对一分钟内超过10个404资源的IP拉黑

安装fail2ban防护软件：

sudo apt install fail2ban

 

增加二个配置文件：

1.创建nginx日志过滤器，分析次数：

/etc/fail2ban/filter.d/nginx-404.conf 内容如下：
[Definition]
failregex = ^<HOST> - .* "(GET|POST|HEAD) .* HTTP/[0-9.]+" 404
ignoreregex =




2.创建fail2ban监控任务：/etc/fail2ban/jail.d/nginx-attack.conf
参数说明：
  • maxretry = 10：60 秒内产生 10 个 404 就封禁（正常用户偶尔点错链接不会触发）
  • bantime = 86400：封禁 1 天；攻击 IP 用 bantime = 604800 封 7 天
  • logpath = /var/log/nginx/access.log 是nginxd的默认日志路径
  • port=http,https,8000 是需要监控的端口号
  • action = 后面的port是封禁后，违规IP禁止访问的端口号，封全部直接写成 action = iptables-allports[name=nginx-404]
 
[nginx-404]
enabled  = true
port     = http,https,8000
filter   = nginx-404
backend = auto
logpath  = /var/log/nginx/access.log
maxretry = 10
findtime = 60
bantime  = 86400
action   = iptables-multiport[name=nginx-404, port="http,https,8000,22"]



新建/etc/fail2ban/jail.d/nginx-badrequest.conf
[nginx-badrequest]
enabled  = true
port     = http,https,8000
filter   = nginx-bad-request
backend  = auto
logpath  = /var/log/nginx/access.log
maxretry = 2
findtime = 120
bantime  = 6048000

 



3.更新完上3个文件后，重启fail2ban

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

 

 

 

其他常用命令：

# 查看监控状态

sudo fail2ban-client status

# 查看封禁状态
sudo fail2ban-client status nginx-404

# 手动解封/封禁测试
sudo fail2ban-client set nginx-404 banip 35.240.243.217
sudo fail2ban-client set nginx-404 unbanip 35.240.243.217