Fail2ban是一款用于保護Linux服務器免受攻擊的工具，它通過監(jiān)控系統(tǒng)日志文件，識別并封鎖惡意IP地址，從而防止服務器被頻繁訪問或遭受拒絕服務攻擊，下面是使用Fail2ban保護Linux服務器的詳細步驟：

1、安裝Fail2ban

在Debian/Ubuntu系統(tǒng)上，可以使用aptget命令進行安裝：

“`

sudo aptget update

sudo aptget install fail2ban

“`

在CentOS/RHEL系統(tǒng)上，可以使用yum命令進行安裝：

“`

sudo yum install epelrelease

sudo yum install fail2ban

“`

2、配置Fail2ban

編輯Fail2ban配置文件/etc/fail2ban/jail.local，根據(jù)需要進行配置，以下是一些常用的配置選項：

“`

[DEFAULT]

# Ban time in seconds

bantime = 3600

# Action to take when a new IP is banned

action = iptables[name=DROP, port=ssh]

# Log file to monitor for new IPs

logpath = /var/log/auth.log

# Regular expression to match new IP addresses

findtime = 86400

# Number of previous occurrences of an IP address required before banning it

maxretry = 5

“`

保存并關(guān)閉配置文件。

3、啟動Fail2ban服務

在Debian/Ubuntu系統(tǒng)上，可以使用systemctl命令啟動Fail2ban服務：

“`

sudo systemctl start fail2ban

“`

在CentOS/RHEL系統(tǒng)上，可以使用service命令啟動Fail2ban服務：

“`

sudo service fail2ban start

“`

若要使Fail2ban服務隨系統(tǒng)啟動而自動運行，可以使用以下命令啟用自啟動：

“`

sudo systemctl enable fail2ban

“`

或

“`

sudo chkconfig fail2ban on

“`

4、監(jiān)控和測試Fail2ban是否正常工作

Fail2ban會自動開始監(jiān)控指定的日志文件，并根據(jù)配置的規(guī)則對惡意IP地址進行封鎖，可以通過查看/var/log/fail2ban.log日志文件來確認Fail2ban是否正常工作，如果看到類似以下的輸出，則表示Fail2ban已成功封鎖了惡意IP地址：

“`

Jul 17 10:34:56 server fail2ban[12345]: Ban xxx.xxx.xxx.xxx completed, total banned IPs: 10000000000000000000000000000000, banned IP list size: 19999999999999999999999999999999, output size: 19999999999999999999999999999999, average ban delay: 3600s, current ban delay: 3600s, max ban delay: 3600s, min ban delay: 3600s, ban reason: Too many authentication failures for user root from xxx.xxx.xxx.xxx port 54777 sshd[sshd] [pid=12345] [active since Mon Jul 17 10:34:56 2023] [total failed logins: 15] [successful logins: 15] [attempted passwords: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [last successful login: Mon Jul 17 10:34:56 2023] [last failed login: Mon Jul 17 10:34:56 2023] [failed password attempts since last login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [login attempts since first failed login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [failed password attempts since first failed login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total login attempts since first login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total failed login attempts since first failed login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total successful login attempts since first successful login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total failed login attempts since first successful login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total successful login attempts since first failed login attempt: ‘root:root’ ‘root:password’ ‘root:admin’ ‘root:test’ ‘root:123456’ ‘root:abcdefg’] [total failed login attempts since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful login attempt since first successful