[{"data":1,"prerenderedAt":602},["ShallowReactive",2],{"wiki-/wiki/security/fail2ban":3},{"id":4,"title":5,"body":6,"description":593,"extension":594,"meta":595,"navigation":596,"path":597,"section":598,"seo":599,"stem":600,"__hash__":601},"wiki/wiki/security/fail2ban.md","Защита от брутфорса с Fail2Ban",{"type":7,"value":8,"toc":576},"minimark",[9,21,27,30,35,38,42,63,67,75,79,84,87,115,118,134,137,155,159,162,175,178,232,235,255,266,269,278,282,296,300,316,319,323,326,348,352,364,367,375,386,390,400,412,418,436,443,453,466,470,486,491,503,517,529,533,553,557,572],[10,11,12,16,17,20],"p",{},[13,14,15],"strong",{},"Время:"," 10 мин · ",[13,18,19],{},"Сложность:"," ★☆☆☆☆",[10,22,23,26],{},[13,24,25],{},"Подходит:"," ✓ Ubuntu 22.04 · ✓ Debian 12 · ✓ AlmaLinux 9",[28,29],"hr",{},[31,32,34],"h2",{"id":33},"краткое-описание","Краткое описание",[10,36,37],{},"Fail2Ban анализирует системные логи и временно блокирует IP-адреса, которые слишком часто ошибаются при входе. Работает с SSH, Nginx, Postfix и другими службами. После установки защита от перебора включается автоматически — без дополнительной настройки.",[31,39,41],{"id":40},"когда-пригодится","Когда пригодится",[43,44,45,49,60],"ul",{},[46,47,48],"li",{},"Сразу после запуска нового VPS с открытым SSH",[46,50,51,52,56,57],{},"Если в ",[53,54,55],"code",{},"/var/log/auth.log"," видите сотни строк с ",[53,58,59],{},"Failed password",[46,61,62],{},"Когда хотите защитить не только SSH, но и веб-сервер или почтовый сервер",[31,64,66],{"id":65},"что-понадобится","Что понадобится",[43,68,69,72],{},[46,70,71],{},"Root-доступ к серверу",[46,73,74],{},"Открытый порт SSH (стандартный 22 или нестандартный)",[31,76,78],{"id":77},"пошаговая-инструкция","Пошаговая инструкция",[80,81,83],"h3",{"id":82},"_1-установка","1. Установка",[10,85,86],{},"На Ubuntu и Debian:",[88,89,94],"pre",{"className":90,"code":91,"language":92,"meta":93,"style":93},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","apt install -y fail2ban\n","bash","",[53,95,96],{"__ignoreMap":93},[97,98,101,105,109,112],"span",{"class":99,"line":100},"line",1,[97,102,104],{"class":103},"sBMFI","apt",[97,106,108],{"class":107},"sfazB"," install",[97,110,111],{"class":107}," -y",[97,113,114],{"class":107}," fail2ban\n",[10,116,117],{},"На AlmaLinux:",[88,119,121],{"className":90,"code":120,"language":92,"meta":93,"style":93},"dnf install -y fail2ban\n",[53,122,123],{"__ignoreMap":93},[97,124,125,128,130,132],{"class":99,"line":100},[97,126,127],{"class":103},"dnf",[97,129,108],{"class":107},[97,131,111],{"class":107},[97,133,114],{"class":107},[10,135,136],{},"Включите автозапуск и запустите службу:",[88,138,140],{"className":90,"code":139,"language":92,"meta":93,"style":93},"systemctl enable --now fail2ban\n",[53,141,142],{"__ignoreMap":93},[97,143,144,147,150,153],{"class":99,"line":100},[97,145,146],{"class":103},"systemctl",[97,148,149],{"class":107}," enable",[97,151,152],{"class":107}," --now",[97,154,114],{"class":107},[80,156,158],{"id":157},"_2-настройка-для-ssh","2. Настройка для SSH",[10,160,161],{},"Создайте файл с локальными настройками — он не перезапишется при обновлении пакета:",[88,163,165],{"className":90,"code":164,"language":92,"meta":93,"style":93},"nano /etc/fail2ban/jail.local\n",[53,166,167],{"__ignoreMap":93},[97,168,169,172],{"class":99,"line":100},[97,170,171],{"class":103},"nano",[97,173,174],{"class":107}," /etc/fail2ban/jail.local\n",[10,176,177],{},"Добавьте следующее содержимое:",[88,179,183],{"className":180,"code":181,"language":182,"meta":93,"style":93},"language-ini shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = /var/log/auth.log\nmaxretry = 5\nbantime = 3600\nfindtime = 600\n","ini",[53,184,185,190,196,202,208,214,220,226],{"__ignoreMap":93},[97,186,187],{"class":99,"line":100},[97,188,189],{},"[sshd]\n",[97,191,193],{"class":99,"line":192},2,[97,194,195],{},"enabled = true\n",[97,197,199],{"class":99,"line":198},3,[97,200,201],{},"port = ssh\n",[97,203,205],{"class":99,"line":204},4,[97,206,207],{},"filter = sshd\n",[97,209,211],{"class":99,"line":210},5,[97,212,213],{},"logpath = /var/log/auth.log\n",[97,215,217],{"class":99,"line":216},6,[97,218,219],{},"maxretry = 5\n",[97,221,223],{"class":99,"line":222},7,[97,224,225],{},"bantime = 3600\n",[97,227,229],{"class":99,"line":228},8,[97,230,231],{},"findtime = 600\n",[10,233,234],{},"Параметры:",[43,236,237,243,249],{},[46,238,239,242],{},[53,240,241],{},"maxretry = 5"," — после 5 неудачных попыток IP блокируется",[46,244,245,248],{},[53,246,247],{},"bantime = 3600"," — блокировка на 1 час (в секундах)",[46,250,251,254],{},[53,252,253],{},"findtime = 600"," — окно наблюдения 10 минут",[10,256,257,258,261,262,265],{},"Если используете нестандартный порт SSH, замените ",[53,259,260],{},"port = ssh"," на ",[53,263,264],{},"port = 2222"," (или ваш порт).",[10,267,268],{},"На AlmaLinux путь к логу другой:",[88,270,272],{"className":180,"code":271,"language":182,"meta":93,"style":93},"logpath = /var/log/secure\n",[53,273,274],{"__ignoreMap":93},[97,275,276],{"class":99,"line":100},[97,277,271],{},[80,279,281],{"id":280},"_3-применить-настройки","3. Применить настройки",[88,283,285],{"className":90,"code":284,"language":92,"meta":93,"style":93},"systemctl restart fail2ban\n",[53,286,287],{"__ignoreMap":93},[97,288,289,291,294],{"class":99,"line":100},[97,290,146],{"class":103},[97,292,293],{"class":107}," restart",[97,295,114],{"class":107},[80,297,299],{"id":298},"_4-проверка-статуса","4. Проверка статуса",[88,301,303],{"className":90,"code":302,"language":92,"meta":93,"style":93},"fail2ban-client status sshd\n",[53,304,305],{"__ignoreMap":93},[97,306,307,310,313],{"class":99,"line":100},[97,308,309],{"class":103},"fail2ban-client",[97,311,312],{"class":107}," status",[97,314,315],{"class":107}," sshd\n",[10,317,318],{},"Вывод покажет количество заблокированных IP и текущий список.",[80,320,322],{"id":321},"_5-разблокировать-ip-вручную","5. Разблокировать IP вручную",[10,324,325],{},"Если заблокировали себя или нужного пользователя:",[88,327,329],{"className":90,"code":328,"language":92,"meta":93,"style":93},"fail2ban-client set sshd unbanip 1.2.3.4\n",[53,330,331],{"__ignoreMap":93},[97,332,333,335,338,341,344],{"class":99,"line":100},[97,334,309],{"class":103},[97,336,337],{"class":107}," set",[97,339,340],{"class":107}," sshd",[97,342,343],{"class":107}," unbanip",[97,345,347],{"class":346},"sbssI"," 1.2.3.4\n",[31,349,351],{"id":350},"проверка-результата","Проверка результата",[88,353,354],{"className":90,"code":302,"language":92,"meta":93,"style":93},[53,355,356],{"__ignoreMap":93},[97,357,358,360,362],{"class":99,"line":100},[97,359,309],{"class":103},[97,361,312],{"class":107},[97,363,315],{"class":107},[10,365,366],{},"В выводе должно быть:",[88,368,373],{"className":369,"code":371,"language":372},[370],"language-text","Status for the jail: sshd\n|- Filter\n|  |- Currently failed: 0\n|  |- Total failed:     0\n|  `- File list:        /var/log/auth.log\n`- Actions\n   |- Currently banned: 0\n   |- Total banned:     0\n   `- Banned IP list:\n","text",[53,374,371],{"__ignoreMap":93},[10,376,377,378,381,382,385],{},"Служба работает, если ",[53,379,380],{},"Currently failed"," и ",[53,383,384],{},"Total banned"," присутствуют в выводе.",[31,387,389],{"id":388},"возможные-ошибки","Возможные ошибки",[10,391,392,395,396,399],{},[13,393,394],{},"«Failed to start fail2ban»"," — скорее всего ошибка синтаксиса в ",[53,397,398],{},"jail.local",". Проверьте конфигурацию:",[88,401,403],{"className":90,"code":402,"language":92,"meta":93,"style":93},"fail2ban-client -t\n",[53,404,405],{"__ignoreMap":93},[97,406,407,409],{"class":99,"line":100},[97,408,309],{"class":103},[97,410,411],{"class":107}," -t\n",[10,413,414,417],{},[13,415,416],{},"Заблокировали сами себя"," — откройте VNC-консоль в панели VMmanager и выполните:",[88,419,421],{"className":90,"code":420,"language":92,"meta":93,"style":93},"fail2ban-client set sshd unbanip ВАШ_IP\n",[53,422,423],{"__ignoreMap":93},[97,424,425,427,429,431,433],{"class":99,"line":100},[97,426,309],{"class":103},[97,428,337],{"class":107},[97,430,340],{"class":107},[97,432,343],{"class":107},[97,434,435],{"class":107}," ВАШ_IP\n",[10,437,438,439,442],{},"Или временно отключите Fail2Ban: ",[53,440,441],{},"systemctl stop fail2ban",".",[10,444,445,448,449,452],{},[13,446,447],{},"Fail2Ban не реагирует на попытки входа"," — проверьте, что ",[53,450,451],{},"logpath"," указывает на существующий файл. На разных дистрибутивах путь к логу может отличаться.",[10,454,455,458,459,462,463,442],{},[13,456,457],{},"«ERROR  No file(s) found for glob»"," — файл лога не существует или указан неверный путь. Найдите нужный лог: ",[53,460,461],{},"journalctl -u ssh"," или ",[53,464,465],{},"ls /var/log/auth*",[31,467,469],{"id":468},"faq","FAQ",[10,471,472,475,476,478,479,482,483,442],{},[13,473,474],{},"Можно ли защитить Nginx от перебора?","\nДа. Добавьте в ",[53,477,398],{}," секцию ",[53,480,481],{},"[nginx-http-auth]"," — фильтр уже встроен в Fail2Ban. Путь к логу: ",[53,484,485],{},"/var/log/nginx/error.log",[10,487,488],{},[13,489,490],{},"Как посмотреть все активные «тюрьмы»?",[88,492,494],{"className":90,"code":493,"language":92,"meta":93,"style":93},"fail2ban-client status\n",[53,495,496],{"__ignoreMap":93},[97,497,498,500],{"class":99,"line":100},[97,499,309],{"class":103},[97,501,502],{"class":107}," status\n",[10,504,505,508,509,512,513,516],{},[13,506,507],{},"Как увеличить время блокировки?","\nИзмените ",[53,510,511],{},"bantime",". Значение ",[53,514,515],{},"-1"," блокирует навсегда.",[10,518,519,522,523,525,526,442],{},[13,520,521],{},"Fail2Ban и UFW — они конфликтуют?","\nНет. Fail2Ban может управлять правилами UFW. Для этого добавьте в ",[53,524,398],{}," параметр ",[53,527,528],{},"banaction = ufw",[31,530,532],{"id":531},"полезные-ссылки","Полезные ссылки",[43,534,535,541,547],{},[46,536,537,540],{},[53,538,539],{},"/etc/fail2ban/filter.d/"," — встроенные фильтры для разных служб",[46,542,543,546],{},[53,544,545],{},"fail2ban-client --help"," — справка по командам клиента",[46,548,549,552],{},[53,550,551],{},"/var/log/fail2ban.log"," — собственный лог Fail2Ban",[31,554,556],{"id":555},"следующие-статьи","Следующие статьи",[43,558,559,566],{},[46,560,561],{},[562,563,565],"a",{"href":564},"/wiki/security/ssh-hardening","Защита SSH",[46,567,568],{},[562,569,571],{"href":570},"/wiki/security/ufw","Настройка UFW",[573,574,575],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}",{"title":93,"searchDepth":192,"depth":192,"links":577},[578,579,580,581,588,589,590,591,592],{"id":33,"depth":192,"text":34},{"id":40,"depth":192,"text":41},{"id":65,"depth":192,"text":66},{"id":77,"depth":192,"text":78,"children":582},[583,584,585,586,587],{"id":82,"depth":198,"text":83},{"id":157,"depth":198,"text":158},{"id":280,"depth":198,"text":281},{"id":298,"depth":198,"text":299},{"id":321,"depth":198,"text":322},{"id":350,"depth":192,"text":351},{"id":388,"depth":192,"text":389},{"id":468,"depth":192,"text":469},{"id":531,"depth":192,"text":532},{"id":555,"depth":192,"text":556},"Как установить и настроить Fail2Ban для блокировки подбора паролей.","md",{},true,"/wiki/security/fail2ban","Безопасность",{"title":5,"description":593},"wiki/security/fail2ban","l3fWG0Gpx_G3-uXNyV6kb5s9cUJLdeFjkDPNxHO_ydI",1788285515569]