Linux教程之Centos 装置Fail2ban - 仓酷云

David-Linux:~#rpm-qlfail2ban/etc/fail2ban/action.d#举措文件夹，内含默许文件。iptables和mail等举措设置装备摆设/etc/fail2ban/fail2ban.conf#界说了fai2ban日记级别、日记地位及sock文件地位/etc/fail2ban/filter.d#前提文件夹，内含默许文件。过滤日记症结内容设置/etc/fail2ban/jail.conf#重要设置装备摆设文件，模块化。重要设置启用ban举措的办事及举措阀值/etc/rc.d/init.d/fail2ban#启动剧本文件

复制代码

David-Linux:/etc/fail2ban#catfail2ban.conf#Fail2Banconfigurationfile##Author:CyrilJaquier##$Revision:629$#[Definition]#Option:loglevel#Notes.:Setthelogleveloutput.#1=ERROR#2=WARN#3=INFO#4=DEBUG#Values:NUMDefault:3#loglevel=3#Option:logtarget#Notes.:Setthelogtarget.Thiscouldbeafile,SYSLOG,STDERRorSTDOUT.#Onlyonelogtargetcanbespecified.#Values:STDOUTSTDERRSYSLOGfileDefault:/var/log/fail2ban.log#logtarget=/var/log/fail2ban.log#Option:socket#Notes.:Setthesocketfile.Thisisusedtocommunicatewiththedaemon.Do#notremovethisfilewhenFail2banruns.Itwillnotbepossibleto#communicatewiththeserverafterwards.#Values:FILEDefault:/var/run/fail2ban/fail2ban.sock#socket=/var/run/fail2ban/fail2ban.sock

复制代码

David-Linux:/etc/fail2ban#catjail.conf#Fail2Banconfigurationfile##Author:CyrilJaquier##$Revision:747$##TheDEFAULTallowsaglobaldefinitionoftheoptions.Theycanbeoverride#ineachjailafterwards.[DEFAULT]#全局设置#"ignoreip"canbeanIPaddress,aCIDRmaskoraDNShost.Fail2banwillnot#banahostwhichmatchesanaddressinthislist.Severaladdressescanbe#definedusingspaceseparator.ignoreip=127.0.0.1#疏忽IP,在这个清单里的IP不会被屏障#"bantime"isthenumberofsecondsthatahostisbanned.bantime=600#屏障时光，以秒为单元#Ahostisbannedifithasgenerated"maxretry"duringthelast"findtime"#seconds.findtime=600#监测时光。在此时代内重试跨越划定次数，会激活fail2ban采用响应的举措。（也能够懂得成在这个时光段内跨越划定次数会被ban失落。）#"maxretry"isthenumberoffailuresbeforeahostgetbanned.maxretry=3#最年夜测验考试次数#"backend"specifiesthebackendusedtogetfilesmodification.Available#optionsare"gamin","polling"and"auto".Thisoptioncanbeoverriddenin#eachjailtoo(use"gamin"forajailand"polling"foranother).##gamin:requiresGamin(afilealterationmonitor)tobeinstalled.IfGamin#isnotinstalled,Fail2banwillusepolling.#polling:usesapollingalgorithmwhichdoesnotrequireexternallibraries.#auto:willchooseGaminifavailableandpollingotherwise.backend=auto#日记修正检测机制（gamin、polling和auto这三种）#ThisjailcorrespondstothestandardconfigurationinFail2ban0.6.#Themail-whoisactionsendanotificatione-mailwithawhoisrequest#inthebody.#上面都是一些子段的设置，但这外面的优先级会高于全局外面的设置，也就是说，当外面设置和全局设置有抵触的时刻，会以此段设置为准。假如没有的话就会挪用全局设置。[ssh-iptables]#相当于标签解释enabled=true#能否激活此项（true/false）filter=sshd#过滤规矩filter的名字，对应filter.d目次下的sshd.confaction=iptables[name=SSH,port=ssh,protocol=tcp]#举措的相干参数。假如不是默许端口的话，记得也要响应的把办事改成端口sendmail-whois[name=SSH,dest=you@mail.com,sender=fail2ban@mail.com]#发送邮件dest是目的，sender是发送者（记得要有SMTP办事啊）#留意：此举措也和filter相似，都是挪用响应的设置装备摆设文件（举措的设置装备摆设文件action.d下的ptables.conf和sendmail-whois.conf）logpath=/var/log/messages#日记记载的地位maxretry=3#最年夜测验考试次数，此项会笼罩全局中maxretry设置

复制代码

#此设置的也许意思就是：fail2ban会依照你的过滤规矩（filter=sshd也就是filter.d/sshd.conf）去检查响应的日记文件（logpath=/var/log/messages）,然后在findtime=600“10分钟”（此时光以全局的为准）以内相符前提的记载上去，假如达到了maxretry=3“3次相符前提”就对这个采用响应的举措action（ptables.conf和sendmail-whois.conf），而且限制的时光为bantime=600“10分钟”。

复制代码

David-Linux:/etc/fail2ban#

复制代码