How to Install and Configure Fail2ban on Ubuntu 20.04

Any service that is exposed to the Internet is at risk of malware attacks. For example, if you are running a service on a publicly available network, attackers can use brute-force attempts to sign in to your account.

Fail2ban is a tool that helps protect your Linux machine from brute-force and other automated attacks by monitoring the services logs for malicious activity. It uses regular expressions to scan log files. All entries matching the patterns are counted, and when their number reaches a certain predefined threshold, Fail2ban bans the offending IP using the system firewall for a specific length of time. When the ban period expires, the IP address is removed from the ban list.

This article describes how to install and configure Fail2ban on Ubuntu 20.04. 

低于 ubuntu 20.04 的系统,可以参考 ubuntu 16.04防止SSH暴力登录攻击 。

Installing Fail2ban on Ubuntu

The Fail2ban package is included in the default Ubuntu 20.04 repositories. To install it, enter the following command as root or user with sudo privileges :

Once the installation is completed, the Fail2ban service will start automatically. You can verify it by checking the status of the service:

The output will look like this:

That’s it. At this point, you have Fail2Ban running on your Ubuntu server.

Fail2ban Configuration

The default Fail2ban installation comes with two configuration files, /etc/fail2ban/jail.conf and /etc/fail2ban/jail.d/defaults-debian.conf. It is not recommended to modify these files as they may be overwritten when the package is updated.

Fail2ban reads the configuration files in the following order. Each .local file overrides the settings from the .conf file:

  • /etc/fail2ban/jail.conf
  • /etc/fail2ban/jail.d/*.conf
  • /etc/fail2ban/jail.local
  • /etc/fail2ban/jail.d/*.local

For most users, the easiest way to configure Fail2ban is to copy the jail.conf to jail.local and modify the .local file. More advanced users can build a .localconfiguration file from scratch. The .local file doesn’t have to include all settings from the corresponding .conf file, only those you want to override.

Create a .local configuration file from the default jail.conf file:

To start configuring the Fail2ban server open, the jail.local file with your text editor :

The file includes comments describing what each configuration option does. In this example, we’ll change the basic settings.

Whitelist IP Addresses

IP addresses, IP ranges, or hosts that you want to exclude from banning can be added to the ignoreip directive. Here you should add your local PC IP address and all other machines that you want to whitelist.

Uncomment the line starting with ignoreip and add your IP addresses separated by space:

/etc/fail2ban/jail.local

Ban Settings

The values of bantime, findtime, and maxretry options define the ban time and ban conditions.

bantime is the duration for which the IP is banned. When no suffix is specified, it defaults to seconds. By default, the bantime value is set to 10 minutes. Generally, most users will want to set a longer ban time. Change the value to your liking:

/etc/fail2ban/jail.local

To permanently ban the IP use a negative number.

findtime is the duration between the number of failures before a ban is set. For example, if Fail2ban is set to ban an IP after five failures (maxretry, see below), those failures must occur within the findtime duration.

/etc/fail2ban/jail.local

maxretry is the number of failures before an IP is banned. The default value is set to five, which should be fine for most users.

/etc/fail2ban/jail.local

Email Notifications

Fail2ban can send email alerts when an IP has been banned. To receive emails, you need to have an SMTP installed on your server and change the default action, which only bans the IP to %(action_mw)s, as shown below:

/etc/fail2ban/jail.local

%(action_mw)s bans the offending IP and sends an email with a whois report. If you want to include the relevant logs in the email, set the action to %(action_mwl)s.

You can also adjust the sending and receiving email addresses:

/etc/fail2ban/jail.local

Fail2ban Jails

Fail2ban uses a concept of jails. A jail describes a service and includes filters and actions. Log entries matching the search pattern are counted, and when a predefined condition is met, the corresponding actions are executed.

Fail2ban ships with a number of jail for different services. You can also create your own jail configurations.

By default, only the ssh jail is enabled. To enable a jail, you need to add enabled = true after the jail title. The following example shows how to enable the proftpd jail:

/etc/fail2ban/jail.local

The settings we discussed in the previous section, can be set per jail. Here is an example:

/etc/fail2ban/jail.local

The filters are located in the /etc/fail2ban/filter.d directory, stored in a file with same name as the jail. If you have custom setup and experience with regular expressions you can fine tune the filters.

Each time you edit a configuration file, you need to restart the Fail2ban service for changes to take effect:

Fail2ban Client

Fail2ban ships with a command-line tool named fail2ban-client that you can use to interact with the Fail2ban service.

To view all available options, invoke the command with the -h option:

This tool can be used to ban/unban IP addresses, change settings, restart the service, and more. Here are a few examples:

  • Check the jail status:

  • Unban an IP:

  • Ban an IP:

Conclusion

We’ve shown you how to install and configure Fail2ban on Ubuntu 20.04.

For more information on this topic, visit the Fail2ban documentation .

If you have questions, feel free to leave a comment below.

注意:如果服务器上启用了 UFW 防火墙,则几乎必然出现 Fail2ban 无法阻止攻击者 IP 的情况。

尽管 Fail2ban 已经提示阻止用户访问。但是由于 iptables 的顺序问题,根本不起作用,依旧在 /var/log/auth.log 中观察到不断的访问尝试。

解决方法如下:

更改为

防火墙规则要求通过 UFW 进行设置。

重新载修改后的配置信息

默认情况下,执行如下命令后:

UFW 服务器应该随着服务器重启自动启动,但是却经常没有启动,尤其是 ubuntu 20.04

参考 Fix ufw service not loading after a reboot 调整。

默认情况下,Fail2ban的配置是没办法阻止用户名尝试的,因此,我们需要新增如下配置才能解决问题。

First, define the filter for invalid users in /etc/fail2ban/filter.d/sshd-invaliduser.conf:

Then enable it in /etc/fail2ban/jail.local:

默认情况下,Fail2ban的配置是没办法阻止root登陆尝试的,因此,我们需要新增如下配置才能解决问题。

Then enable it in /etc/fail2ban/jail.local:

参考链接


Magisk

Root —— 玩家与厂商间的博弈

Android 从诞生之日起就高举着开源的大旗,这也是它成功的原因之一。而它的开放性也成功的吸引到了一大批爱折腾的人,从而诞生出了 root(此处特制 Android 中的 root)。

根据 Wikipedia 的释义,root 指的是使用户取得 Android 操作系统的超级用户(Super User)许可权的技术。用户通过 root,可以越过手机制造商的限制,卸载手机制造商预装在手机中某些应用,以及运行一些需要超级用户权限的应用程序。同时,root 也可能会让手机变得“不安全”(并不是说 root 使手机变得不安全,而是一些用户的使用习惯会使 root 后的手机变得危险)。

但是从棉花糖(Android 6.0)开始,Google 基本阻止了以前版本中最流行的 root 方法 —— 即,将 su守护程序 放置到 /system 分区,并在启动时取得所需的权限。道高一尺,魔高一丈,于是就出现了 systemless 的 root 方式,因为它不采取任何方式修改 /system 分区。

出于增加安全性的考虑,Google 推出了 SafetyNet 这样的检测,以确保 Android Pay 等一些 App 的安全运行,玩家不得不在 root 权限和一些有价值的 App 之间作出选择。

这个时候 Magisk 诞生了。

Magisk

什么是 Magisk

Magisk 是出自一位台湾学生 @topjohnwu 开发的 Android 框架,是一个通用的第三方 systemless 接口,通过这样的方式实现一些较强大的功能。

看似很简单的一个框架,甚至与大名鼎鼎的 Xposed 框架在功能性上有点重复。很多人批评 Magisk的模块太少了,想替代 Xposed 根本不可能(在那个 Xposed Framework for Android 7.0 难产的时代,很多人将 Magisk 看是做是 Xposed 的替代品)。这是不正确的,因为 Magisk 从来没有想过要代替 Xposed ,Magisk 与 Xposed 是可以互相兼容的,你甚至可以通过 Magisk 来安装 Xposed(安装 Xposed 后就不能绕过 SafetyNet 了)。

Magisk 的厉害之处在于它实现了一种绕过 SafetyNet 使用 root 的方法。

实现原理:由于它是通过启动时在 boot 中创建钩子,把 /data/magisk.img 挂载到 /magisk,构建出一个在 system 基础上能够自定义替换,增加以及删除的文件系统,所有操作都在启动的时候完成,实际上并没有对 /system 分区进行修改(即 systemless 接口,以不触动 /system 的方式修改 /system)。

功能

截至目前版本(v14.0),Magisk 可以实现的功能包括:

  • 集成 root(MagiskSU)
  • root 和 Magisk 的日志功能
  • Magisk Hide(隐藏 Magisk 的 root 权限,针对 Snapchat、Android Pay、PokémonGo、Netflix 等)
  • 为广告屏蔽应用提供 systemless hosts 支持
  • 通过 SafetyNet 检查
  • Magisk 功能模块

支持的版本:Android 5.0+

安装方法

安装 Magisk 需要解锁 Bootloader 并刷入第三方 Recovery。所以每个品牌的手机都或多或少的有点不一样,这里只介绍一个标准的流程,具体操作方法请自行 Google(只需要 Google 你使用的手机解锁 Bootloader 和刷入第三方 Recovery 的方法就可以了,其他的安我说的做)。

  1. 解锁手机 Bootloader(BL)
    方法:自行 Google
  2. 刷入第三方 Recovery(例如 TWRP)
    方法:自行 Google
  3. 下载官方 Magisk 包,然后通过第三方 Recovery 刷入
    方法:首先将下好的包放入手机的硬盘中(你可以使用 QQ数据线 也可以使用 XX手机助手,whatever)然后,进入第三方 Recovery(以 twrp 为例),安装刷机包 -> 找到我让你放在硬盘中的那个包(后缀为 .zip)-> 滑动滑块,开始刷机 -> 刷好后立即重启
  4. 享受完整 Magisk 的 systemless root 和神奇的 Magisk 模块
    重启后找到一个名为 Magisk Manager(图标是一个面具,绿色背景),这是 Magisk 的管理程序,你可以在这里下载、安装、升级、卸载你的 Magisk 和 Magisk 模块。
  5. 卸载 Magisk
    卸载 Magisk 有两种方法:在 Magisk Manager 中卸载,或者通过第三方 Recovery 刷入卸载包卸载。通过 Magisk Manager 卸载很好理解,通过第三方 Recovery 卸载的意思是刷一个名为 Magisk-uninstaller.zip 的刷机包,方法和刷 Magisk 一样。两种方法我都没试过。
一些推荐的功能模块

App Systemizer

这是一个能把用户 App 挂载为系统 App 的模块,如 Google Play 服务、绿色守护、蟒蛇音效等。

Magisk SELinux Permissive Script

使 Android 的 SELinux 默认以 Permissive 运行,关于 SELinux 模式的介绍,请点击这里

ViPER4Android FX

大名鼎鼎的蝰蛇音效的 Magisk 模块,需要配合 VIPERFX 的管理器使用,请在 XDA 论坛搜索下载。关于ViPER4Android

Xposed

强大的 Xposed 框架的 systemless 实现,关于 Xposed 的介绍点击这里

待续...

一些资源

如果你不知道这么找 Magisk 或者 VIPERFX。我这里提供了一些资源。不能保证是最新的。

  • Magisk_v17.1.zip

    Magisk 卡刷包,版本:17.1

  • VIPERFX

    ViPER4Android FX 的管理程器,版本:2.5.0.5

  • ViPER4Android_full.zip

    我收集的蝰蛇音效的音效配置、脉冲反馈 和 DDC。完整版,质量良莠不齐

  • ViPER4Android.zip

    还是音效配置、脉冲反馈 和 DDC。但这是我精选过的版本,也是目前再用的版本

参考链接