 # See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
 #mode   = normal
 port    = ssh
 logpath = %(sshd_log)s
 backend = %(sshd_backend)s
 ...
Restart fail2ban

<code>systemctl restart fail2ban</code>

= Test from client =
Try to login to server 5 times with wrong password

<code>ssh root@<server-with-fail2ban></code>

= Test at server =
<code>cat /var/log/fail2ban.log</code>
 ...
 2021-03-08 11:51:28,721 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:28
 2021-03-08 11:51:31,446 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:31
 2021-03-08 11:51:33,862 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:51:33
 2021-03-08 11:52:38,031 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:52:38
 2021-03-08 11:52:40,501 fail2ban.filter         [2280]: INFO    [sshd] Found 192.168.17.250 - 2021-03-08 11:52:40
 2021-03-08 11:52:40,880 fail2ban.actions        [2280]: NOTICE  [sshd] Ban 192.168.17.250
 ...
Look at iptables rule

<code>iptables -L f2b-sshd -v --line-numbers</code>
 ...
 Chain f2b-sshd (1 references)
 num   pkts bytes target     prot opt in     out     source               destination
 1        8  1004 REJECT     all  --  any    any     192.168.17.250       anywhere             reject-with icmp-port-unreachable
 ...
Client 192.168.17.250 is BANNED!

Manual delete ban rule

<code>iptables -D f2b-sshd 1</code>
[[Категория:Fail2ban]]
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__