1panel设置Fail2ban

Dec 23, 2024153

AI-generated summary

The document provides installation instructions for Fail2ban on Ubuntu/Debian systems. It includes steps to install Fail2ban and rsyslog (for Debian 12 and above), start the Fail2ban service, enable it to start on boot, and check its status. The default configuration settings for Fail2ban are also outlined, including parameters for banning and SSH settings. Additionally, it describes modifications to the UFW configuration for banning and unbanning actions.

1 安装#

Ubuntu / Debian

1、安装 Fail2ban
sudo apt-get install fail2ban

2、Debian 12 及以上的版本需要手动安装 rsyslog
sudo apt-get install rsyslog

3、启动 Fail2ban 服务

sudo systemctl start fail2ban

4、开机自启动
sudo systemctl enable fail2ban

5、查看 Fail2ban 服务状态。
sudo systemctl status fail2ban

2 默认配置#

1Panel 默认使用以下配置：

#DEFAULT-START
[DEFAULT]
bantime = 600
findtime = 300
maxretry = 5
banaction = ufw
action = %(action_mwl)s
#DEFAULT-END

[sshd]
ignoreip = 127.0.0.1/8
enabled = true
filter = sshd
port = 22
maxretry = 3
findtime = 300
bantime = -1
banaction = ufw
action = %(action_mwl)s
logpath = /var/log/auth.log

3 修改 UFW 配置#

/etc/fail2ban/action.d/ufw.conf

[Definition]
actionstart = 
actionstop = 
actioncheck = 
# 封禁所有端口访问
actionban = ufw insert 1 deny from <ip> to any
actionunban = ufw delete deny from <ip> to any

[Init]