Linux SECURITY: Use fail2ban to prevent scanning attacks

Cast_blog

We always think that Linux is safer and the probability of being attacked is lower. If the machine attempts to crack your password on the Internet, even though we have made relevant security settings, however, the password is still tested every day, and it is always uncomfortable to find a tool to check whether there is anything wrong with the password to automatically disable the IP address. This is not the case. I found a small tool named fail2ban. I used the log analysis to automatically ban the hacker's IP address.

In: http://fail2ban.sourceforge.net/rpms/
Find the latest version of the rpm package to install it. After installation, you can change the configuration as needed.

Vi/etc/fail2ban. conf
# Start fail2ban in daemon mode
Background = true
# Allowed attempts
Maxfailures = 3
# The lock time (in seconds) after maxfailures is triggered. If it is set to-1, the lock will be permanently blocked.
Banktime = 3600
# Use the error records in the findtime (second) time as the reference for maxfailures count
Findtime= 600
# Exclude IP ranges and separate them with blank spaces
Ignoreip = 127.0.0.1 192.168.0.0/24
# Disable mail Notification
[MAIL]
Enabled = false
# Modified from VSFTPD. The original settings are maintained for unmentioned parts.
[PROFTPD]
Enabled = true
Logfile =/var/log/proftpd. log
Failregex = no such user | Incorrect password
# Retain the original settings For unmentioned parts
[SSH]
Enabled = true
Logfile =/var/log/secure
Service fail2ban start
After the service is started, you can see that the attacked bot is banned in/var/log/fail2ban. log every day.
09:13:33, 532 WARNING: SSH: Ban (3600 s) 205.189.197.66
12:24:41, 943 WARNING: SSH: Ban (3600 s) 121.52.209.5