Debian安装fail2ban封禁恶意ip

1
sudo apt update
2
sudo apt install fail2ban rsyslog -y

1
sudo systemctl enable --now fail2ban
2
sudo systemctl enable --now rsyslog

1
sudo systemctl status fail2ban
2
sudo systemctl status rsyslog

1
sudo nano /etc/fail2ban/jail.local

1
[sshd]
2
ignoreip = 127.0.0.1/8
3
enabled = true
4
filter = sshd
5
port = 5522
6
maxretry = 3
7
findtime = 300
8
bantime = -1
9
banaction = nftables-multiport
10
logpath = /var/log/auth.log

1
sudo fail2ban-client -t

1
sudo systemctl restart rsyslog

1
sudo systemctl stop fail2ban
2
sudo systemctl disable fail2ban
3
sudo apt-get remove --purge fail2ban
4
sudo apt-get autoremove
5
sudo apt-get clean
6
sudo rm -rf /var/log/fail2ban.log
7
sudo rm -rf /var/lib/fail2ban