Fail2bani seadistamine Debian 9-s

Fail2ban, nagu nimigi ütleb, on utiliit, mis on loodud Linuxi masinate kaitsmiseks valitud avatud portide, eriti SSH-pordi jõhkrate rünnakute eest. Süsteemi funktsionaalsuse ja haldamise huvides ei saa neid porte tulemüüriga sulgeda. Sellises olukorras on hea mõte kasutada Fail2bani tulemüüri täiendava turvameetmena, et piirata jõhkra jõuga rünnakute liiklust nendes sadamates.

Selles artiklis näitan teile, kuidas installida ja konfigureerida Fail2ban, et kaitsta Vultr Debian 9 serveri eksemplari SSH-porti, mis on kõige levinum rünnaku sihtmärk.

Eeltingimused

• Värske Debian 9 (Stretch) x64 serveri eksemplar.
• Sisse logitud kui root.
• Kõik kasutamata pordid on blokeeritud nõuetekohaste IPTablesi reeglitega.

1. samm: värskendage süsteemi

apt update && apt upgrade -y
shutdown -r now

Pärast süsteemi käivitumist logige uuesti sisse kui root.

Step 2: Modify the SSH port (Optional)

Since the default SSH port number 22 is too popular to ignore, changing it to a lesser-known port number, say 38752 would be a smart decision.

sed -i "s/#Port 22/Port 38752/g" /etc/ssh/sshd_config
systemctl restart sshd.service

After the modification, you need to update IPTables rules accordingly:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -p tcp --dport 38752 -j ACCEPT

Save the updated IPTables rules to a file for persistence purposes:

iptables-save > /etc/iptables.up.rules
touch /etc/network/if-pre-up.d/iptables
chmod +x /etc/network/if-pre-up.d/iptables
echo '#!/bin/sh' >> /etc/network/if-pre-up.d/iptables
echo '/sbin/iptables-restore < /etc/iptables.up.rules' >> /etc/network/if-pre-up.d/iptables

In this fashion, IPTables rules will be persistent even after a system reboot. From now on, you will need to log in from the 38752 port.

Step 3: Install and configure fail2ban to protect SSH

Use apt to install the stable version of Fail2ban which is currently 0.9.x:

apt install fail2ban -y

After the installation, the Fail2ban service will start automatically. You can use the following command to show its status:

service fail2ban status

On Debian, the default Fail2ban filter settings will be stored in both the /etc/fail2ban/jail.conf file and the /etc/fail2ban/jail.d/defaults-debian.conf file. Remember that settings in the latter file will override corresponding settings in the former one.

Use the following commands to view more details:

cat /etc/fail2ban/jail.conf | less
cat /etc/fail2ban/jail.d/defaults-debian.conf
fail2ban-client status
fail2ban-client status sshd

For your information, code excerpts about SSH are listed below:

In /etc/fail2ban/jail.conf:

[DEFAULT]

bantime = 600
...
maxentry = 5

[sshd]

port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

In /etc/fail2ban/jail.d/defaults-debian.conf:

[sshd]
enabled = true

Since the contents in the two config files above might change in future system updates, you should create a local config file to store your own fail2ban filter rules. Again, the settings in this file will override corresponding settings in the two files mentioned above.

vi /etc/fail2ban/jail.d/jail-debian.local

Input the following lines:

[sshd]
port = 38752
maxentry = 3

Note: Be sure to use your own SSH port. Except for port and maxentry mentioned above, all other settings will use the default values.

Save and quit:

:wq

Uue konfiguratsiooni laadimiseks taaskäivitage teenus Fail2ban:

service fail2ban restart

Meie seadistus on lõpetatud. Nüüdsest, kui mõni masin saadab Debiani serveri kohandatud SSH-porti ( 38752) rohkem kui kolm korda valed SSH-mandaadid, blokeeritakse selle potentsiaalselt pahatahtliku masina IP 600 sekundiks.