๐ก Linux：Fail2Ban ้ฒ้่ช่จ่ฆๅ、Filter ่งฃๆ่ๅคๆๅ้ฒ็ฆฆ็ญ็ฅ
Fail2Ban ๆฏ Linux ็ณป็ตฑๆ้่ฆ็ไธปๅๅผ้ฒ่ญทๅทฅๅ ทไนไธ，้้ๅๆๆฅ่ชไธฆ่ชๅๅฐ้ๆกๆ IP，ๆๆ้ไฝๆดๅ็ ด่งฃ่ๆกๆๅญๅ็้ขจ้ช。ๆฌ็ฏๅพๅบๆฌๅ็、filter ่ช่จ、jail ็ตๅ、้ฒ็ซ็ๆดๅๅฐๅคๆๅไฟ่ญท็ญ็ฅๅฎๆด่งฃๆ。
๐ ไธ、Fail2Ban ้ไฝๅ็
Fail2Ban ็ๆ ธๅฟๆต็จๅฏๅ็บ 3 ๅ้จๅ：
- Filter：ๅพๆฅ่ชไธญๆพๅบๆกๆ่ก็บ（ๅฆๅฏ็ขผ้ฏ่ชค、้ๆณ็ปๅ ฅ）
- Jail：ๅฎ็พฉๅฐ้ๆขไปถ，ไพๅฆ「5 ๅ้ๅ งๅคฑๆ 5 ๆฌก」
- Action：่งธ็ผๅฐ้（ๅฆ่ชฟ็จ iptables、nftables、firewalld）
ๅช่ฆ Filter ๅตๆธฌๅฐไธๅๆณ็ๅ่ฉฆ，ๅฐฑๆ่งธ็ผ jail，ไธฆๆไพๆบ IP ๅฐ้ๆๅฎๆ้。
---๐ ไบ、ๅฎ่ฃ Fail2Ban
๐ฆ Debian / Ubuntu
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
๐ฅ CentOS / Rocky / AlmaLinux
sudo yum install -y epel-release
sudo yum install -y fail2ban fail2ban-systemd
sudo systemctl enable --now fail2ban
sudo systemctl status fail2ban
fail2ban-client status
๐ ไธ、Fail2Ban ๅบๆฌ่จญๅฎ：jail.local
ไธป่ฆ่จญๅฎๆช่ซๅฟ็ดๆฅไฟฎๆน /etc/fail2ban/jail.conf，ๆๅปบ็ซ override：
sudo nano /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
backend = systemd
ignoreip = 127.0.0.1/8 10.0.0.0/24
[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log
๐ ๅ、Filter ๆทฑๅ ฅ่งฃๆ（filter.d）
Filter ๆฏ Fail2Ban ็ๆ ธๅฟ，็จ regex ๅพๆฅ่ชๆพๅบๆกๆ่ก็บ。
Filter ไฝ็ฝฎ：
/etc/fail2ban/filter.d/
๐ ็ฏไพ：่ช่จ SSH ๆดๅ็ ด่งฃ filter（ๆดๅ ็）
sudo nano /etc/fail2ban/filter.d/ssh-bruteforce.conf
[Definition]
failregex = ^.*Failed password for .* from <HOST> port .* ssh2
^.*Invalid user .* from <HOST> port .* ssh2
ignoreregex =
๐ regex ไธญ็ <HOST> ็ฑ Fail2Ban ่ชๅๆฟๆๆ IP ๅน้
ๅๅ。
ๆธฌ่ฉฆ filter：
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/ssh-bruteforce.conf
๐ ไบ、Jail ้ฒ้่จญๅฎ（maxretry、banaction、port）
็บ่ช่จ filter ๅปบ็ซ jail：
sudo nano /etc/fail2ban/jail.d/ssh-bruteforce.local
[ssh-bruteforce]
enabled = true
filter = ssh-bruteforce
action = iptables-multiport
port = ssh
logpath = /var/log/auth.log
maxretry = 4
findtime = 5m
bantime = 12h
๐ ๅ ญ、ๅคๆๅๆดๅ：nginx / postfix / dovecot / proftpd
Fail2Ban ๆฏๆดๅคๆธๅธธ่ฆๆๅ，ๅช่ฆๅ็จๅฐๆ jail ๅณๅฏ。
๐ฉ nginx ไฟ่ญท（ๆๅธธ่ขซๆดๅๆๆ）
[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /var/log/nginx/error.log
๐ง postfix（้ตไปถๆด็ ด）
[postfix]
enabled = true
port = smtp,ssmtp
logpath = /var/log/maillog
๐ฆ dovecot（IMAP/POP ๅ่ฉฆ）
[dovecot]
enabled = true
logpath = /var/log/maillog
๐ฅ ProFTPD / vsftpd
[proftpd]
enabled = true
logpath = /var/log/proftpd/proftpd.log
๐ ไธ、้ฒ็ซ็ๆดๅ：iptables、nftables、firewalld
Fail2Ban ๆ่ชๅๅผๅซ็ณป็ตฑ็ firewall action，ไฝ ไน่ฝๆๅๆๅฎ。
| ้ฒ็ซ็ | Fail2Ban Action |
|---|---|
| iptables | iptables-multiport |
| nftables | nftables-multiport |
| firewalld | firewallcmd-multiport |
๐ช ๅผทๅถๆๅฎ nftables
[sshd]
enabled = true
banaction = nftables-multiport
๐ ๅ ซ、Fail2Ban ๅฏฆ็จๆไปคๅคงๅ จ
ๆฅ็ๆๆ jail
sudo fail2ban-client status
ๆฅ็ๆ jail
sudo fail2ban-client status sshd
ๅฐ้ / ่งฃ้ IP
sudo fail2ban-client set sshd banip 1.2.3.4
sudo fail2ban-client set sshd unbanip 1.2.3.4
้ๆฐ่ผๅ ฅ่จญๅฎ
sudo systemctl reload fail2ban
๐ ไน、ๆไฝณๅๅปบ่ญฐ（ๆญฃๅผ็ฐๅขๅฟ ๅ）
- ๆญ้ GeoIP ้ๆฟพ，ๅฐ้้ๅฐ็ฃ／้ๅฟ ่ฆๅๅฎถ
- SSH ๆน้้ ่จญ 22 port
- ๅ็จ fail2ban persistent log（ไฟ็ๅฐ้็ด้）
- ่ Fail2Ban Cloud API ๆดๅ้ปๅๅฎ（้ธ็จ）
- ๅฎๆๆชขๆฅ่ชคๅค IP，ๅ ๅ ฅ ignoreip ็ฝๅๅฎ
๐ ๅปถไผธ้ฑ่ฎ
- ๐ Linux ไฝฟ็จ่ ่ ACL ้ซ้ๆฌ้็ฎก็
- ๐ก Linux ้ฒ็ซ็ๅฎๆดๆๅ：iptables / nftables / firewalld
- ๐ก SELinux / AppArmor / Auditd / Fail2Ban ๅฎๅ จๆดๅ
- ๐งฑ Linux ไผบๆๅจๅพๅฎ่ฃๅฐๅผทๅๅฎๆดๆๅญธ
— WWFandy・Linux Security ็ญ่จ
ๆฒๆ็่จ:
ๅผต่ฒผ็่จ