محافظت از SSH با ابزار Fail2ban

1sudo yum install epel-release

1sudo yum install fail2ban

1sudo systemctl enable fail2ban23sudo systemctl start fail2ban

1tail -f /var/log/secure23grep 'sshd.*Failed password for' /var/log/secure

1Sep 26 10:08:10 localhost sshd[16031]: Failed password for root from 49.88.112.90 port 15595 ssh223Sep 26 10:08:13 localhost sshd[16031]: Failed password for root from 49.88.112.90 port 15595 ssh245Sep 26 10:13:19 localhost sshd[16039]: Failed password for root from 222.186.52.89 port 58696 ssh267Sep 26 10:13:22 localhost sshd[16039]: Failed password for root from 222.186.52.89 port 58696 ssh289Sep 26 10:13:26 localhost sshd[16039]: Failed password for root from 222.186.52.89 port 58696 ssh21011Sep 26 10:16:14 localhost sshd[17218]: Failed password for root from 49.88.112.80 port 41089 ssh21213Sep 26 10:16:16 localhost sshd[17218]: Failed password for root from 49.88.112.80 port 41089 ssh21415Sep 26 10:16:19 localhost sshd[17218]: Failed password for root from 49.88.112.80 port 41089 ssh21617Sep 26 10:19:14 localhost sshd[17226]: Failed password for root from 153.36.236.35 port 44787 ssh21819Sep 26 10:19:17 localhost sshd[17226]: Failed password for root from 153.36.236.35 port 44787 ssh22021Sep 26 10:19:19 localhost sshd[17226]: Failed password for root from 153.36.236.35 port 44787 ssh22223Sep 26 10:22:06 localhost sshd[17260]: Failed password for root from 222.186.30.165 port 22558 ssh22425Sep 26 10:22:08 localhost sshd[17260]: Failed password for root from 222.186.30.165 port 22558 ssh22627Sep 26 10:22:11 localhost sshd[17260]: Failed password for root from 222.186.30.165 port 22558 ssh2

1sudo yum update23sudo yum install epel-release45sudo yum update

1sudo yum install fail2ban

1sudo systemctl enable fail2ban

1Created symlink /etc/ystem/system/multi-user.target.wants/fail2ban.service ? /usr/lib/ystem/system/fail2ban.service.

1sudo vi /etc/fail2ban/jail.local

1[DEFAULT]23# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):45bantime = 8640067 89# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.1011findtime = 6001213maxretry = 31415 1617# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban1819# will not ban a host which matches an address in this list. Several addresses2021# can be defined using space (and/or comma) separator. For example, add your2223# static IP address that you always use for login such as 103.1.2.32425#ignoreip = 127.0.0.1/8 ::1 103.1.2.32627 2829# Call iptables to ban IP address3031banaction = iptables-multiport3233 3435# Enable sshd protection36373839enabled = true

1sudo systemctl start fail2ban23sudo systemctl status fail2ban

1sudo systemctl start fail2ban23sudo systemctl stop fail2ban45sudo systemctl restart fail2ban67sudo systemctl status fail2ban

1sudo fail2ban-client status23sudo fail2ban-client status sshd

1cd /etc/fail2ban/filter.d23ls

1sudo cat /etc/fail2ban/filter.d/sshd.conf

1sudo vi /etc/fail2ban/filter.d/sshd.conf

1tail -f /var/log/fail2ban.log23grep IP-address /var/log/fail2ban.log45sudo iptables -L -n -v67sudo iptables -L f2b-sshd -n -v89sudo iptables -S | f2b-sshd