Fail2ban 安装与配置指南 Print

Fail2ban 是一款基于日志的入侵防御软件，能自动将多次登录失败的 IP 加入防火墙黑名单。

安装

sudo apt update
sudo apt install fail2ban

基本配置

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

配置 SSH 防护

编辑 /etc/fail2ban/jail.local：

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
findtime = 600

配置 Nginx 防护

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 10
bantime = 3600

管理命令

# 查看状态
sudo fail2ban-client status
sudo fail2ban-client status sshd

# 解封 IP
sudo fail2ban-client set sshd unbanip 192.168.1.100

# 重新加载配置
sudo fail2ban-client reload

白名单设置

[sshd]
ignoreip = 127.0.0.1/8 192.168.1.0/24