93 lines
2.3 KiB
Markdown
Executable File
93 lines
2.3 KiB
Markdown
Executable File
\[i=s\] 本帖最后由 神经蛙\_r9959 于 2024-11-18 14:05 编辑 \[/i\]
|
||
|
||
背景
|
||
|
||
> 使用nas的小伙伴通常会用ddns或者IPV6把服务暴露到公网，方便访问，一旦暴露到公网，不可避免的会被扫描爆破，一旦被爆破对我们来说也是一个灾难，可能好几年的图片都丢失，所以最好还是加一道防护，防止爆破，这里我是用fail2ban对账号进行保护
|
||
|
||
#### 1.安装fail2ban
|
||
|
||
```null
|
||
#1. 安装fail2ban
|
||
sudo apt install fail2ban
|
||
|
||
```
|
||
|
||
#### 2\. 添加日志过滤的配置
|
||
|
||
```null
|
||
#
|
||
sudo vim /etc/fail2ban/filter.d/trim_main.conf
|
||
|
||
```
|
||
|
||
```null
|
||
#以下内容写入到/etc/fail2ban/filter.d/trim_main.conf
|
||
[Definition]
|
||
failregex = MAINEVENT:.*"template":"LoginFail".*"IP":"<HOST>"
|
||
ignoreregex =
|
||
|
||
```
|
||
|
||
#### 3\. 设置要ban的规则
|
||
|
||
```null
|
||
#
|
||
sudo vim /etc/fail2ban/jail.local
|
||
|
||
```
|
||
|
||
```null
|
||
#把下面配置写入jail.local
|
||
[DEFAULT]
|
||
# 忽略的IP地址列表，局域网内的ip不做限制
|
||
ignoreip = 127.0.0.1/8 192.168.1.0/24
|
||
# 默认的禁用时间（秒）
|
||
bantime = 3600
|
||
# 最大失败尝试次数
|
||
maxretry = 5
|
||
|
||
# 日志级别
|
||
loglevel = 3
|
||
|
||
[trim_main]
|
||
enabled = true
|
||
filter = trim_main
|
||
logpath = /var/log/syslog
|
||
maxretry = 5
|
||
bantime = 3600
|
||
findtime = 600
|
||
#若想ban掉某个ip，不让他访问飞牛服务器任何端口，就用这个配置
|
||
#action = iptables-allports[name=trim_main, port="all"]
|
||
#只ban 掉飞牛5667端口访问权限
|
||
action = iptables-multiport[name=trim_main, port="5667", protocol=tcp]
|
||
|
||
```
|
||
|
||
以上参数可根据自己的需求做调整，比如密码错误次数，ban的时间长短，还有ban的端口，因为我对外暴露的就一个5667端口，所以这里我就ban了5667，如果想直接ban掉ip的所有访问权限，直接把 `action = iptables-allports[name=trim_main, port="all"]`的注释去掉，把5667那个配置注释即可
|
||
|
||
#### 4\. fail2ban基本用法
|
||
|
||
```null
|
||
#启动
|
||
sudo systemctl start fail2ban
|
||
#停止
|
||
sudo systemctl stop fail2ban
|
||
# 重启
|
||
sudo systemctl stop fail2ban
|
||
# 查看被ban的ip
|
||
sudo fail2ban-client banned
|
||
# 解除某个被ban的ip
|
||
sudo fail2ban-client set trim_main unbanip x.x.x.x
|
||
#开机启动fail2ban
|
||
sudo systemctl enable fail2ban
|
||
# 禁止开机启动
|
||
sudo systemctl disable fail2ban
|
||
|
||
```
|
||
|
||
#### 5.飞牛的服务日志查看
|
||
|
||
```null
|
||
sudo tail -f /var/log/syslog
|
||
|
||
``` |