Fail2ban prevent SSH brute force hack

1. Environment CentOS 7

2, online installation

Yum Install-y epel-release

Yum Install-y Fail2ban

Fail2ban structure

/etc/fail2ban # # Fail2ban Service configuration directory
/ETC/FAIL2BAN/ACTION.D # # iptables, mail and other action files directory
/ETC/FAIL2BAN/FILTER.D # # condition matching file directory, filtering log key content
/ETC/FAIL2BAN/JAIL.CONF # # Fail2ban Protection configuration file
/etc/fail2ban/fail2ban.conf # # Fail2ban profile, defining log levels, logs, sock file locations, and more

3, Cp/etc/fail2ban/jail.conf/etc/fail2ban/jail.local

4, Vim/etc/fail2ban/jial.local

#找到 banaction Change "banaction = Iptables-multiport" to "banaction = Firewallcmd-new"

#找到 sshd

[SSHD]
Enabled = True
Port = SSH
LogPath =/var/log/secure
Maxretry = 3//maximum number of attempts
Bantime = 600//## illegal IP shielded time (seconds), 1 means forever blocked

Findtime = 600//Set how long (in seconds) to exceed the maxretry limit number of times is blocked

5. Start Fail2ban

Systemctl Start Fail2ban

6, on the other server to test the intentional error 3 times the password

The fourth time the connection was rejected directly

View status on the Fail2ban server

The blockade succeeds and is automatically unblocked after bantime.

Fail2ban prevent SSH brute force hack