设置Fail2Ban

Question

我是fail2ban的新手。我想设置Fail2Ban，以便在两次失败的登录尝试中禁止一个IP一个小时。我有以下设置：

/etc/fail2ban/jail.local.conf

[DEFAULT]
bantime = 3600
maxretry = 2
backend = systemd
usedns = warn
mode = normal
destemail = <MYEMAIL>
sender = <MYSENDER>
protocol = tcp
chain = <known/chain>
port = 0:65535
fail2ban_agent = Fail2Ban/%(fail2ban_version)s
...
# Choose default action.  To change, just override value of 'action' with
# the interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_mw)s

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s


[dropbear]

port     = ssh
logpath  = %(dropbear_log)s
backend  = %(dropbear_backend)s


[selinux-ssh]

port     = ssh
logpath  = %(auditd_log)s

在systemctl status fail2ban.service上，我看到服务已经启动。我的假设是它使用jail.local.conf文件。没有报告错误。我没有安装iptables。这有必要吗？如果是这样的话，如何用我现有的fail2ban设置来设置它？

Answer 1

你的文件的名字不对。fail2ban将读取一个名为jail.local的文件，而不是jail.local.conf。重命名文件并重新启动fail2ban。