\u6700\u8fd1\u603b\u6709\u4e00\u4e9b\u65e0\u804a\u7684\u4eba\uff0c\u4f1a\u6765\u626b\u63cf\u4e00\u4e0b\u6211\u7684\u670d\u52a1\u5668\uff0c\u770b\u6709\u6ca1\u6709\u5565\u6f0f\u6d1e\u53ef\u4ee5\u5229\u7528\u7684\u3002\u3002\u3002<\/p>\n
\u53ef\u4ee5\u770b\u5230\u7c7b\u4f3c\u8fd9\u6837\u7684404\u8bbf\u95ee\u65e5\u5fd7\uff1a<\/p>\n
[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/pluse7xue.php (103.229.125.236) 0.55ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusmybak.php (103.229.125.236) 0.57ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusxsvip.php (103.229.125.236) 0.60ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/pluslaobiao.php (103.229.125.236) 0.60ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/xiaolei.php (103.229.125.236) 0.45ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/dxyylcmd5.php (103.229.125.236) 0.45ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/UserFilesx.aspx (103.229.125.236) 0.52ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/UserFilesx.aspx (103.229.125.236) 0.38ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/UserFilesx.aspx (103.229.125.236) 0.44ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/datacachefuck.php.parse_search_.inc (103.229.125.236) 0.47ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/datacachefuck.php.parse_search_.inc (103.229.125.236) 0.49ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/datacachefuck.php.parse_search_.inc (103.229.125.236) 0.43ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/utilityconvertdataconfig.inc.php (103.229.125.236) 0.43ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/configAspCms_Config.asp (103.229.125.236) 0.42ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusbakup.php (103.229.125.236) 0.43ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/includecodemp.php (103.229.125.236) 0.59ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/templetsplussky.php (103.229.125.236) 0.57ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusmytag_j.php?aid=6022 (103.229.125.236) 0.60ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusmytag_j.php?aid=6022 (103.229.125.236) 0.47ms
\n[W 2017-06-07 08:32:32 web:1728] 404 GET \/\/plusmytag_j.php?aid=6022 (103.229.125.236) 0.49ms<\/p>\n
…..<\/p>\n
\u8fd9\u79cd\u653b\u51fb\u7684\u7279\u70b9\u5c31\u662f\u77ed\u65f6\u95f4\u5185\u4f1a\u5927\u91cf\u7684404\u8bf7\u6c42\uff0c\u53ef\u4ee5\u5229\u7528\u8fd9\u4e00\u7279\u70b9\uff0c\u7528\u5de5\u5177\u8fdb\u884c\u62e6\u622a\uff0c\u68c0\u6d4b\u5230\u591a\u5c11\u65f6\u95f4\u5185\uff0c404\u8bf7\u6c42\u6570\u8d85\u8fc7\u4e86\u591a\u5c11\uff0c\u5c31\u628a\u8fd9\u4e2aip\u7ed9\u5c01\u6389\u3002<\/p>\n
\u4e8e\u662f\u5c31\u4ece\u7f51\u4e0a\u641c\u7d22\u5230\u4e86\u8fd9\u4e2a\u5de5\u5177\uff1afail2ban\uff0c\u5b98\u65b9\u4e3b\u9875\uff1ahttps:\/\/www.fail2ban.org\/wiki\/index.php\/MANUAL_0_8<\/p>\n
\u5728Ubuntu\u4e2d\u5b89\u88c5fail2ban\u5f88\u7b80\u5355\uff1a<\/p>\n
sudo apt-get install fail2ban<\/p>\n
\u5b89\u88c5\u597d\u540e\uff0c\u914d\u7f6e\u6587\u4ef6\u5728 \/etc\/fail2ban \u91cc\u9762\u3002<\/p>\n
\u9996\u5148\u6211\u4eec\u9700\u8981\u914d\u7f6e\u4e00\u4e2afilter\u89c4\u5219\uff0c\u4ee5\u4fbf\u68c0\u6d4b\u6211\u4eec\u7684\u65e5\u5fd7\u6587\u4ef6\u4e2d404\u7684\u76ee\u6807\u3002<\/p>\n
vim \/etc\/fail2ban\/filters.d\/web-404.conf<\/p>\n
[INCLUDES]<\/p>\n
before = common.conf<\/p>\n
[Definition]<\/p>\n
failregex = web:1728\\] 404 GET .*?\\(<HOST>\\)<\/p>\n
\u5199\u597d\u89c4\u5219\u540e\uff0c\u53ef\u4ee5\u7528\u547d\u4ee4\u884c\u6d4b\u8bd5\u4e00\u4e0b\u80fd\u4e0d\u80fd\u547d\u4e2d\uff1a<\/p>\n
fail2ban-regex 2017060708.log \/etc\/fail2ban\/filter.d\/web-404.conf <\/p>\n
\u6709\u4e00\u70b9\u5fc5\u987b\u6ce8\u610f\uff0c\u4f60\u7684\u65e5\u5fd7\u6587\u4ef6\u4e2d\uff0c\u884c\u7684\u5f00\u5934\u4e00\u5b9a\u8981\u5148\u547d\u4e2d\u65f6\u95f4\u6233\uff0c\u683c\u5f0f\u53ef\u4ee5\u662f\u7cfb\u7edf\u80fd\u8bc6\u522b\u7684\u65f6\u95f4\u683c\u5f0f\uff0c\u5982\u679c\u6ca1\u6709\u547d\u4e2d\u65f6\u95f4\uff0c\u90a3\u4e48\u4f60\u5199\u7684filter\u89c4\u5219\u662f\u6c38\u8fdc\u4e0d\u4f1a\u88ab\u547d\u4e2d\u7684\u3002<\/p>\n
\u6bd4\u5982\u6211\u521a\u5f00\u59cb\u7684\u65e5\u5fd7\u683c\u5f0f\u662f\u8fd9\u6837\u7684\uff1a<\/p>\n
W 20170607 08:32:32 web:1728] 404 GET \/\/plusxsvip.php (103.229.125.236) 0.60ms<\/p>\n
\u65e5\u671f\u683c\u5f0f 20170607 \u4e0d\u80fd\u88ab\u8bc6\u522b\uff0c\u6240\u4ee5\u6211\u5199\u7684filter\u89c4\u5219\u6b7b\u6d3b\u547d\u4e2d\u4e0d\u4e86\u3002\u3002\u3002<\/p>\n
\u5b98\u65b9\u6587\u6863\u6709\u89e3\u91ca\uff1ahttps:\/\/www.fail2ban.org\/wiki\/index.php\/MANUAL_0_8<\/p>\n
In order for a log line to match your failregex, it actually has to match in two parts: the beginning of the line has to match a timestamp pattern or regex,
\nand the remainder of the line has to match your failregex.
\nIf the failregex is anchored with a leading ^, then the anchor refers to the start of the remainder of the line, after the timestamp and intervening whitespace.<\/p>\n
The pattern or regex to match the time stamp is currently not documented, and not available for users to read or set.
\nSee Debian bug #491253. This is a problem if your log has a timestamp format that fail2ban doesn’t expect, since it will then fail to match any lines.
\nBecause of this, you should test any new failregex against a sample log line, as in the examples below, to be sure that it will match.
\nIf fail2ban doesn’t recognize your log timestamp, then you have two options: either reconfigure your daemon to log with a timestamp in a more common format,
\nsuch as in the example log line above; or file a bug report asking to have your timestamp format included.<\/p>\n
\u5982\u679c\u8981\u81ea\u5b9a\u4e49\u65f6\u95f4\u683c\u5f0f\uff0c\u53ef\u4ee5\u5728filter\u7684\u914d\u7f6e\u4e2d\u8bbe\u7f6e datepattern \u53c2\u6570\uff0c\u8be6\u60c5\u89c1\u5b98\u65b9\u6587\u6863\uff1ahttps:\/\/manpages.debian.org\/testing\/fail2ban\/jail.conf.5.en.html<\/p>\n
\u5b9a\u4e49\u597dfilter\u540e\uff0c\u5c31\u53ef\u4ee5\u5199ban\u7684\u89c4\u5219\uff1a<\/p>\n
cat \/etc\/fail2ban\/jail.local<\/p>\n
[web-404]<\/p>\n
enabled = true
\nport = http,https
\nfilter = web-404
\nlogpath = \/var\/log\/supervisor\/web.log tail
\nmaxretry = 10
\nbantime = 86400
\nfindtime = 60<\/p>\n
\u4e0a\u9762\u914d\u7f6e\u7684\u542b\u4e49\u5c31\u662f\uff0c\u4f7f\u7528 moviex_web-404 \u8fd9\u4e00\u4e2afilter\u914d\u7f6e\uff0c\u68c0\u6d4b\u65e5\u5fd7\u6587\u4ef6logpath\uff0c\u5728findtime\u65f6\u95f4\u5185\uff0c\u5339\u914d\u5230 maxretry \u6b21\u6570\u540e\uff0c\u5c31ban\u6389\u5bf9\u65b9\u7684ip\uff0c\u5728\u6709\u6548\u65f6\u95f4 bantime \u5185\uff0c\u62d2\u7edd\u5bf9\u65b9\u8fde\u63a5 port \u53c2\u6570\u6307\u5b9a\u7684\u7aef\u53e3\u3002<\/p>\n
logpath \u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u53ef\u4ee5\u662f head \u6216 tail\uff0c\u9ed8\u8ba4\u4e3ahead\uff0c\u4ece\u65e5\u5fd7\u7684\u5f00\u5934\u8fdb\u884c\u5339\u914d\uff0c\u8fd9\u6837\u6709\u4e2a\u4e0d\u597d\u7684\u5730\u65b9\u5c31\u662f\u6bcf\u6b21\u91cd\u542ffail2ban\u540e\uff0c\u90fd\u8981\u4ece\u65e5\u5fd7\u5f00\u5934\u5339\u914d\u4e00\u904d\u3002<\/p>\n
\u5982\u679c\u6709\u591a\u4e2alogpath\uff0c\u5219\u6362\u884c\u5199\uff0c\u4e00\u884c\u5199\u4e00\u6761\u3002<\/p>\n
\u53ef\u4ee5\u5728 jail.local \u4e2d\u5b9a\u4e49\u5ffd\u7565ip\uff0c\u6bd4\u5982\u8bf4google \u722c\u866b\u7684ip\u5730\u5740\uff0c\u5728jail.local\u6587\u4ef6\u4e2d\u52a0\u4e0a\u914d\u7f6e\uff1a<\/p>\n
[DEFAULT]
\n# \u4ee5\u7a7a\u683c\u5206\u9694\u7684\u5217\u8868\uff0c\u53ef\u4ee5\u662f IP \u5730\u5740\u3001CIDR \u524d\u7f00\u6216\u8005 DNS \u4e3b\u673a\u540d
\n# \u7528\u4e8e\u6307\u5b9a\u54ea\u4e9b\u5730\u5740\u53ef\u4ee5\u5ffd\u7565 fail2ban \u9632\u5fa1
\nignoreip = 127.0.0.1 172.31.0.0\/24 10.10.0.0\/24 192.168.0.0\/24<\/p>\n
\u5982\u679c\u60f3\u8981\u8ba9ip\u767d\u540d\u5355\u53ea\u9488\u5bf9\u67d0\u4e9bjail\u89c4\u5219\u751f\u6548\uff0c\u5219\u53ef\u4ee5\u4f7f\u7528fail2ban-client\u547d\u4ee4\u6765\u8bbe\u7f6e\u3002\u4f8b\u5982\uff1a<\/p>\n
fail2ban-client set web-404 addignoreip 123.45.67.89 <\/p>\n
\u91cd\u542ffail2ban\u751f\u6548\u540e\uff0c\u53ef\u4ee5\u67e5\u770b\u65e5\u5fd7 \/var\/log\/fail2ban.log \u6765\u770b\u68c0\u6d4b\u60c5\u51b5\uff0c\u4e5f\u53ef\u4ee5\u901a\u8fc7\u547d\u4ee4\u884c\u6765\u67e5\u770b\u72b6\u6001\uff1a<\/p>\n
# \u67e5\u770b\u6240\u6709jail\u72b6\u6001
\nsudo fail2ban-client status<\/p>\n
# \u67e5\u770bweb-404 \u8fd9\u4e2ajail\u7684\u72b6\u6001
\nsudo fail2ban-client status web-404<\/p>\n
# \u89e3\u5c01ip
\nsudo fail2ban-client set web-404 unbanip 192.168.1.8<\/p>\n
fail2ban-client \u8fd8\u6709\u5f88\u591a\u5176\u5b83\u547d\u4ee4\uff0c\u53ef\u4ee5\u53c2\u8003\u6587\u6863\u8bf4\u660e\uff1a fail2ban-client –help<\/p>\n
\u5f53 fail2ban \u6545\u969c\u65f6\uff0c\u9700\u8981\u6e05\u7406\u6570\u636e\u5e76\u91cd\u542f\uff0c\u6b65\u9aa4\u5982\u4e0b<\/p>\n
sudo service fail2ban stop\nsudo truncate -s 0 \/var\/log\/fail2ban.log\nsudo rm \/var\/lib\/fail2ban\/fail2ban.sqlite3\nsudo service fail2ban restart\ufeff\n<\/code><\/pre>\n\u5220\u9664 fail2ban \u751f\u6210\u7684 iptables \u89c4\u5219\u3002\u9996\u5148\uff0c\u786e\u4fdd\u6e05\u9664\u5f53\u524d\u7684 Fail2ban \u76f8\u5173 iptables \u89c4\u5219\uff0c\u4ee5\u907f\u514d\u51b2\u7a81\u3002\u4f60\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u547d\u4ee4\u6e05\u9664\u7279\u5b9a\u94fe\u7684\u89c4\u5219\uff1a<\/p>\n
sudo iptables -F <chain_name>\n<\/code><\/pre>\n\u901a\u5e38\uff0cFail2ban \u4f7f\u7528\u4ee5 f2b- \u5f00\u5934\u7684\u94fe\u540d\u3002\u4f60\u53ef\u4ee5\u5217\u51fa\u6240\u6709\u94fe\u5e76\u627e\u5230\u76f8\u5173\u7684\u94fe\uff1a<\/p>\n
sudo iptables -L -n --line-numbers\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"\u6700\u8fd1\u603b\u6709\u4e00\u4e9b\u65e0\u804a\u7684\u4eba\uff0c\u4f1a\u6765\u626b\u63cf\u4e00\u4e0b\u6211\u7684\u670d\u52a1\u5668\uff0c\u770b\u6709\u6ca1\u6709\u5565\u6f0f\u6d1e\u53ef\u4ee5\u5229\u7528\u7684\u3002\u3002\u3002 \u53ef\u4ee5\u770b\u5230\u7c7b\u4f3c\u8fd9\u6837\u7684404\u8bbf\u95ee\u65e5\u5fd7 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-6215","post","type-post","status-publish","format-standard","hentry","category-skill"],"_links":{"self":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/6215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/comments?post=6215"}],"version-history":[{"count":6,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/6215\/revisions"}],"predecessor-version":[{"id":7834,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/posts\/6215\/revisions\/7834"}],"wp:attachment":[{"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/media?parent=6215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/categories?post=6215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kyle.ai\/blog\/wp-json\/wp\/v2\/tags?post=6215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}