背景介紹

雙十一的時(shí)候薅羊毛租了臺(tái)騰訊云的虛機(jī), 是真便宜, 只是沒(méi)想到才跑了一個(gè)月, 系統(tǒng)里面就收集到了巨多的 SSH 惡意登錄失敗記錄.

只能說(shuō), 互聯(lián)網(wǎng)真的是太不安全了. 之前有用過(guò) fail2ban 在 CentOS 7 上面做過(guò)防護(hù), 不過(guò)那已經(jīng)是好久好久之前的故事了, 好多方法已經(jīng)不再適用. 下面記錄一下在 Debian 12 上安裝和配置 fail2ban 的過(guò)程.

配置過(guò)程

# 安裝 ufw 和 fail2ban
sudo apt install -y ufw fail2ban# 配置 ufw 防火墻放行 SSH 端口
sudo ufw allow SSH# 開(kāi)啟 ufw
sudo ufw enable
sudo systemctl enable ufw --now

下面開(kāi)始編輯 fail2ban 配置文件

sudo vim /etc/fail2ban/jail.d/defaults-debian.conf

[DEFAULT]
# 忽略的 IP 地址, 相當(dāng)于白名單
ignoreip = 1.1.1.1
# [重點(diǎn)] 指定使用 ufw 作為防護(hù)的操作
banaction = ufw[sshd]
enabled = true
# [重點(diǎn)] Debian 12 中的 SSH 審計(jì)日志都在 systemd 里面, 所以一定要指定
backend = systemd
filter = sshd

保存配置后啟動(dòng)原神 服務(wù)

sudo systemctl enable fail2ban --now

測(cè)試驗(yàn)證

檢查當(dāng)前 fail2ban 的狀態(tài), 還沒(méi)有 Banned IP

sudo fail2ban-client status sshdStatus for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions|- Currently banned: 0|- Total banned:     0`- Banned IP list:

再開(kāi)個(gè) SSH 鏈接, 故意輸錯(cuò)密碼5次, 再訪問(wèn)就直接 ssh: connect to host 172.17.65.147 port 22: Connection timed out

查看 fail2ban 的日志:

root@lpwm-virtualmachine:/var/log# cat fail2ban.log
2024-12-24 23:01:07,663 fail2ban.server         [1975]: INFO    --------------------------------------------------
2024-12-24 23:01:07,663 fail2ban.server         [1975]: INFO    Starting Fail2ban v1.0.2
2024-12-24 23:01:07,663 fail2ban.observer       [1975]: INFO    Observer start...
2024-12-24 23:01:07,668 fail2ban.database       [1975]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2024-12-24 23:01:07,669 fail2ban.database       [1975]: WARNING New database created. Version '4'
2024-12-24 23:01:07,669 fail2ban.jail           [1975]: INFO    Creating new jail 'sshd'
2024-12-24 23:01:07,681 fail2ban.jail           [1975]: INFO    Jail 'sshd' uses systemd {}
2024-12-24 23:01:07,682 fail2ban.jail           [1975]: INFO    Initiated 'systemd' backend
2024-12-24 23:01:07,682 fail2ban.filter         [1975]: INFO      maxLines: 1
2024-12-24 23:01:07,689 fail2ban.filtersystemd  [1975]: INFO    [sshd] Added journal match for: '_SYSTEMD_UNIT=sshd.service + _COMM=sshd'
2024-12-24 23:01:07,689 fail2ban.filter         [1975]: INFO      maxRetry: 5
2024-12-24 23:01:07,689 fail2ban.filter         [1975]: INFO      findtime: 600
2024-12-24 23:01:07,689 fail2ban.actions        [1975]: INFO      banTime: 600
2024-12-24 23:01:07,689 fail2ban.filter         [1975]: INFO      encoding: UTF-8
2024-12-24 23:01:07,690 fail2ban.jail           [1975]: INFO    Jail 'sshd' started
2024-12-24 23:01:07,691 fail2ban.filtersystemd  [1975]: INFO    [sshd] Jail is in operation now (process new journal entries)
2024-12-24 23:02:50,864 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:02:50
2024-12-24 23:02:51,404 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:02:51
2024-12-24 23:02:54,154 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:02:53
2024-12-24 23:03:21,154 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:03:20
2024-12-24 23:03:23,904 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:03:23
2024-12-24 23:03:23,920 fail2ban.actions        [1975]: NOTICE  [sshd] Ban 172.17.64.1
2024-12-24 23:03:26,654 fail2ban.filter         [1975]: INFO    [sshd] Found 172.17.64.1 - 2024-12-24 23:03:26

再次檢查 fail2ban 狀態(tài), 可以看到 Banned IP 多了一個(gè):

root@lpwm-virtualmachine:/var/log# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     6
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd
`- Actions|- Currently banned: 1|- Total banned:     1`- Banned IP list:   172.17.64.1

查看 ufw 狀態(tài), 也多了一條 REJECT 的記錄:

root@lpwm-virtualmachine:/var/log# ufw status
Status: activeTo                         Action      From
--                         ------      ----
Anywhere                   REJECT      172.17.64.1                # by Fail2Ban after 5 attempts against sshd
SSH                        ALLOW       Anywhere
WWW                        ALLOW       Anywhere
SSH (v6)                   ALLOW       Anywhere (v6)
WWW (v6)                   ALLOW       Anywhere (v6)

后話

以上均使用的是 fail2ban 的默認(rèn)配置, 即最多連續(xù) 5 次錯(cuò)誤登錄就會(huì)自動(dòng)加到 ufw 防火墻規(guī)則中給 Ban 掉, 如果需要調(diào)整具體的規(guī)則, 可以修改 /etc/fail2ban/jail.d/defaults-debian.conf, 完整配置說(shuō)明請(qǐng)參考 https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf