Ansible实践 - 运维

#SSH防暴力破解
##一、批量fail2ban
	
	#安装fail2ban
	ansible Test -m yum -a "name=fail2ban state=latest"

##二、添加ssh的屏蔽策略
	
	#配置(/root/F2B_SSH/jail.conf)
	
	[ssh-iptables]
	enabled  = true
	filter   = sshd        
	action   = iptables[name=SSH, port=22, protocol=tcp]
	logpath  = /var/log/secure
	maxretry = 3
	findtime  = 300
	bantime = 24h

---
	#执行替换命令
	ansible Test -m template -a "src=/root/F2B_SSH/jail.conf dest=/etc/fail2ban/jail.conf"
	
##三、启动服务并设置开机启动
	ansible Test -m systemd -a "name=fail2ban enabled=yes state=started"
	
	
##四、查看服务
	ansible Test -m shell -a "systemctl status fail2ban | grep Active"

![](/media//202205/2022-05-09105738249715.png)

##五、fail2ban规则操作
	#重载规则
	ansible Test -m shell -a "fail2ban-client reload"
	
	#查看规则状态
	ansible Test -m shell -a "fail2ban-client status"

![](/media//202205/2022-05-09110618275306.png)

#查看指定规则状态
	ansible Test -m shell -a "fail2ban-client status ssh-iptables"

![](/media//202205/2022-05-09110748154422.png)

#解禁IP
	ansible Test -m shell -a "fail2ban-client set ssh-iptables unbanip 192.168.1.8"
---