fail2ban(IP自动屏蔽工具) - 安全相关

#注意
###fail2ban停止或重启后，会默认删除它此次创建的iptables规则
	systemctl stop fail2ban

---
#安装
	yum -y install fail2ban

---
#修改配置
	vim /etc/fail2ban/jail.conf

---

###SSH封禁例子
	[ssh-iptables]
	enabled  = true
	filter   = sshd		
	#过滤规则 filter 名称，对应 filter.d 目录下的 sshd.conf
	action   = iptables[name=SSH, port=22, protocol=tcp]
	action   = iptables[name=SSH, port=2201:2219, protocol=tcp]
	#执行语句，多端口段使用":"连接。
	action = mail-whois[name=SSH, dest=wujiaqiang@wxchina.com, sender=cpaas@wxchina.com]
        iptables[name=SSH,port=2233, protocol=tcp]
	#执行多语句，空一行
	logpath  = /var/log/secure
	maxretry = 3
	findtime  = 300
	bantime = 10m

####注意：mail-whois实为/etc/fail2ban/action.d/里面配置mail-whois.conf

---
#启停Fail2ban
	#启动Fail2ban。
	systemctl start fail2ban

#停止Fail2ban
	systemctl stop fail2ban

#开机启动Fail2ban。
	systemctl enable fail2ban

---
#重新加载
	fail2ban-client reload

---
#查看
	fail2ban-client status
	fail2ban-client status ssh-iptables
	
---
##解禁一个特定IP
	fail2ban-client set ssh-iptables unbanip 192.168.1.8
	
---
#Fail2ban常用命令
	#启动Fail2ban。
	systemctl start fail2ban

#停止Fail2ban
	systemctl stop fail2ban

#开机启动Fail2ban。
	systemctl enable fail2ban

#查看被ban IP，其中ssh-iptables为名称
	fail2ban-client status ssh-iptables

#添加白名单。
	fail2ban-client set ssh-iptables addignoreip IP地址

#删除白名单。
	fail2ban-client set ssh-iptables delignoreip IP地址
	
	#查看白名单
	fail2ban-client get ssh-iptables ignoreip

#查看被禁止的IP地址。
	iptables -L -n

#解禁一个特定IP
	fail2ban-client set ssh-iptables unbanip 192.168.1.8

---
#目录
###fail2ban的配置文件路径：/etc/fail2ban
###fail2ban安装目录：/usr/share/fail2ban
###日志文件：/var/log/fail2ban.log
###（重要）达到阈值之后的执行的动作的配置文件：   action.d/ 
###包含所有的过滤规则：filter.d/

---
#邮件告警【自定义动作】
##安装mailx
	yum -y install mailx
---
##备份配置
	cp /etc/mail.rc /etc/mail.rc.bak
---
##修改配置
	vim /etc/mail.rc
	========================================================
	#配置如下：
	========================================================
	set ssl-verify=ignore
	set from=邮件地址@163.com
	set smtp=smtps://smtp.163.com:465
	set smtp-auth-user=邮件地址@163.com
	set smtp-auth-password=授权码
	set smtp-auth=login
	========================================================
	注意：smtp-auth-password不是填写邮箱密码，而是邮箱的授权码
---
##测试
	#echo输入
	echo "正文"|mail -s "标题" -a 20220204-20220206_gbk.csv xx1@wxchina.com,xx2@wxchina.com
	
	#文件重定向输入
	mail -a 20220204-20220206_gbk.csv -s "消费" xx1@wxchina.com,xx2@wxchina.com<aa.log
	
---
##创建action文件
	vim /etc/fail2ban/action.d/mail-whois.conf
	#内容：
	[Definition]
	actioncheck =
	actionban = printf "警告!!!\n
            攻击者IP：<ip>\n
            被攻击机器名：`uname -n` \n
            被攻击机器IP：`/bin/curl ifconfig.co` \n
            攻击服务：<name> \n
            攻击次数：<failures> 次 \n
            攻击方法：暴力破解，尝试弱口令\n
            该IP：<ip>已经被Fail2Ban加入防火墙黑名单,屏蔽时间5分钟\n
            Fail2Ban邮件提醒"|/bin/mailx -s "服务器:<name>服务疑似遭到<ip>暴力攻击." <dest>
	actionunban =
	[Init]
	name = default
	dest = root

---
##修改jail配置
	[ssh-iptables]
	enabled  = true
	filter   = sshd
	action = mail-whois[name=SSH, dest=wujiaqiang@wxchina.com, sender=cpaas@wxchina.com]
        iptables[name=SSH,port=2233, protocol=tcp]
	logpath  = /var/log/secure
	maxretry = 3
	findtime  = 300
	bantime = 100

###注意：mail-whois要对应创建action文件名称。
####例如：/etc/fail2ban/action.d/mail-whois.conf，则此处就为mail-whois

---
##重启fail2ban
	systemctl restart fail2ban