Installation de Fail2ban
De www.yakakliker.org
Fail2ban est un IPS (Intrusion Prevention Software) open source. Il permet de sécuriser les serveurs Linux contre les tentatives de connexions malveillantes et les attaques DDOS. Fail2ban réduit les tentatives de connexion malveillantes en bloquant les adresses IP sources.
Installation & configuration du firewall UFW
sudo apt install ufw -y
Autorisation du SSH dans UFW
sudo ufw allow ssh
Activation du service UFW
sudo ufw enable
Installation & configuration de Fail2ban
sudo apt install fail2ban -y
Activation du service Fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
Configuration du service Fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local
Ajout des IP LAN qui ne seront pas surveillées par Fail2ban
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24 192.168.10.20
Paramétrage du bannissement des IP
bantime = 30d
findtime = 10m
maxretry = 5
banaction = ufw
Paramétrage de la récidive
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime = 90d
findtime = 1d
Redémarrage du service Fail2ban pour prendre en compte les paramètres
sudo systemctl restart fail2ban
Vérification du service Fail2ban
sudo fail2ban-client status sshd
sudo tail -f /var/log/fail2ban.log
# tail -f /var/log/fail2ban.log
2024-03-18 14:06:58,265 fail2ban.filter [637026]: INFO [recidive] Found 109.195.148.73 - 2024-03-18 07:11:30
2024-03-18 14:06:58,265 fail2ban.filter [637026]: INFO [recidive] Found 118.193.35.98 - 2024-03-18 07:12:20
2024-03-18 14:06:58,265 fail2ban.filter [637026]: INFO [recidive] Found 129.226.156.158 - 2024-03-18 07:12:52
2024-03-18 14:06:58,266 fail2ban.filter [637026]: INFO [recidive] Found 43.128.109.248 - 2024-03-18 07:13:12
2024-03-18 14:06:58,266 fail2ban.filter [637026]: INFO [recidive] Found 45.145.4.35 - 2024-03-18 07:17:04
2024-03-18 14:06:58,266 fail2ban.filter [637026]: INFO [recidive] Found 170.64.176.22 - 2024-03-18 09:03:43
2024-03-18 14:06:58,266 fail2ban.filter [637026]: INFO [recidive] Found 185.224.128.34 - 2024-03-18 10:06:32
2024-03-18 14:06:58,267 fail2ban.filter [637026]: INFO [recidive] Found 43.134.183.116 - 2024-03-18 10:11:33
2024-03-18 14:06:58,267 fail2ban.filter [637026]: INFO [recidive] Found 206.189.102.172 - 2024-03-18 10:11:48
2024-03-18 14:06:58,267 fail2ban.filter [637026]: INFO [recidive] Found 121.254.93.120 - 2024-03-18 10:34:34
