a8abed6b5b
- 添加速率限制中间件，防止API滥用和DDoS攻击 - 添加可疑请求检测，基于行为模式识别攻击 - 添加输入清理和验证，防止命令注入和XSS攻击 - 更新middleware.ts，集成所有安全功能 - 添加fail2ban安装脚本，防止SSH暴力破解 - 不依赖IP黑名单，适用于所有攻击者 安全功能： - API速率限制：每分钟100次请求 - 认证速率限制：每分钟5次请求 - 自动检测可疑请求模式 - 输入清理和验证 - 详细的安全日志记录
121 lines
2.9 KiB
Bash
Executable File
121 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# 安装和配置fail2ban脚本
|
||
# 用于防止SSH暴力破解攻击
|
||
|
||
set -e
|
||
|
||
echo "=================================================================================="
|
||
echo "🛡️ 安装和配置 fail2ban - SSH暴力破解防护"
|
||
echo "=================================================================================="
|
||
|
||
# 检测操作系统
|
||
if [ -f /etc/redhat-release ]; then
|
||
OS="centos"
|
||
PKG_MANAGER="dnf"
|
||
elif [ -f /etc/debian_version ]; then
|
||
OS="debian"
|
||
PKG_MANAGER="apt-get"
|
||
else
|
||
echo "❌ 不支持的操作系统"
|
||
exit 1
|
||
fi
|
||
|
||
echo "检测到操作系统: $OS"
|
||
|
||
# 安装fail2ban
|
||
echo ""
|
||
echo "📦 安装 fail2ban..."
|
||
if [ "$OS" = "centos" ]; then
|
||
dnf install -y epel-release || true
|
||
dnf install -y fail2ban fail2ban-systemd
|
||
elif [ "$OS" = "debian" ]; then
|
||
apt-get update
|
||
apt-get install -y fail2ban
|
||
fi
|
||
|
||
# 创建本地配置文件
|
||
echo ""
|
||
echo "⚙️ 配置 fail2ban..."
|
||
|
||
# 备份原始配置
|
||
if [ -f /etc/fail2ban/jail.local ]; then
|
||
cp /etc/fail2ban/jail.local /etc/fail2ban/jail.local.bak.$(date +%Y%m%d_%H%M%S)
|
||
fi
|
||
|
||
# 创建jail.local配置文件
|
||
cat > /etc/fail2ban/jail.local << 'EOF'
|
||
[DEFAULT]
|
||
# 禁止时间（秒）：1小时 = 3600秒
|
||
bantime = 3600
|
||
|
||
# 查找时间窗口（秒）：10分钟
|
||
findtime = 600
|
||
|
||
# 最大失败次数
|
||
maxretry = 5
|
||
|
||
# 忽略的IP地址（本地网络）
|
||
ignoreip = 127.0.0.1/8 ::1
|
||
|
||
# 邮件通知（可选）
|
||
# destemail = admin@example.com
|
||
# sendername = Fail2Ban
|
||
# mta = sendmail
|
||
|
||
[sshd]
|
||
enabled = true
|
||
port = ssh
|
||
logpath = %(sshd_log)s
|
||
backend = %(sshd_backend)s
|
||
maxretry = 5
|
||
bantime = 3600
|
||
findtime = 600
|
||
|
||
# 如果使用systemd日志
|
||
[sshd-systemd]
|
||
enabled = true
|
||
port = ssh
|
||
backend = systemd
|
||
maxretry = 5
|
||
bantime = 3600
|
||
findtime = 600
|
||
EOF
|
||
|
||
# 启动并启用fail2ban服务
|
||
echo ""
|
||
echo "🚀 启动 fail2ban 服务..."
|
||
systemctl enable fail2ban
|
||
systemctl restart fail2ban
|
||
|
||
# 检查服务状态
|
||
if systemctl is-active --quiet fail2ban; then
|
||
echo "✅ fail2ban 服务已启动"
|
||
else
|
||
echo "❌ fail2ban 服务启动失败"
|
||
exit 1
|
||
fi
|
||
|
||
# 显示当前状态
|
||
echo ""
|
||
echo "📊 fail2ban 状态："
|
||
fail2ban-client status
|
||
|
||
echo ""
|
||
echo "📊 SSH jail 状态："
|
||
fail2ban-client status sshd 2>/dev/null || fail2ban-client status sshd-systemd 2>/dev/null || echo "SSH jail 尚未激活"
|
||
|
||
echo ""
|
||
echo "=================================================================================="
|
||
echo "✅ fail2ban 安装和配置完成！"
|
||
echo "=================================================================================="
|
||
echo ""
|
||
echo "📋 常用命令："
|
||
echo " - 查看状态: fail2ban-client status"
|
||
echo " - 查看SSH jail: fail2ban-client status sshd"
|
||
echo " - 手动封禁IP: fail2ban-client set sshd banip <IP地址>"
|
||
echo " - 手动解封IP: fail2ban-client set sshd unbanip <IP地址>"
|
||
echo " - 查看日志: tail -f /var/log/fail2ban.log"
|
||
echo "=================================================================================="
|
||
|