专利申请需要准备哪些材料？申请流程是怎样的？

Installing and configuring fail2ban on CentOS is not complicated, it mainly includes the following steps: 1. Install fail2ban using yum; 2. Manually enable and start the service; 3. Create a jail.local file for custom configuration; 4. Set SSH defense rules, including enabling sshd, specifying the blocking time and retry times; 5. Configure firewalld as an action actuator; 6. Regularly check the blocking IP and logs. Fail2ban detects abnormal login behavior through monitoring logs and automatically blocks suspicious IPs. Its core mechanism relies on the settings of key parameters such as bantime (banned time), findtime (statistic window time) and maxretry (maximum number of failures). When using the default configuration file structure, you should prioritize creating .local files instead of modifying .conf files to avoid configuration loss. For SSH protection, just enable the sshd module in jail.local and adjust the relevant parameters to take effect. At the same time, to ensure that the ban rule is applied correctly, banaction needs to be set to firewallcmd-rich-rules to adapt to firewalld. Users can view the current blocked status through the iptables command or the fail2ban log, and extend the protection rules of other services as needed.

Fail2ban is a very practical intrusion prevention tool that detects abnormal login behavior (such as multiple failed attempts) by monitoring system logs and automatically blocks suspicious IP addresses. Installing and configuring fail2ban on CentOS is not complicated, but requires some basic operations.

Install Fail2ban

The default repository of CentOS usually contains fail2ban, so you can directly install it with yum:

• Run the command: sudo yum install fail2ban
• After the installation is completed, the fail2ban service will not start automatically by default. You need to manually enable and start the service:
  • sudo systemctl enable fail2ban
  • sudo systemctl start fail2ban

You can use systemctl status fail2ban to check whether the service status is running normally.

Basic configuration file structure

The main configuration file of Fail2ban is /etc/fail2ban/jail.conf , but the official recommendation does not directly modify this file, but create a .local file for custom settings:

• Create or edit configuration file: sudo vi /etc/fail2ban/jail.local
• In this file, you can override the settings in jail.conf, such as changing the ban time, retry times, etc.

Common basic configuration items include:

• bantime : ban time (unit second)
• findtime : How long does a failed attempt be counted
• maxretry : Maximum number of failed attempts
• ignoreip : You can add whitelist IP to avoid accidentally blocking yourself or other trusted sources

Configure SSH defense rules

SSH is one of the most common attack portals. Fail2ban includes a filtering rule for SSH by default, which only needs to be enabled.

Add or confirm the following in jail.local :

 [sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
maxretry = 5
bantime = 86400

This configuration means:

• Enable sshd rules
• Use the default SSH log path (usually /var/log/secure )
• If an IP fails more than 5 times within the set time, it will be banned for one day (86400 seconds)

You can also adjust parameters according to your own security needs.

Use Firewalld as Action Actuator

CentOS 7 and above use firewalld as a firewall management tool by default. Fail2ban supports banning IP directly through firewalld.

Make sure that your jail.local has the following configuration:

 banaction = firewallcmd-rich-rules

In this way, fail2ban will use rich rules to add temporary blocking rules, and it will take effect without restarting the firewall.

If you want to view the currently blocked IP, you can use the following command:

• sudo iptables -L -n | grep banned

Or check the fail2ban's own log:

• sudo cat /var/log/fail2ban.log

Basically that's it. After installation, remember to check the logs and bans regularly. If necessary, you can extend the protection rules of other services, such as preventing FTP or HTTP brute-force cracking. Although there are not many steps, some details are easy to ignore, such as configuration file location and firewalld action settings. If you make a mistake, it may affect the blocking effect.

The above is the detailed content of How to install and configure fail2ban on CentOS?. For more information, please follow other related articles on the PHP Chinese website!