Indlela yokusetha i-Fail2ban ukuze uvikele iseva yakho ye-Linux

Isibuyekezo sokugcina: 3 September ka-2026
Author: I-TecnoDigital

Uchwepheshe we-IT osebenza ne-laptop esikhungweni sedatha sesimanje, ofanele ukwethula ukuphepha kweseva.

Ukuba neseva ye-Linux evezwe kunethiwekhi kufana nokubeka i-magnet yama-bots. Uma ungakahleli noma yiziphi izinyathelo zokuphepha, cishe usuvele unezinkulungwane zemizamo yokungena ngemvume ehlulekile ku-log yakho; kunemishini ezenzakalelayo ehlala izama ukuhlanganiswa kwegama lomsebenzisi nephasiwedi ukuzama ukulawula umshini wakho. brute force attack.

Yilapho i-Fail2ban ingena khona, ithuluzi elisebenza njengomqaphi ongakhathali. Akuyona i-firewall ngomqondo oqinile, kodwa kunalokho ihlaziya amalogi esistimu Futhi uma ibona umuntu ozama ukungena ngenkani, ivala umnyango ebusweni bakhe ngokuvala ikheli lakhe le-IP isebenzisa amathuluzi anjenge-iptables noma i-nftables. Ake sibone ukuthi singayilungisa kanjani ukuze iseva yakho ibe yinto enzima kakhulu ukuyiqhekeza.

Iyini ngempela i-Fail2ban futhi isebenza kanjani?

Kalula nje, i-Fail2ban iyi-daemon eqapha amafayela elogi ezinsizakalo zakho njalo. Uma ithola amaphethini asolisayo ahambisana nemithetho echazwe ngaphambilini, yenza izingcingo. ehlungaIqala ukubala ukwehluleka. Uma ikheli le-IP lifinyelela umkhawulo wemizamo evunyelwe phakathi nesikhathi esithile, uhlelo lusebenzisa isenzookuvame ukuhilela ukwengeza lelo kheli le-IP ohlwini olumnyama lwe-firewall.

Lezi zilungiselelo zihlelwe ngendlela ebizwa ngokuthi amajele noma amajeleIjele ngokuyisisekelo lisethi yemithetho esetshenziswa kusevisi ethile (njenge-SSH, i-Apache, noma i-MySQL). Ngale ndlela, ungaba nenqubomgomo eqinile kakhulu yokufinyelela kude kanye nenqubomgomo evumela kakhulu iseva yewebhu, ukuqinisekisa ukuthi abangeneleli bavinjelwe ngokuzenzakalelayo ngaphandle kokuthi uhlole amalogi ngesandla njalo ngemizuzu emihlanu.

  Izinsiza Zewebhu Ezingcono Kakhulu ze-Linux: Umhlahlandlela Ophelele

Uphawu lokuhlasela kwe-cyber nomuntu ophethe imaski ye-hacker eduze kwama-racks eseva ye-Linux.

Ukufakwa ngokuya ngokusatshalaliswa kwe-Linux yakho

Kuye ngokuthi usebenzisa luphi uhlelo, umyalo wokuyifaka uyahluka kancane, kodwa ngokuvamile itholakala cishe kuzo zonke izindawo zokugcina ezisemthethweni.

  • Ku-Ubuntu naku-Debian: Kulula kakhulu, kufanele ugijime nje sudo apt update seguido de sudo apt install fail2ban.
  • Ku-Rocky Linux noma ku-AlmaLinux: Njengoba lokhu kungukusatshalaliswa kwebhizinisi, kufanele uqale unike amandla indawo yokugcina ye-EPEL nge sudo dnf install epel-release bese ufaka iphakheji nge sudo dnf install fail2ban fail2ban-firewalld.
  • Ku-Alpine Linux: Sebenzisa umphathi we-APK nge sudo apk add fail2ban Futhi, njengoba isebenzisa i-OpenRC, kufanele uyivule nge sudo rc-update add fail2ban default bese uqala ngakho sudo rc-service fail2ban start.

Imininingwane yobungcweti yama-server racks esikhungweni sedatha esinokukhanya okuluhlaza okwesibhakabhaka, okumelela ingqalasizinda yeseva.

Ukucushwa okuyinhloko: Imfihlo yefayela le-.local

Iphutha elivame kakhulu ukuhlela ifayela ngqo. jail.confUngakwenzi! Lelo fayela lingabhalwa kabusha uma ubuyekeza uhlelo. Umthetho wegolide ukudala ikhophi ebizwa ngokuthi ijele.lendawoNoma yimaphi amapharamitha owafaka kuleli fayela lesibili azothatha indawo yokuqala, futhi izinguquko zakho zizobhalwa phansi. kuphephile ezibuyekezweni.

Ukuze uqale, ungakopisha ifayela lokuqala nge sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local bese uyivula ngomhleli wakho owuthandayo, njenge-nano noma i-vim. Esigabeni [IMIPHUMELA] Yilapho uchaza khona ukuziphatha okuphelele kohlelo:

  • isikhathi sokuphumula: El tiempo que la IP maliciosa se quedará en el congelador. Puede ser en segundos o usando ‘m’ para minutos (ej. 10m).
  • isikhathi sokuthola: Isikhathi lapho i-Fail2ban ihlola khona amaphutha. Uma othile ehluleka izikhathi ezi-5 ngehora kodwa isikhathi sokuthola singamaminithi ayi-10, ngeke avinjelwe.
  • zama kakhulu: Inani lemizamo ehlulekile evunyelwe ngaphambi kokuba uhlelo lusho Kwanele futhi uvimbele i-IP.
  • ukunganaki: Kubalulekile ukugwema ukuzivimba. Lapha kufanele ufake eyakho ikheli le-IP lomphakathi noma ububanzi bakho be-VPN.
  Iziqinisekiso kanye nezitifiketi: umhlahlandlela ophelele wokuthuthukisa iphrofayela yakho

Ukusondela kwezintambo zenethiwekhi ye-fiber optic ezixhunywe kuseva yebhizinisi, okubonisa ukuxhumana kwenethiwekhi kanye nokuphepha.

Ukuvikela izinsizakalo ezithile isinyathelo ngesinyathelo

Uma izilungiselelo ezijwayelekile sezilungisiwe, sekuyisikhathi sokuvula amajele ezinsizakalo ezikukhathaza kakhulu. Ukuze isivikelo sisebenze, kufanele usethe enabled = true esigabeni sayo ngaphakathi jail.local.

Ukufinyelela kwe-SSH (Iphuzu elibaluleke kakhulu)

I-Port 22 iyithagethi yokuqala. Ukucushwa okuqinile kungachaza maxretry = 3 futhi a bantime = 3600 (ihora elilodwa). I-Fail2ban izolifunda ifayela. /var/log/auth.log (ku-Debian/Ubuntu) noma / var / log / ephephile (ku-CentOS/RHEL) ukuthola ukwehluleka kokuqinisekisa kanye nokufinyelela okuseduze kumhlaseli.

Amaseva ewebhu (i-Apache ne-Nginx)

Uma unewebhusayithi noma isitolo esiku-inthanethi, ama-bot azozama ukufinyelela imizila ebucayi efana /wp-admin o /login.phpUngakha izihlungi ezenziwe ngokwezifiso ku /etc/fail2ban/filter.d/ ukuthola la maphethini. Isibonelo, ukuthola la maphethini. Vikela i-WordPressAmaphutha angu-403 noma imizamo ehlulekile iyaqashwa ku wp-login.php, ivimba i-IP uma idlula imikhawulo ebekiwe ejele le-Apache noma le-Nginx.

Ama-database kanye ne-FTP

Ku-MySQL, ungaqapha ilogi yamaphutha yebinzana Ukufinyelela kunqatshelwe umsebenzisiEndabeni ye-FTP (njenge-ProFTPD), kubalulekile ukuqinisekisa ukuthi logpath qondanisa indlela yangempela namalogi akho, ngoba uma i-Fail2ban ingakwazi ukuthola ifayela lelogi, ukuvikelwa ngeke kusebenze.

Ukuphathwa okuthuthukisiwe nge-fail2ban-client

Akudingeki njalo ukuthi uhlele amafayela bese uqala kabusha isevisi ukuze wenze izinguquko ezisheshayo. Umyalo fail2ban-client Ikuvumela ukuthi uphathe uhlelo ngokushesha kusuka ku-console.

Ukuze ubone ukuthi yimaphi amajele asebenzayo nokuthi mangaki ama-IP avinjelwe, sebenzisa sudo fail2ban-client statusUma ufuna ukungena ngokujulile kusevisi, njenge-SSH, sebenzisa sudo fail2ban-client status sshdNgaphezu kwalokho, uma ngephutha Uvimbe umuntu osebenza naye Noma ungakhulula ikheli le-IP ngokushesha ngokwakho ngomyalo sudo fail2ban-client set sshd unbanip IP_A_DESBLOQUEAR.

Ukulungisa nokuxazulula izinkinga

Uma ubona ukuthi i-Fail2ban ayivimbi njengoba kufanele, indawo yokuqala okufanele uyibheke ifayela lelogi lethuluzi. /var/log/fail2ban.log. Isebenzisa tail -f Ungabona ngesikhathi sangempela ukuthi ubani ovinjelwayo nokuthi kungani.

  Ideskithophu yesilawuli kude ye-Chrome: Ukuphela Kwamakhompuyutha Omuntu Siqu?

Khumbula ukuthi i-Fail2ban igcina isimo sokukhiya kusizindalwazi se-SQLite ku /var/lib/fail2ban/fail2ban.sqlite3Ngakho-ke, uma uqala kabusha iseva, ama-IP ayevinjelwe ngeke avinjelwe. kuzohlala kuvinjelwe kuze kube yilapho isikhathi sakho sesijeziso siphela. Noma nini lapho wenza izinguquko kumafayela okucushwa, ungakhohlwa ukusebenzisa izinguquko nge sudo systemctl restart fail2ban.

Ukusebenzisa leli thuluzi kuguqula iseva yakho isuke ekubeni yinto elula ukuyiqondisa ibe yindawo ezenzakalelayo, kunciphisa umthwalo we-CPU ngokulahla ithrafikhi enonya kungqimba lwenethiwekhi futhi kukuvumele ulale kahle wazi ukuthi ama-bot ngeke akwazi ukungena ngenkani. Ngokuhlanganisa ukusetshenziswa kwamafayela e-.local, ukuphathwa kwamajele athile, kanye nokuqapha njalo amalogi, ufinyelela ukuzivikela ekujuleni kubalulekile kunoma yimuphi umphathi wesistimu ye-Linux.