使用fail2ban封禁visionheight\.com/scan|CensysInspect|Infrawatch|nikto|sqlmap|nmap扫描

一、安装fail2ban

yum install --nobest fail2ban-server fail2ban

二、配置fail2ban

2.1配置filter规则

/etc/fail2ban/filter.d目录新建规则nginx-scan.conf

[Definition]
failregex = ^<HOST> - - \[.*\] "(GET|POST) /[^"]*" (403|404) \d+ "-" ".*(visionheight\.com/scan|CensysInspect|Infrawatch|nikto|sqlmap).*"
ignoreregex =

2.2配置jail

/etc/fail2ban/jail.d目录新建监狱jail.local

[nginx-scan]
enabled = true
port    = http,https
filter  = nginx-scan
logpath = /www/wwwlogs/access.log   
maxretry = 10
bantime = 86400                
findtime = 300
action  = iptables-multiport[name=nginx, port="80,443", protocol=tcp]

三、启动fail2ban服务和测试

systemctl start fail2ban

systemctl enable fail2ban

systemctl status fail2ban

检查fail2ban服务启动是否正常，如果为退出状态检查nginx访问日志和过滤规则是否能匹配日志，退出状态大部分为过滤规则问题。

以下为正常运行状态：

systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled)
   Active: active (running) since Sat 2026-07-04 15:21:15 CST; 24min ago
     Docs: man:fail2ban(1)
  Process: 202893 ExecStop=/usr/bin/fail2ban-client stop (code=exited, status=0/SUCCESS)
  Process: 202895 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, status=0/SUCCESS)
 Main PID: 202897 (f2b/server)
    Tasks: 3 (limit: 22976)
   Memory: 10.8M
   CGroup: /system.slice/fail2ban.service
           └─202897 /usr/bin/python3.6 -s /usr/bin/fail2ban-server -xf start

Jul 04 15:21:15 iZ2zehritkw7wcjda4z16wZ systemd[1]: Starting Fail2Ban Service...
Jul 04 15:21:15 iZ2zehritkw7wcjda4z16wZ systemd[1]: Started Fail2Ban Service.
Jul 04 15:21:15 iZ2zehritkw7wcjda4z16wZ fail2ban-server[202897]: Server ready

实际效果：

原来CPU被拉爆。