![[PukiWiki]](image/owl.png "[PukiWiki]")
[sshd] enabled = true bantime = 1h findtime = 10m maxretry = 5
[recidive] enabled = true bantime = 1w findtime = 1d maxretry = 5
# banされてるIPを表示 sudo fail2ban-client status sshd # sshd jail からunban sudo fail2ban-client set sshd unbanip <IP> # recidive jail からunban sudo fail2ban-client set recidive unbanip <IP>
記事:
記事:
仕様:
sudo firewall-cmd --set-log-denied=all sudo tail /var/log/messages ... Nov 1 08:00:00 host1 kernel: filter_IN_public_REJECT: IN=eth0 OUT= MAC=xx:xx:xx... SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx ...
sudo firewall-cmd --set-log-denied=off
# help fail2ban-client # jail ruleを確認: sshdがある sudo fail2ban-client status Status |- Number of jail: 1 `- Jail list: sshd # sshd ruleの詳細 sudo fail2ban-client status sshd # IPを解除 sudo fail2ban-client set <jail rule> unbanip <IP addr1> <IP addr2> ...
# 全jailの状態一覧 sudo fail2ban-client status # 特定jail（sshd）の詳細（ban数・ban済みIP） sudo fail2ban-client status sshd # 全設定をdump（jail.conf + jail.local + jail.d/*.local の合成結果） sudo fail2ban-client -d
sudo tail -f /var/log/fail2ban.log
sudo firewall-cmd --list-all --zone=public ... rich rules: rule family="ipv4" source address="xxx.xxx.xxx.xxx" port port="ssh" protocol="tcp" reject type="icmp-port-unreachable"
sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination f2b-sshd tcp -- anywhere anywhere multiport dports ssh
