Fail2Ban 是一个广泛使用的工具，用于检测恶意登录尝试和其他异常活动，并自动封锁攻击者的IP地址。您可以配置它来检测过多的连接请求，然后暂时封锁来自恶意IP地址的访问。

安装与启动

Debian/Ubuntu安装

apt update -y && apt install -y fail2ban

CentOS安装

yum update -y 

yum install -y epel-release 

yum install -y  fail2ban

yum install -y  nano

启动

systemctl start fail2ban

开机自启

systemctl enable fail2ban

查看状态

systemctl status fail2ban

主配置文件

主配置文件创建本地副本

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

编辑本地副本

nano /etc/fail2ban/jail.local

重启服务

systemctl restart fail2ban

SSH防御 防止暴力破解

rm -rf /etc/fail2ban/jail.d/*

nano /etc/fail2ban/jail.d/sshd.local

插入以下文本

[sshd]

enabled = truemode = normalbackend = systemd

重启服务

systemctl restart fail2ban

查看封锁列表

fail2ban-client status

查看SSH封锁情况

fail2ban-client status sshd

网站防御

采用科技lion的LDNMP建站方案可以使用该防御

删除之前nginx容器

docker rm -f nginx

部署新容器我们把log映射出来

docker run -d --name nginx --restart always --network web_default -p 80:80 -p 443:443 -v /home/web/conf.d:/etc/nginx/conf.d -v /home/web/certs:/etc/nginx/certs -v /home/web/html:/var/www/html -v /home/web/log/nginx:/var/log/nginx nginx

开启目录权限

docker exec -it nginx chmod -R 777 /var/www/html

开启NGINX速率限制

docker exec -it nginx sh -c "sed -i '/http {/a \    limit_req_zone \$binary_remote_addr zone=example_zone:10m rate=1r/s;' /etc/nginx/nginx.conf"

重启nginx

docker restart nginx

创建网站拦截规则

nano /etc/fail2ban/jail.d/nginx.local

插入规则

[nginx-http-auth]

enabled = true

mode = fallback

port = http,https

logpath = /home/web/log/nginx/access.log

[nginx-limit-req]

enabled = true

port    = http,https

logpath = /home/web/log/nginx/access.log

[nginx-botsearch]

enabled = true

port     = http,https

logpath = /home/web/log/nginx/access.log

[nginx-bad-request]

enabled = true

port    = http,https

logpath = /home/web/log/nginx/access.log

[php-url-fopen]

enabled = true

port    = http,https

logpath = /home/web/log/nginx/access.log

[no-referer-nonhomepage1]

enabled = true

filter = no-referer-nonhomepage.py

重启服务

systemctl restart fail2ban

查看nginx封锁情况

fail2ban-client status nginx-http-auth

sudo fail2ban-client status nginx-high-traffic

fail2ban-client status no-referer-nonhomepage

# 手动封禁一个IP测试

sudo fail2ban-client set nginx-high-traffic banip 1.2.3.4

# 手动解封

sudo fail2ban-client set nginx-high-traffic unbanip 52.167.144.191

# 1. 首先查看当前被禁的所有IP

sudo fail2ban-client status nginx-high-traffic

# 2. 解封所有IP（一行命令）

sudo fail2ban-client set nginx-high-traffic unbanip --all

# 或者使用循环解封所有IP

sudo fail2ban-client status nginx-high-traffic | grep "Banned IP list:" | awk '{for(i=5;i<=NF;i++) print $i}' | xargs -I {} sudo fail2ban-client set nginx-high-traffic unbanip {}

sudo fail2ban-client status no-referer-nonhomepage | grep "Banned IP list:" | awk '{for(i=5;i<=NF;i++) print $i}' | xargs -I {} sudo fail2ban-client set no-referer-nonhomepage unbanip {}

# 停止监狱

sudo fail2ban-client stop nginx-high-traffic

# 重启监狱（会清空所有封禁）

sudo fail2ban-client start nginx-high-traffic

# 或者完全重新加载配置

sudo fail2ban-client reload nginx-high-traffic

# 查看当前封禁的IP

sudo iptables -L -n | grep nginx-high-traffic

# 或

sudo fail2ban-client get nginx-high-traffic banip

# 清空监狱对应的iptables链

sudo iptables -D INPUT -j f2b-nginx-high-traffic

sudo iptables -F f2b-nginx-high-traffic

sudo iptables -X f2b-nginx-high-traffic

# 重新添加链

sudo iptables -N f2b-nginx-high-traffic

sudo iptables -A f2b-nginx-high-traffic -j RETURN

sudo iptables -I INPUT -p tcp --dport 80,443 -j f2b-nginx-high-traffic

查看总日志

tail -f /var/log/fail2ban.log

测试

fail2ban-regex /www/wwwlogs/www.08i8.com.log "nginx-high-traffic"

卸载

systemctl disable fail2ban

systemctl stop fail2ban

apt remove -y --purge fail2ban

find / -name "fail2ban" -type d

rm -rf /etc/fail2ban