# fail2ban-client -d 2023-01-30 16:14:51,875 fail2ban.configreader [1333]: WARNING 'allowipv6' not defined in 'Definition'. Using default one: 'auto' ['set', 'syslogsocket', 'auto'] ['set', 'loglevel', 'INFO'] ['set', 'logtarget', '/var/log/fail2ban.log'] ['set', 'allowipv6', 'auto'] ['set', 'dbfile', '/var/db/fail2ban/fail2ban.sqlite3'] ['set', 'dbmaxmatches', 10] ['set', 'dbpurgeage', '1d']
/usr/local/etc/fail2ban/ ├── action.d此目录存放匹配后采取相应动作的文件 │ ├── dummy.conf │ ├── hostsdeny.conf │ ├── iptables.conf │ ├── mail-whois.conf │ ├── ...... │ └── shorewall.conf ├── fail2ban.conffail2ban-server的配置文件，一般不做改动 ├── fail2ban.d ├── filter.d存放过滤器配置文件 │ ├── apache-auth.conf │ ├── apache-noscript.conf │ ├── couriersmtp.conf │ ├── postfix.conf │ ├── proftpd.conf │ ├── qmail.conf │ ├── ...... │ ├── sshd.conf │ └── vsftpd.conf ├── jail.confjail配置文件 └── jail.d/此目录默认为空，建议将jail配置文件保存到此目录中，便于管理
[ssh-iptables] #enabled = false enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] # mail-whois[name=SSH, dest=yourmail@mail.com] #logpath = /var/log/sshd.log logpath = /var/log/auth.log maxretry = 5
| 名称 | 默认值 | 说明 |
|---|---|---|
| filter | jail用于检测匹配项的过滤器的名称。 过滤器的每一次匹配都会使jail内的计数器递增。 |
|
| logpath | /var/log/messages | 提供给过滤器的日志文件的路径。 |
| maxretry | 3 | 触发IP禁止操作的匹配数（即计数器值）。 |
| findtime | 600 sec | 如果在“findtime”秒内未找到匹配项，则计数器设置为零。 |
| bantime | 600 sec | 禁止IP的持续时间（秒）。负数表示“permanent(永久)”禁令。 |
failregex = Authentication failure for .* fromFailed [-/\w]+ for .* from ROOT LOGIN REFUSED .* FROM [iI](?:llegal|nvalid) user .* from
Jan 10 07:02:37 homebrou sshd[18419]: Failed password for root from 222.76.213.151 port 55236 ssh2
# fail2ban-regex 'Jul 18 12:13:01 [1.2.3.4] authentication failed' 'authentication failed' Running tests ============= Use failregex line : authentication failed ERROR: No failure-id group in 'authentication failed'执行错误，并返回“No failure-id group”错误。 # fail2ban-regex 'Jul 18 12:13:01 [1.2.3.4] authentication failed' '\[<HOST>\] authentication failed' Running tests ============= Use failregex line : \[<HOST>\] authentication failed Use single line : Jul 18 12:13:01 [1.2.3.4] authentication failed Results ======= Failregex: 1 total |- #) [# of hits] regular expression | 1) [1] \[<<HOST>\] authentication failed `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [1] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)? `- Lines: 1 lines, 0 ignored, 1 matched, 0 missed [processed in 0.02 sec]执行成功，找到了主机1.2.3.4 # fail2ban-regex '18-07-2008 12:13:01 [1.2.3.4] authentication failed' '\[<HOST>\] authentication failed' Running tests ============= Use failregex line : \[<HOST>\] authentication failed Use single line : 18-07-2008 12:13:01 [1.2.3.4] authentication failed Results ======= Failregex: 1 total |- #) [# of hits] regular expression | 1) [1] \[<HOST>\] authentication failed `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [1] {^LN-BEG}Day(?P<_sep>[-/])Month(?P=_sep)(?:ExYear|ExYear2) %k:Minute:Second `- Lines: 1 lines, 0 ignored, 1 matched, 0 missed [processed in 0.02 sec]执行成功，找到了主机1.2.3.4 # fail2ban-regex '18-7-2008 12:13:01 [1.2.3.4] authentication failed' '\[<HOST>\] authentication failed' Running tests ============= Use failregex line : \[<HOST>\] authentication failed Use single line : 18-7-2008 12:13:01 [1.2.3.4] authentication failed Results ======= Failregex: 1 total |- #) [# of hits] regular expression | 1) [1] \[<HOST>\] authentication failed `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [1] {^LN-BEG}Day(?P<_sep>[-/])Month(?P=_sep)(?:ExYear|ExYear2) %k:Minute:Second `- Lines: 1 lines, 0 ignored, 1 matched, 0 missed [processed in 0.02 sec]执行成功，找到了主机1.2.3.4