Fail2ban tools to prevent violent cracking under linux

The function of fail2ban is still very powerful, interested students can learn from Baidu on their own, which is mainly used to prevent violent cracking of the server.

Experimental environment:

Ali CVM. The system is centos 7.2 1511.

The principle of implementation:

The fail2ban monitoring ssh service monitors the / var/log/secure log file to view the log of login failure. When the set early warning value is reached, an iptables rule is automatically generated, and the source ip access port is shielded through the firewall.

Install fail2ban below:

1. First install the dependency package:

Command: yum-y install gamin-python python-inotify python-ctypes

Wget http://ftp.sjtu.edu.cn/fedora/epel/5/i386/fail2ban-0.8.14-1.el5.noarch.rpm-> download dependency packages

Rpm-ivh fail2ban-0.8.14-1.el5.noarch.rpm-> install dependency packages using rpm

two。 Install fail2ban with source code:

Command: wget https://codeload.github.com/fail2ban/fail2ban/tar.gz/0.9.0-> download the source package

Tar-xzvf fail2ban-0.9.0.tar.gz-> decompress the source package

3. Configure fail2ban: this is configured to monitor the ssh service, which is directly blocked after more than 3 login failures in one day (86400 seconds), and the blocking time is one day (86400 seconds).

Command: vi / etc/fail2ban/jail.conf

[ssh-iptables]

Enabled = true-> true is enabled

Filter = sshd-> name of the monitored service

Action = iptables [name=SSH, port=ssh, protocol=tcp]-> relevant parameters of the action

Logpath = / var/log/secure-> detected log file

Maxretry = 3-> maximum number of attempts

Bantime = 86400-> shielding time

Findtime = 86400-> exceeding the specified number of times during this period will be prohibited.

4. Start the service:

Command: service fail2ban start

In order to prevent the simple installation and use of the more practical fail2ban tools to prevent violence, fail2ban has many powerful functions. Thank you for browsing.