暴力防止解読--fail 2 ban(詳細およびインストール操作centos 7編)

原理:
iptablesなどの安全戦略を呼び出すことで暴力解読を防ぐ目的を達成する.
環境:
centos 7 :192.168.253.130
 1.fail 2 banのインストール

[root@hya ~]# yum -y install epel-release  epel   fail2ban      
[root@hya ~]# yum -y install fail2ban

 2.fail 2 banの構成

[root@hya ~]# vim /etc/fail2ban/jail.conf 
[DEFAULT] 
ignoreip = 127.0.0.1/8 
ignorecommand =
bantime  = 60       #    ，-1     
findtime  = 60      #                         
maxretry = 3        #      
backend = auto     #         
usedns = warn      #ssh    
logencoding = auto
enabled = false

[ssh-iptables] ##     （   SSHD      ） 
enabled = true ##       ，false     
filter = sshd ##      filter   ，   filter.d      sshd.conf  action   = iptables[name=SSH, port=22, protocol=tcp]

《###action = iptables[name=SSH, port=ssh, protocol=tcp] ##     
sendmail-whois[name=SSH, [email protected], [email protected],   sendername="Fail2Ban"] ##       
                          ##                 ##      ####》        

logpath = /var/log/secure ##            
maxretry = 3 ##       

 3.テストを行う

[root@localhost ~]# ssh 192.168.253.130               
ssh: connect to host 192.168.253.130 port 22: Connection refused
[root@hya ~]# fail2ban-client status ssh-iptables    
Status for the jail: ssh-iptables
|- Filter
|  |- Currently failed:	0
|  |- Total failed:	6
|  `- File list:	/var/log/secure
`- Actions
   |- Currently banned:	1
   |- Total banned:	2
   `- Banned IP list:	192.168.253.137

[root@hya ~]# vim  /var/log/secure               ip
Jul 14 22:03:58 localhost sshd[12509]: Failed password for root from 192.168.253.137 port 55829 ssh2
Jul 14 22:03:58 localhost sshd[12509]: Connection closed by 192.168.253.137 port 55829 [preauth]
Jul 14 22:03:58 localhost sshd[12509]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.253.137  user=root