fail2ban的功能和特性(实测)

fail2ban的功能和特性

https://fedoraproject.org/wiki/Fail2ban_with_FirewallD

1、支持大量服务。如sshd,apache,qmail,proftpd,sasl等等
2、支持多种动作。如iptables,tcp-wrapper,shorewall(iptables第三方工具),mail notifications(邮件通知)等等。
3、在logpath选项中支持通配符
4、需要Gamin支持(注：Gamin是用于监视文件和目录是否更改的服务工具)
5、需要安装python,iptables,tcp-wrapper,shorewall,Gamin。如果想要发邮件，那必需安装postfix/sendmail

/etc/fail2ban/action.d #动作文件夹，内含默认文件。iptables以及mail等动作配置
/etc/fail2ban/fail2ban.conf #定义了fai2ban日志级别、日志位置及sock文件位置
/etc/fail2ban/filter.d #条件文件夹，内含默认文件。过滤日志关键内容设置
/etc/fail2ban/jail.conf #主要配置文件，模块化。主要设置启用ban动作的服务及动作阀值

1.下载，安装
wget https://github.com/fail2ban/fail2ban/archive/0.11.tar.gz -O fail2ban-0.11.tar.gz
tar -zvxf fail2ban-0.11.tar.gz && cd fail2ban-0.11
python setup.py install

2.修改配置文件
vim /etc/fail2ban/fail2ban.conf
修改以下内容
socket = /var/run/fail2ban.sock
pidfile = /var/run/fail2ban.pid
:wq 保存退出

3.自定义规则
vim /etc/fail2ban/jail.local
修改以下内容

[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 3000
findtime = 600
maxretry = 5
banaction = firewallcmd-ipset
action = %(action_mwl)s

[sshd]
enabled = true
filter = sshd
port = 22
action = %(action_mwl)s
logpath = /var/log/secure

[nginx-cc]
enabled = true
port = http,https
filter = nginx-cc
maxretry = 20
findtime = 60
bantime = 300
action = %(action_mwl)s
logpath = /opt/nginx/logs/access.log

:wq 保存退出

4.设置自动启动
[root@centos7 system]# vim /etc/systemd/system/fail2ban.service
修改以下内容

[Unit]
Description=Fail2Ban Service
Documentation=man:fail2ban(1)
After=network.target iptables.service firewalld.service
PartOf=firewalld.service

[Service]
Type=forking
ExecStart=/usr/bin/fail2ban-client -x start
ExecStop=/usr/bin/fail2ban-client stop
ExecReload=/usr/bin/fail2ban-client reload
PIDFile=/var/run/fail2ban.pid
Restart=always

[Install]
WantedBy=multi-user.target

:wq 保存退出

[root@centos7 system]# vim /etc/systemd/system/fail2ban.service
修改以下内容
[Definition]
failregex = <HOST> -.*- .*HTTP/1.* .* .*$
ignoreregex =

:wq 保存退出

5.调试过滤器 （查看fail2ban过滤器是否适用于特定日志文件）

fail2ban-regex /opt/nginx/logs/access.log /etc/fail2ban/filter.d/nginx-cc.conf

如果，输出内容是零匹配，那么过滤器的正规表达式可能有问题。
-----------------------------------------------------------------------------------------------------------------------
[root@centos7 system]#cat /opt/nginx/logs/access.log
192.168.1.222 - - [26/Oct/2019:15:01:34 +0800] "GET / HTTP/1.1" 200 96 "-" "curl/7.29.0"
127.0.0.1 - - [26/Oct/2019:19:34:29 +0800] "GET / HTTP/1.1" 200 96 "-" "curl/7.29.0"
127.0.0.1 - - [26/Oct/2019:19:34:35 +0800] "GET / HTTP/1.1" 200 96 "-" "curl/7.29.0"
192.168.1.107 - - [26/Oct/2019:19:34:57 +0800] "GET / HTTP/1.1" 200 96 "-" "Mozilla/5.0 (Windows NT 10.0; Win6 4; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36"
192.168.1.107 - - [26/Oct/2019:19:34:57 +0800] "GET /favicon.ico HTTP/1.1" 404 555 "http://192.168.1.221/" "Mo zilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537. 36"
192.168.1.107 - - [26/Oct/2019:19:37:56 +0800] "GET / HTTP/1.1" 200 96 "-" "curl/7.65.3"
192.168.1.107 - - [26/Oct/2019:19:38:25 +0800] "GET / HTTP/1.1" 200 96 "-" "fasthttp"
192.168.1.107 - - [26/Oct/2019:19:38:25 +0800] "GET / HTTP/1.1" 200 96 "-" "fasthttp"

正式则表达式匹配
# ^<HOST> - - .*HTTP/1.1.*$
# ^<HOST>.*$
# ^<HOST>.*Mozilla.*$
# ^<HOST>.*"fasthttp".*$
# failregex = ^<HOST>.*"curl/7.29.0".*$
# failregex = ^<HOST>.*"(GET|POST).*" (404|444|403|400) .*$
-----------------------------------------------------------------------------------------------------------------------

6. 设为允许默认启动
systemctl enable fail2ban
systemctl restart fail2ban && systemctl status fail2ban

7.查看版本，状态
fail2ban-client version
fail2ban-client status
fail2ban-client status sshd

8.查看当前触发规则，删除规则禁止IP （需要指定规则名称及IP，sshd,192.168.1.107）
ipset list
fail2ban-client set sshd unbanip 192.168.1.107

9.查看相关文件日志
tail -f /var/log/secure
tail -f /var/log/fail2ban.log
cat /var/spool/mail/root

10.查看防火墙
firewall-cmd --state
firewall-cmd --reload && iptables -L --line-numbers|grep ACCEPT
firewall-cmd --zone=public --list-ports
firewall-cmd --direct --get-all-rules
------------------------------------------------------------
添加规则
firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -p tcp --dport 80 -s 172.25.254.77 -j ACCEPT
## 只允许172.25.254.77通过80端口访问主机的http服务。
## 主机内核同意开启http服务，需要在表filter中设置INPUT。
##-p 数据包类型；--dport 服务端口；
------------------------------------------------------------