https://wiki.cless.pro/index.php?action=history&feed=atom&title=Fail2ban._Centos_7._Installation_and_configuring
Fail2ban. Centos 7. Installation and configuring - История изменений
2026-10-22T22:45:06Z
История изменений этой страницы в вики
MediaWiki 1.36.2
https://wiki.cless.pro/index.php?title=Fail2ban._Centos_7._Installation_and_configuring&diff=1384&oldid=prev
Cless: Новая страница: «= Links = https://losst.ru/nastrojka-fail2ban-centos-7 = Installation and configuring = <code>yum install epel-release</code> <code>yum install fail2ban</code>...»
2023-03-25T06:14:03Z
<p>Новая страница: «= Links = https://losst.ru/nastrojka-fail2ban-centos-7 = Installation and configuring = <code>yum install epel-release</code> <code>yum install fail2ban</code>...»</p>
<p><b>Новая страница</b></p><div>= Links =<br />
https://losst.ru/nastrojka-fail2ban-centos-7<br />
<br />
= Installation and configuring =<br />
<code>yum install epel-release</code><br />
<br />
<code>yum install fail2ban</code><br />
<br />
Backup original config '''/etc/fail2ban/jail.conf'''<br />
<br />
<code>mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.ORIG</code><br />
<br />
It will be rewrited on update, so don't use it<br />
<br />
Use /etc/fail2ban/jail.local config instead<br />
<br />
Copy orig conf to custom conf<br />
<br />
<code>cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local</code><br />
<br />
Edit conf<br />
<br />
<code>nano /etc/fail2ban/jail.local</code><br />
...<br />
# enable fail2ban<br />
enabled = true<br />
...<br />
<br />
# "maxretry" is the number of failures before a host get banned.<br />
maxretry = 5<br />
...<br />
<br />
# time to ban IP<br />
bantime = 10m<br />
<br />
# A host is banned if it has generated "maxretry" during the last "findtime"<br />
findtime = 10m<br />
...<br />
<br />
# DELETE ALL SERVICES, EXCEPT SERVICES WE WILL USE<br />
# as example - SSHD<br />
<br />
[sshd]<br />
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:<br />
# normal (default), ddos, extra or aggressive (combines all).<br />
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.<br />
#mode = normal<br />
port = ssh<br />
logpath = %(sshd_log)s<br />
backend = %(sshd_backend)s<br />
...<br />
Restart fail2ban<br />
<br />
<code>systemctl restart fail2ban</code><br />
<br />
= Test from client =<br />
Try to login to server 5 times with wrong password<br />
<br />
<code>ssh root@<server-with-fail2ban></code><br />
<br />
= Test at server =<br />
<code>cat /var/log/fail2ban.log</code><br />
...<br />
2021-03-08 11:51:28,721 fail2ban.filter [2280]: INFO [sshd] Found 192.168.17.250 - 2021-03-08 11:51:28<br />
2021-03-08 11:51:31,446 fail2ban.filter [2280]: INFO [sshd] Found 192.168.17.250 - 2021-03-08 11:51:31<br />
2021-03-08 11:51:33,862 fail2ban.filter [2280]: INFO [sshd] Found 192.168.17.250 - 2021-03-08 11:51:33<br />
2021-03-08 11:52:38,031 fail2ban.filter [2280]: INFO [sshd] Found 192.168.17.250 - 2021-03-08 11:52:38<br />
2021-03-08 11:52:40,501 fail2ban.filter [2280]: INFO [sshd] Found 192.168.17.250 - 2021-03-08 11:52:40<br />
2021-03-08 11:52:40,880 fail2ban.actions [2280]: NOTICE [sshd] Ban 192.168.17.250<br />
...<br />
Look at iptables rule<br />
<br />
<code>iptables -L f2b-sshd -v --line-numbers</code><br />
...<br />
Chain f2b-sshd (1 references)<br />
num pkts bytes target prot opt in out source destination<br />
1 8 1004 REJECT all -- any any 192.168.17.250 anywhere reject-with icmp-port-unreachable<br />
...<br />
Client 192.168.17.250 is BANNED!<br />
<br />
Manual delete ban rule<br />
<br />
<code>iptables -D f2b-sshd 1</code><br />
[[Категория:Fail2ban]]<br />
__ОБЯЗАТЕЛЬНОЕ_ОГЛАВЛЕНИЕ__</div>
Cless