CentOS 7安裝fail2ban + Firewalld防止爆破與CC攻擊

1. 安裝fail2ban

步驟1：更新系統(tǒng)

sudo yum update y

步驟2：安裝fail2ban

sudo yum install fail2ban y

步驟3：啟動并設(shè)置開機自啟動

sudo systemctl start fail2ban
sudo systemctl enable fail2ban

2. 配置Firewalld

步驟1：安裝Firewalld

sudo yum install firewalld y

步驟2：啟動并設(shè)置開機自啟動

sudo systemctl start firewalld
sudo systemctl enable firewalld

步驟3：添加端口規(guī)則（以SSH為例）

sudo firewallcmd permanent addport=22/tcp
sudo firewallcmd reload

3. 配置fail2ban

步驟1：編輯jail.local文件

sudo vi /etc/fail2ban/jail.local

在文件中添加以下內(nèi)容：

[ssh]
enabled  = true
port     = 22
filter   = sshd
logpath  = /var/log/secure
maxretry = 3
action   = firewallcmdipset

步驟2：創(chuàng)建firewallcmdipset動作文件

sudo vi /etc/fail2ban/action.d/firewallcmdipset.conf

在文件中添加以下內(nèi)容：

Fail2Ban configuration file
#
Author: YourName
#
[INCLUDES]
[Definition]
Options used by action, common for all jails
actionstart =  a  s  
actionstop =  a  s  X 
actioncheck =  a  s  
Default banning range (e.g. IPv4, IPv6, ...)
default = 0.0.0.0/0
The following options can be used with IPv4 only
bantime = 3600 # Default ban time in seconds for IPv4
maxretry = 3  # Default max number of retries before ban in IPv4 mode
ignoreip = 127.0.0.1/8 # Local host subnets
banip = 0.0.0.0/0 # All the IP addresses to ban
findtime = 600 # Default time in seconds between checks if an IP is still banned
The following options can be used with IPv6 only
bantime6 = 3600 # Default ban time in seconds for IPv6
maxretry6 = 3  # Default max number of retries before ban in IPv6 mode
ignoreip6 = fe80::/10 # Local host subnets
banip6 = ::/0 # All the IP addresses to ban
findtime6 = 600 # Default time in seconds between checks if an IP is still banned

步驟3：重啟fail2ban服務(wù)

sudo systemctl restart fail2ban

至此，CentOS 7已經(jīng)成功安裝fail2ban和Firewalld，可以有效防止爆破和CC攻擊。

相關(guān)問題與解答

Q1：如何查看被禁止的IP地址？

A1：可以使用以下命令查看被禁止的IP地址：

sudo fail2banclient status ssh

Q2：如何解除某個IP地址的封禁？

A2：可以使用以下命令解除某個IP地址的封禁（將替換為實際的IP地址）：

sudo firewallcmd permanent zone=public removesource=/32
sudo firewallcmd reload

網(wǎng)站題目：CentOS7安裝fail2ban+Firewalld防止爆破與CC攻擊
文章分享：http://uogjgqi.cn/article/dhdcogo.html