1.fail2ban安装

yum install fail2ban

2.创建配置文件

vim /etc/fail2ban/jail.local

[DEFAULT]
# 以空格分隔的列表，可以是 IP 地址、CIDR 前缀或者 DNS 主机名
# 用于指定哪些地址可以忽略 fail2ban 防御
ignoreip = 127.0.0.1 172.31.0.0/24 10.10.0.0/24 192.168.0.0/24

# 客户端主机被禁止的时长（秒）
bantime = 86400

# 客户端主机被禁止前允许失败的次数 
maxretry = 5

# 查找失败次数的时长（秒）
findtime = 600

mta = sendmail

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH, dest=your@email.com, sender=fail2ban@email.com]
# Debian 系的发行版 
logpath = /var/log/auth.log
# Red Hat 系的发行版
logpath = /var/log/secure
# ssh 服务的最大尝试次数 
maxretry = 3

3.重启fail2ban

service fail2ban restart
systemctl restart fail2ban

4.检验是否运行

fail2ban-client ping

若运行则返回:Server replied: pong 5.查看日志

cat /var/log/fail2ban.log

6.查看fail2ban状态

fail2ban-client status
fail2ban-client status ssh-iptables

7.解锁特定ip

fail2ban-client set ssh-iptables unbanip 192.168.1.8

8.设置开机自启

chkconfig fail2ban on
systemctl enable fail2ban