1 前言

一个问题，一篇文章，一出故事。
笔者经常遇到需要使用fail2ban的环境，于是整理fail2ban最基础环境的配置方法。
其他应用基于此基础可以得到进一步配置。

2 最佳实践

2.1 实践环境

2.1.1 安装软件包

dnf install -y fail2ban iptables-services

2.1.2 禁用默认的firewalld服务

systemctl stop firewalld
systemctl disable firewalld

2.1.3 配置iptables服务

systemctl enable --now iptables
vim /etc/sysconfig/iptables

加入如下行，

#...
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
#...

重启服务使配置生效，

systemctl restart iptables

2.2 配置Fail2Ban

2.2.1 启动服务并设置服务自启动

systemctl start fail2ban
systemctl enable fail2ban

2.2.2 定义默认配置

vim /etc/fail2ban/jail.d/jail.local

加入如下配置，

[DEFAULT]
ignoreself = true
ignoreip = 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
bantime = 1h
findtime  = 1m
maxretry = 5
banaction = iptables-allports
banaction_allports = iptables-allports
chain = INPUT

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s

[sshd-ddos]
port    = ssh
logpath = %(sshd_log)s

配置修改后，你需要重启服务使配置生效，

systemctl restart fail2ban.service
systemctl status fail2ban.service

2.2.5 查看服务状态

fail2ban-client status sshd

可见如下显示，

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd + _COMM=sshd-session
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

2.2.6 查看防火墙状态

iptables -L -v -n

可见如下显示，

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 9401   20M f2b-wordpress  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           
11233   23M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
  200 12000 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
   28  1664 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    2    92 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
   87  4940 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 13150 packets, 5592K bytes)
 pkts bytes target     prot opt in     out     source               destination         

参阅文档
====================
https://github.com/fail2ban/fail2ban/wiki/Developing-Regex-in-Fail2ban
https://wangdoc.com/ssh/fail2ban