开源服务专题之------ssh防止暴力破解及fail2ban的使用方法

[root@xiaolyu77 ~]# nmap xiaolyu77   #扫描自己的ip地址

Starting Nmap 5.51 ( http://nmap.org ) at 2016-09-19 08:56 CST
Nmap scan report for xiaolyu77 (192.168.31.77)
Host is up (0.0000080s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE
22/tcp open  ssh         #22端口，判断出来是ssh服务。

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
[root@xiaolyu77 ~]# nmap xiaolyu76  #扫描xiaolyu76服务器的ip地址

Starting Nmap 5.51 ( http://nmap.org ) at 2016-09-19 08:57 CST
Nmap scan report for xiaolyu76 (192.168.31.76)
Host is up (0.00028s latency).
Not shown: 999 closed ports
PORT    STATE SERVICE
222/tcp open  rsh-spx      #222端口判断不出来是ssh服务，发生误判。
MAC Address: 00:0C:29:58:6F:7B (VMware)

Nmap done: 1 IP address (1 host up) scanned in 1.20 seconds

[root@xiaolyu76 ~]# useradd mk  #创建一个用户mk，用它来冒充root用户。

 [root@xiaolyu76 ~]# passwd mk   #给mk用户添加密码。
 Changing password for user mk.
 New password:
 BAD PASSWORD: it is too simplistic/systematic
 BAD PASSWORD: is too simple
 Retype new password:
 passwd: all authentication tokens updated successfully.

[root@xiaolyu76 ~]# vim /etc/passwd
# passwd文件修改前
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
xiao:x:500:500::/home/xiao:/bin/bash
mk:x:501:501::/home/mk:/bin/bash
#passwd文件修改后：（只修改了文件中表蓝色的部分，修改后变成了这种颜色）

root:x:0:0:root:/root:/sbin/nologin   #修改后的root用户，不在具有登录权限了。
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
xiao:x:500:500::/home/xiao:/bin/bash
mk:x:0:0::/home/mk:/bin/bash  #修改后的mk用户，它的uid，gid都为0。

[root@xiaolyu77 ~]# hostname -i
192.168.31.77
[root@xiaolyu77 ~]# ssh -p 8099 xiaolyu76
root@xiaolyu76's password: 
Last login: Mon Sep 19 10:04:10 2016 from 192.168.31.160
Warning ! From now on, all of your operations have been recorded!
This account is currently not available.
Connection to xiaolyu76 closed.
[root@xiaolyu77 ~]# ssh -p 8099 mk@xiaolyu76
mk@xiaolyu76's password: 
Last login: Mon Sep 19 10:06:00 2016 from xiaolyu77
Warning ! From now on, all of your operations have been recorded!
[root@xiaolyu76 ~]# hostname -i
192.168.31.76
[root@xiaolyu76 ~]# whoami
root
[root@xiaolyu76 ~]# 

[root@xiaolyu76 fail2ban-0.8.14]# vim README.md
#说明：下面的readme仅仅是我择要摘取，原文太长了。
This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
are available in fail2ban(1) manpage and on the website http://www.fail2ban.org

Installation:
-------------

**It is possible that Fail2ban is already packaged for your distribution.  In
this case, you should use it instead.**

Required:
- [Python >= 2.4](http://www.python.org)

Optional:
- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
  - Linux >= 2.6.13
- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)

To install, just do:

    tar xvfj fail2ban-0.8.12.tar.bz2
    cd fail2ban-0.8.12
    python setup.py install

This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are
placed into /usr/bin, and configuration under /etc/fail2ban.

#下面是生成服务启动脚本的程序：
[root@xiaolyu76 fail2ban-0.8.14]# pwd   
/root/fail2ban-0.8.14
[root@xiaolyu76 fail2ban-0.8.14]# grep chkconfig ./* -R --color   #查看服务启动脚本是哪个文件，同时着色显示。
./files/redhat-initd:# chkconfig: - 92 08
[root@xiaolyu76 fail2ban-0.8.14]# cp files/redhat-initd /etc/init.d/fail2ban #将服务启动脚本复制到存放开机启动的服务的目录下
[root@xiaolyu76 fail2ban-0.8.14]# chkconfig --add fail2ban  #设置服务的开机启动  
[root@xiaolyu76 fail2ban-0.8.14]# service fail2ban start    #service fail2ban start|stop|status|restart测试服务是否正常
Starting fail2ban:                                         [  OK  ]
[root@xiaolyu76 fail2ban-0.8.14]# service fail2ban status
fail2ban-server (pid  5874) is running...
Status
|- Number of jail:    0
`- Jail list:        
[root@xiaolyu76 fail2ban-0.8.14]# service fail2ban restart
Stopping fail2ban:                                         [  OK  ]
Starting fail2ban:                                         [  OK  ]
[root@xiaolyu76 fail2ban-0.8.14]# service fail2ban stop
Stopping fail2ban:                                         [  OK  ]
[root@xiaolyu76 fail2ban-0.8.14]# 

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8

# External command that will take an tagged arguments to ignore, e.g. <ip>,
# and return true if the IP is to be ignored. False otherwise.
#
# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

# "backend" specifies the backend used to get files modification.
# Available options are "pyinotify", "gamin", "polling" and "auto".
# This option can be overridden in each jail as well.
#
# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
#              If pyinotify is not installed, Fail2ban will use auto.
# gamin:     requires Gamin (a file alteration monitor) to be installed.
#              If Gamin is not installed, Fail2ban will use auto.
#
# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
#              If pyinotify is not installed, Fail2ban will use auto.
# gamin:     requires Gamin (a file alteration monitor) to be installed.
#              If Gamin is not installed, Fail2ban will use auto.
# polling:   uses a polling algorithm which does not require external libraries.
# auto:      will try to use the following backends, in order:
#              pyinotify, gamin, polling.
backend = auto

# "usedns" specifies if jails should trust hostnames in logs,
#   warn when DNS lookups are performed, or ignore all hostnames in logs
#
# yes:   if a hostname is encountered, a DNS lookup will be performed.
# warn:  if a hostname is encountered, a DNS lookup will be performed,
#        but it will be logged as a warning.
# no:    if a hostname is encountered, will not be used for banning,
#        but it will be logged as info.
usedns = warn


# This jail corresponds to the standard configuration in Fail2ban.
# The mail-whois action send a notification e-mail with a whois request
# in the body.

[ssh-iptables]

#enabled  = false
enabled  = true
filter   = sshd
action   = iptables[name=SSH, port=ssh, protocol=tcp]
           sendmail-whois[name=SSH, dest=you@example.com, sender=fail2ban@example.com, sendername="Fail2Ban"]
#logpath  = /var/log/sshd.log
logpath  = /var/log/secure
#maxretry = 5
maxretry = 3

[root@xiaolyu76 ~]# iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name ROUTER-SSH  --update --seconds 1800 --hitcount 5 -j DROP
[root@xiaolyu76 ~]# iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name ROUTER-SSH --set -j ACCEPT
[root@xiaolyu76 ~]# service iptables -L  #该命令如果返回防火墙规则，说明防火墙起作用了，否则不起作用。
Usage: iptables {start|stop|reload|restart|condrestart|status|panic|save}
[root@xiaolyu76 ~]# 

[root@xiaolyu76 ~]# > /var/log/secure  #清空该日志，从现在开始重新写
[root@xiaolyu76 ~]# cat /var/log/secure
[root@xiaolyu76 ~]# service fail2ban restart #重启fail2ban
Stopping fail2ban:                                         [  OK  ]
Starting fail2ban:                                         [  OK  ]
[root@xiaolyu76 ~]# iptables -L -n   #生成关于fail2ban的规则链
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-SSH  tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0 

[root@xiaolyu77 ~]# ssh xiaolyu76
root@xiaolyu76's password: 
Permission denied, please try again.
root@xiaolyu76's password: 
Permission denied, please try again.
root@xiaolyu76's password: 
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
[root@xiaolyu77 ~]# ssh xiaolyu76
ssh: connect to host xiaolyu76 port 22: Connection refused