基于 Fail2ban 的 SSH 入侵自动反制方案

# 安装 rsyslog、fail2ban 和 nftables
apt update
apt install rsyslog fail2ban nftables -y
systemctl enable rsyslog
systemctl enable fail2ban
systemctl enable nftables# 编写 jail.local
tee /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 7200
findtime = 600
maxretry = 5
ignoreip = 127.0.0.1/8 ::1banaction = nftables-multiport
chain = input[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
EOF# 重启 fail2ban
systemctl restart fail2ban# 查看封禁 IP 列表
fail2ban-client status sshd# 手动封禁指定 IP
fail2ban-client set sshd banip 111.183.145.241# 解封指定 IP
fail2ban-client set sshd unbanip 111.183.145.241# 解封所有 IP
fail2ban-client unban --all# 查看 fail2ban 日志
tail -f /var/log/fail2ban.log# 重启 fail2ban
systemctl restart fail2ban# 查看登录失败日志
tail -f /var/log/auth.log | egrep --color=auto "Failed (password|publickey)|invalid user|Connection (closed|refused)|authentication failure|not allowed"

 

OpenWrt 版参考这个：https://www.cnblogs.com/nihaorz/p/19660788