Skip to content

Commit 56f912b

Browse files
CodeGlimpseCodeGlimpse
committed
docs: 新增关于 Fail2ban 的中英文教程文档
新增两篇教程文档，分别以中文和英文介绍如何在 Linux 服务器上使用 Fail2ban 防御暴力破解攻击。内容涵盖安装、配置、常用命令及常见问题解答。
1 parent d3b29b9 commit 56f912b

2 files changed

Lines changed: 334 additions & 0 deletions

File tree

‎content/en/post/linux-fail2ban/index.md‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
---
2+
title: "Protect Your Linux Server with Fail2ban"
3+
date: 2026-04-01 15:00:00+08:00
4+
description: "Fail2ban is a powerful tool to protect your server from brute-force attacks. This tutorial guides you through installing and configuring Fail2ban."
5+
categories:
6+
- Tutorials
7+
tags:
8+
- Linux
9+
---
10+
11+
## What is Fail2ban?
12+
13+
Fail2ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It works by scanning log files (e.g., `/var/log/auth.log`) and banning IP addresses that show malicious signs, such as too many password failures, seeking for exploits, etc.
14+
15+
## Installing Fail2ban
16+
17+
Choose the installation method according to your Linux distribution.
18+
19+
### 1. Using Package Manager
20+
21+
#### Debian / Ubuntu
22+
```bash
23+
sudo apt update
24+
sudo apt install fail2ban
25+
```
26+
27+
#### CentOS / RHEL (Using yum or dnf)
28+
On CentOS/RHEL, you typically need to install the EPEL repository first:
29+
```bash
30+
# CentOS 7
31+
sudo yum install epel-release
32+
sudo yum install fail2ban
33+
34+
# CentOS 8 / RHEL 8 / Fedora (Using dnf)
35+
sudo dnf install epel-release
36+
sudo dnf install fail2ban
37+
```
38+
39+
### 2. From Source (tar.gz)
40+
If you need a specific version or your distribution doesn't provide a package, you can install from source:
41+
42+
```bash
43+
# Download source (replace with the latest version link)
44+
wget https://github.com/fail2ban/fail2ban/archive/refs/tags/1.0.2.tar.gz
45+
tar -xvzf 1.0.2.tar.gz
46+
cd fail2ban-1.0.2
47+
48+
# Install
49+
sudo python3 setup.py install
50+
```
51+
*Note: Source installation typically requires manual configuration of systemd service files and log paths.*
52+
53+
After installation, it is recommended to set Fail2ban to start on boot:
54+
```bash
55+
sudo systemctl enable fail2ban
56+
sudo systemctl start fail2ban
57+
```
58+
59+
## Configuring Fail2ban
60+
61+
The default configuration file for Fail2ban is `/etc/fail2ban/jail.conf`. However, it's not recommended to modify this file directly, as it may be overwritten during package upgrades. Instead, you should create a local configuration file, `/etc/fail2ban/jail.local`, or new `.conf` files in the `/etc/fail2ban/jail.d/` directory to override the defaults.
62+
63+
### Create a Local Configuration File
64+
65+
First, copy `jail.conf` to `jail.local`:
66+
67+
```bash
68+
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
69+
```
70+
71+
Now you can safely edit the `jail.local` file.
72+
73+
### Configure SSH Protection
74+
75+
Open the `/etc/fail2ban/jail.local` file and find the `[sshd]` section. You can customize the following parameters as needed:
76+
77+
```ini
78+
[sshd]
79+
enabled = true
80+
port = ssh
81+
logpath = %(sshd_log)s
82+
backend = %(sshd_backend)s
83+
maxretry = 5
84+
findtime = 10m
85+
bantime = 1d
86+
```
87+
88+
- `enabled`: `true` enables this jail.
89+
- `port`: The port for the SSH service.
90+
- `logpath`: The path to the SSH authentication log file.
91+
- `maxretry`: The number of failures before a ban is imposed.
92+
- `findtime`: The time window during which the failures must occur.
93+
- `bantime`: The duration for which the IP address is banned. `1d` means one day.
94+
95+
### More Practical Scenarios
96+
97+
In addition to SSH, Fail2ban can protect many other services. Add the following to `jail.local`:
98+
99+
#### Nginx Prevention of Malicious Scans (Too many 404 errors)
100+
```ini
101+
[nginx-404]
102+
enabled = true
103+
port = http,https
104+
filter = nginx-404
105+
logpath = /var/log/nginx/access.log
106+
findtime = 600
107+
maxretry = 5
108+
bantime = 1h
109+
```
110+
*Note: This requires you to define an `nginx-404.conf` filter under `/etc/fail2ban/filter.d/`.*
111+
112+
#### MySQL/MariaDB Protection
113+
```ini
114+
[mariadb-jail]
115+
enabled = true
116+
port = 3306
117+
filter = mysqld-auth
118+
logpath = /var/log/mysql/error.log
119+
maxretry = 3
120+
```
121+
122+
## Common Fail2ban Management Commands
123+
124+
`fail2ban-client` is the primary tool for managing Fail2ban.
125+
126+
### 1. Check Status
127+
```bash
128+
# Check overall service running status
129+
sudo fail2ban-client ping
130+
131+
# Check the list of enabled jails
132+
sudo fail2ban-client status
133+
134+
# Check detailed status of a specific jail (e.g., sshd)
135+
sudo fail2ban-client status sshd
136+
```
137+
138+
### 2. Manage Banned IPs
139+
```bash
140+
# Manually ban an IP (in the sshd jail)
141+
sudo fail2ban-client set sshd banip 1.2.3.4
142+
143+
# Manually unban an IP
144+
sudo fail2ban-client set sshd unbanip 1.2.3.4
145+
146+
# Unban an IP from all jails
147+
sudo fail2ban-client unban 1.2.3.4
148+
```
149+
150+
### 3. Reload Configuration
151+
When you modify `.local` files or filters, you can apply changes without restarting the entire service:
152+
```bash
153+
sudo fail2ban-client reload
154+
```
155+
156+
## FAQ & Tips
157+
- **Whitelist**: Set `ignoreip = 127.0.0.1/8 ::1 <Your Fixed IP>` in the `[DEFAULT]` section to prevent locking yourself out.
158+
- **Persistence**: By default, bans expire after a service restart. For persistence, you can configure database storage.
159+
- **Email Notifications**: Fail2ban supports sending email alerts to administrators when an IP is banned.
160+
161+
## Summary
162+
163+
Fail2ban is a simple yet effective tool that adds a significant layer of security to your server. With proper configuration, you can greatly reduce the risk of brute-force attacks.

‎content/zh-cn/post/linux-fail2ban/index.md‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
title: "保护 Linux 服务器的一大利器：Fail2ban"
3+
date: 2026-04-01 15:00:00+08:00
4+
description: "Fail2ban 是一款强大的工具，可以保护你的服务器免受暴力破解攻击。本教程将指导你如何安装和配置 Fail2ban。"
5+
categories:
6+
- Tutorials
7+
tags:
8+
- Linux
9+
---
10+
11+
## 什么是 Fail2ban？
12+
13+
Fail2ban 是一个入侵防御软件框架，可以保护计算机服务器免受暴力破解攻击。它通过扫描日志文件（例如 `/var/log/auth.log`）并禁止显示恶意迹象的 IP 地址——如密码失败次数过多，寻找漏洞等。
14+
15+
## 安装 Fail2ban
16+
17+
根据你使用的 Linux 发行版，选择相应的安装方式。
18+
19+
### 1. 使用包管理器安装
20+
21+
#### Debian / Ubuntu
22+
```bash
23+
sudo apt update
24+
sudo apt install fail2ban
25+
```
26+
27+
#### CentOS / RHEL (使用 yum 或 dnf)
28+
在 CentOS/RHEL 上，你通常需要先安装 EPEL 仓库：
29+
```bash
30+
# CentOS 7
31+
sudo yum install epel-release
32+
sudo yum install fail2ban
33+
34+
# CentOS 8 / RHEL 8 / Fedora (使用 dnf)
35+
sudo dnf install epel-release
36+
sudo dnf install fail2ban
37+
```
38+
39+
### 2. 通过源码安装 (tar.gz)
40+
如果你需要安装特定版本或者你的发行版没有提供包，可以从源码安装：
41+
42+
```bash
43+
# 下载源码（请替换为最新版本链接）
44+
wget https://github.com/fail2ban/fail2ban/archive/refs/tags/1.0.2.tar.gz
45+
tar -xvzf 1.0.2.tar.gz
46+
cd fail2ban-1.0.2
47+
48+
# 安装
49+
sudo python3 setup.py install
50+
```
51+
*注意：源码安装通常需要手动配置 systemd 服务文件和日志路径。*
52+
53+
安装后，建议将 Fail2ban 设置为开机自启：
54+
```bash
55+
sudo systemctl enable fail2ban
56+
sudo systemctl start fail2ban
57+
```
58+
59+
## 配置 Fail2ban
60+
61+
Fail2ban 的默认配置文件是 `/etc/fail2ban/jail.conf`。但是，不建议直接修改此文件，因为软件包更新时可能会覆盖它。相反，你应该创建一个本地配置文件 `/etc/fail2ban/jail.local` 或在 `/etc/fail2ban/jail.d/` 目录下创建新的 `.conf` 文件来覆盖默认设置。
62+
63+
### 创建本地配置文件
64+
65+
首先，将 `jail.conf` 复制到 `jail.local`：
66+
67+
```bash
68+
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
69+
```
70+
71+
现在，你可以安全地编辑 `jail.local` 文件。
72+
73+
### 配置 SSH 防护
74+
75+
打开 `/etc/fail2ban/jail.local` 文件，找到 `[sshd]` 部分。你可以根据需要自定义以下参数：
76+
77+
```ini
78+
[sshd]
79+
enabled = true
80+
port = ssh
81+
logpath = %(sshd_log)s
82+
backend = %(sshd_backend)s
83+
maxretry = 5
84+
findtime = 10m
85+
bantime = 1d
86+
```
87+
88+
- `enabled`: `true` 表示启用此监狱（jail）。
89+
- `port`: SSH 服务的端口。
90+
- `logpath`: SSH 认证日志文件的路径。
91+
- `maxretry`: 在 `findtime` 时间内允许的最大失败尝试次数。
92+
- `findtime`: 监控失败尝试的时间窗口。
93+
- `bantime`: 禁止 IP 地址的时间长度。`1d` 表示一天。
94+
95+
### 重启 Fail2ban
96+
97+
修改配置后，你需要重启 Fail2ban 服务以使更改生效：
98+
99+
```bash
100+
sudo systemctl restart fail2ban
101+
```
102+
103+
### 更多实用场景配置
104+
105+
除了 SSH，Fail2ban 还可以保护许多其他服务。在 `jail.local` 中添加以下内容：
106+
107+
#### Nginx 防止恶意扫描 (404 错误过多)
108+
```ini
109+
[nginx-404]
110+
enabled = true
111+
port = http,https
112+
filter = nginx-404
113+
logpath = /var/log/nginx/access.log
114+
findtime = 600
115+
maxretry = 5
116+
bantime = 1h
117+
```
118+
*注意：这需要你在 `/etc/fail2ban/filter.d/` 下定义 `nginx-404.conf` 过滤器。*
119+
120+
#### MySQL/MariaDB 防护
121+
```ini
122+
[mariadb-jail]
123+
enabled = true
124+
port = 3306
125+
filter = mysqld-auth
126+
logpath = /var/log/mysql/error.log
127+
maxretry = 3
128+
```
129+
130+
## Fail2ban 常用管理命令
131+
132+
`fail2ban-client` 是管理 Fail2ban 的主要工具。
133+
134+
### 1. 查看状态
135+
```bash
136+
# 查看服务整体运行状态
137+
sudo fail2ban-client ping
138+
139+
# 查看已启用的监狱列表
140+
sudo fail2ban-client status
141+
142+
# 查看特定监狱的详细状态（如 sshd）
143+
sudo fail2ban-client status sshd
144+
```
145+
146+
### 2. 管理被禁 IP
147+
```bash
148+
# 手动禁止一个 IP (在 sshd 监狱中)
149+
sudo fail2ban-client set sshd banip 1.2.3.4
150+
151+
# 手动解禁一个 IP
152+
sudo fail2ban-client set sshd unbanip 1.2.3.4
153+
154+
# 解禁所有监狱中的某个 IP
155+
sudo fail2ban-client unban 1.2.3.4
156+
```
157+
158+
### 3. 重新加载配置
159+
当你修改了 `.local` 文件或过滤器后，无需重启整个服务即可生效：
160+
```bash
161+
sudo fail2ban-client reload
162+
```
163+
164+
## 常见问题与小贴士
165+
- **白名单**：在 `[DEFAULT]` 部分设置 `ignoreip = 127.0.0.1/8 ::1 <你的固定IP>`，防止把自己关在外面。
166+
- **持久化**：默认情况下，重启服务后之前的禁令会失效。如果需要持久化，可以配置数据库存储。
167+
- **邮件通知**：Fail2ban 支持在封禁 IP 时向管理员发送邮件提醒。
168+
169+
## 总结
170+
171+
Fail2ban 是一个简单而有效的工具，可以为你的服务器增加一层重要的安全保护。通过正确配置，你可以大大减少受到暴力破解攻击的风险。

0 commit comments

Comments
 (0)