fail2ban-client

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Fail2ban reads log files or the journal with filters (regex for "Failed password", "authentication failure", 401 responses …). When an IP has too many failures (maxretry) in a time window (findtime), a jail runs an action: on RHEL it adds a firewalld rich rule or ipset for bantime. Jails exist for sshd, nginx, postfix, dovecot, WordPress and more.

It is a simple, strong layer for any server with SSH or a login page on the internet (install from EPEL).

طريقة الكتابة

fail2ban-client [status [JAIL]] [set JAIL banip|unbanip IP] [reload]

الأجزاء الرئيسية

Commands

status: List active jails.
status JAIL: Failures and banned IPs of one jail.
set JAIL banip IP: Ban an IP by hand.
set JAIL unbanip IP: Remove a ban.
unban --all: Remove all bans.
reload [JAIL]: Reload the config.
get JAIL bantime|maxretry|findtime: Read settings.
banned: Show all banned IPs.

الخيارات 8

الأكثر استخدامًا

jail.local settings

enabled = true: Turn the jail on.
maxretry = 5: Failures before a ban.
findtime = 10m: Time window for failures.
bantime = 1h: How long the ban lasts.
bantime.increment = true: Longer bans for repeat offenders.
ignoreip = …: Never ban these (your office / VPN).
backend = systemd: Read the journal instead of files.
banaction = firewallcmd-rich-rules: How to ban on RHEL.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Install on RHEL

#dnf install -y epel-release && dnf install -y fail2ban fail2ban-firewalld
#systemctl enable --now fail2ban

2Protect SSH

#cat /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
bantime.increment = true
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 10.20.0.0/16
banaction = firewallcmd-rich-rules
[sshd]
enabled = true
backend = systemd
#fail2ban-client reload

3See what it does

#fail2ban-client status
#fail2ban-client status sshd

4Unban a user who locked himself out

#fail2ban-client set sshd unbanip 203.0.113.25

5Ban an IP by hand

#fail2ban-client set sshd banip 198.51.100.77

6Protect an nginx login page

#cat /etc/fail2ban/jail.d/nginx.local
[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/error.log

7Test a filter against a log

#fail2ban-regex /var/log/nginx/error.log /etc/fail2ban/filter.d/nginx-http-auth.conf

8See the firewall rules it made
```
#firewall-cmd --list-rich-rules
```

9Read its log

#tail -f /var/log/fail2ban.log
#grep "Ban " /var/log/fail2ban.log | awk '{print $NF}' | sort | uniq -c | sort -rn | head

10Check settings of a jail

#fail2ban-client get sshd bantime
#fail2ban-client get sshd maxretry

انتبه

Edit jail.local / jail.d/*.local, never jail.conf (updates overwrite it).
Put your own admin IPs in ignoreip, or you can ban yourself.
Fail2ban does not replace key-only SSH login; it only slows attackers.

الملفات

/etc/fail2ban/jail.local: Your settings.
/etc/fail2ban/jail.d/: More jail files.
/etc/fail2ban/filter.d/: Filters (regex).
/var/log/fail2ban.log: Log.

نصائح للحفظ

Behind a load balancer or CDN, ban on the real client IP (from the X-Forwarded-For log field), not the proxy IP.

رموز الخروج

`0`	Success.
`255`	Error (server not running, unknown jail).

`fail2ban-client`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Commands

الخيارات 8

jail.local settings

أمثلة 10

1Install on RHEL

2Protect SSH

3See what it does

4Unban a user who locked himself out

5Ban an IP by hand

6Protect an nginx login page

7Test a filter against a log

8See the firewall rules it made

9Read its log

10Check settings of a jail

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Commands

الخيارات 8

jail.local settings

أمثلة 10

1Install on RHEL

2Protect SSH

3See what it does

4Unban a user who locked himself out

5Ban an IP by hand

6Protect an nginx login page

7Test a filter against a log

8See the firewall rules it made

9Read its log

10Check settings of a jail

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`fail2ban-client`