Fail2ban
1.安装

 # 1. 安装 
fail2ban echo "Installing fail2ban..." 
sudo apt update sudo apt install -y fail2ban
 

2 配置文件

sudo tee /etc/fail2ban/jail.local > /dev/null <<'EOF' 
[DEFAULT] 
# 封禁时长：-1 = 永久 
bantime  = -1 
# 检测窗口：600 秒 = 10 分钟 
findtime = 600 
# 窗口内失败次数触发封禁 
maxretry = 3 
# 从 systemd journal 
读取日志（Debian 12 推荐） 
backend  = systemd 
# 封禁动作：iptables-multiport（默认） 
banaction = iptables-multiport 
loglevel = INFO  
[sshd] enabled  = true 
port     = ssh 
filter   = sshd 
# 使用 systemd backend 时不需要 logpath 
EOF  
sudo systemctl restart fail2ban sleep 3 && sudo fail2ban-client status sshd 

方案B配置文件

 
 [DEFAULT] 
bantime  = -1 
findtime = 600 
maxretry = 3 
backend  = auto 
banaction = iptables-multiport 
loglevel = INFO  
[sshd] 
enabled  = true 
port     = ssh 
filter   = sshd 
logpath  = /var/log/auth.log 

# 查看被封禁的 IP

sudo fail2ban-client status sshd  

# 手动解封某个误封的 IP

sudo fail2ban-client set sshd unbanip <IP地址>  

# 手动封禁某个 IP

sudo fail2ban-client set sshd banip <IP地址>  

# 查看 fail2ban 日志

sudo tail -f /var/log/fail2ban.log