{"id":7574,"date":"2022-04-22T14:44:24","date_gmt":"2022-04-22T21:44:24","guid":{"rendered":"https:\/\/www.xh86.me\/?p=7574"},"modified":"2022-04-22T14:44:24","modified_gmt":"2022-04-22T21:44:24","slug":"linux%e9%98%b2%e6%9a%b4%e5%8a%9b%e7%a0%b4%e8%a7%a3%e5%b7%a5%e5%85%b7fail2ban%e7%9a%84%e6%97%a5%e5%bf%97%e6%8e%a5%e5%85%a5%e5%88%b0graylog%e5%b9%b6%e5%ae%9e%e7%8e%b0geoip%e5%b1%95%e7%a4%ba","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=7574","title":{"rendered":"Linux\u9632\u66b4\u529b\u7834\u89e3\u5de5\u5177Fail2ban\u7684\u65e5\u5fd7\u63a5\u5165\u5230GrayLog\u5e76\u5b9e\u73b0GeoIP\u5c55\u793a"},"content":{"rendered":"
\n

\u5728GrayLog\u7684marketplace\u4e0a\u6709\u641c\u5230\u5173\u4e8eFail2ban\u65e5\u5fd7Grok\u4ee5\u53caPipeline\u7684\u5957\u4ef6\u5305<\/span><\/p>\n

\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u6700\u540e\u53ef\u4ee5\u5b9e\u73b0\u5982\u4e0b\u6548\u679c<\/p>\n

<\/div><\/p>\n

(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n

\u7ed3\u5408\u6211\u4e4b\u524d\u5199\u7684\u6587\u7ae0(\u70b9\u51fb\u94fe\u63a5\u67e5\u770b\u539f\u6587\u7ae0<\/span>)<\/p>\n

1\u3001<\/span>CentOS7\u4e91\u4e3b\u673a\u90e8\u7f72Fail2ban\u963b\u65adSSH\u66b4\u529b\u7834\u89e3<\/a>\r\n2\u3001\u5f00\u6e90\u65e5\u5fd7\u7ba1\u7406\u7cfb\u7edfGraylog\u4e4bSidecar\u529f\u80fd\u5b9e\u8df5<\/a>\r\n<\/code><\/pre>\n
\u51b3\u5b9a\u8fdb\u884c\u5c1d\u8bd5\u5b9e\u8df5\u4e00\u4e0b<\/p>\n
\u73af\u5883\u5982\u4e0b<\/p>\n
1\u3001CentOS7 webserver 192.168.31.211\u4f5c\u4e3a\u65e5\u5fd7\u6e90\uff0c\u5b89\u88c5fail2ban+graylog-sidecar+filebeat<\/p>\n
2\u3001GraylogServer 192.168.31.127\u5bfc\u5165Fail2ban\u7684ContentPack<\/p>\n
\u5177\u4f53\u6b65\u9aa4\u5982\u4e0b:<\/p>\n
\u4e00\u3001\u5b89\u88c5\u5e76\u914d\u7f6efailban<\/span><\/h2>\n
curl\u00a0-o\u00a0\/etc\/yum.repos.d\/epel.repo\u00a0http:\/\/mirrors.aliyun.com\/repo\/epel-7.repo\r\nyum\u00a0install\u00a0fail2ban\u00a0-y\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
cd<\/span>\u00a0\/etc\/fail2ban\/\r\ncp\u00a0fail2ban.conf\u00a0fail2ban.local\r\ncp\u00a0jail.conf\u00a0jail.local\r\nvim\u00a0jail.local\u00a0\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u4fee\u6539\u5982\u4e0b\u51e0\u4e2a\u5730\u65b9<\/p>\n
ignoreip\u00a0=\u00a0127.0.0.1\/8\u00a0::1\r\nbantime\u00a0\u00a0=\u00a0300\r\nfindtime\u00a0\u00a0=\u00a0300\r\nmaxretry\u00a0=\u00a08\r\n<\/code><\/pre>\n
[sshd]\u914d\u7f6e\u5904\u6dfb\u52a0\u5982\u4e0b\u4e00\u884c<\/p>\n
enabled = true<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u542f\u52a8fail2ban\u670d\u52a1<\/p>\n
systemctl\u00a0start\u00a0fail2ban.service\u00a0\r\nsystemctl\u00a0enable<\/span>\u00a0fail2ban.service\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u67e5\u770b\u65e5\u5fd7\uff0c\u5e76\u89e6\u53d1ssh\u66b4\u529b\u7834\u89e3\u767b\u5f55\u65e5\u5fd7<\/p>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
tail\u00a0-f\u00a0\/var\/log<\/span>\/fail2ban.log\u00a0\r\nfail2ban-client\u00a0status\r\nfail2ban-client\u00a0status\u00a0sshd\r\n<\/code><\/pre>\n
<\/div><\/p>\n
(\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
\u4e8c\u3001\u5b89\u88c5sidecar+filebeat<\/span><\/h2>\n
    \n
  • \n
    1\u3001graylog-sidecar\u5b89\u88c5<\/section>\n<\/li>\n<\/ul>\n
    rpm\u00a0-Uvh\u00a0https:\/\/packages.graylog2.org\/repo\/packages\/graylog-sidecar-repository-1-2.noarch.rpm\r\nyum\u00a0install\u00a0graylog-sidecar\u00a0-y\r\n<\/code><\/pre>\n
    <\/div><\/p>\n
    (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
      \n
    • \n
      2\u3001filebeat\u5b89\u88c5<\/section>\n<\/li>\n<\/ul>\n
      curl\u00a0-L\u00a0-O\u00a0https:\/\/artifacts.elastic.co\/downloads\/beats\/filebeat\/filebeat-8.1.0-x86_64.rpm\r\nrpm\u00a0-vi\u00a0filebeat-8.1.0-x86_64.rpm\r\n<\/code><\/pre>\n
      <\/div><\/p>\n
      (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
        \n
      • \n
        3\u3001\u521b\u5efatoken<\/section>\n<\/li>\n<\/ul>\n
        \u4f8b\u5982token\u4e3a12fet46c82h8r9vlfjh8jqi8kbr2nlf6hdjd4l9rkdf648na2rle<\/p>\n
        <\/div><\/p>\n
        (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
        <\/div><\/p>\n
        (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \n
        • \n
          4\u3001\u4fee\u6539sidecar.yml<\/section>\n<\/li>\n<\/ul>\n
          cp\u00a0\/etc\/graylog\/sidecar\/sidecar.yml\u00a0\/etc\/graylog\/sidecar\/sidecar.yml_bak\r\nvim\u00a0\/etc\/graylog\/sidecar\/sidecar.yml\r\n<\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
          \u4fee\u6539\u6210\u5982\u4e0b\u914d\u7f6e<\/p>\n
          1\uff09#server_url:\u00a0\"http:\/\/127.0.0.1:9000\/api\/\"<\/span>\r\n\u4fee\u6539\u4e3ahttp:\/\/192.168.31.127:9000\/api\/\r\n2\uff09server_api_token:\u00a0\"12fet46c82h8r9vlfjh8jqi8kbr2nlf6hdjd4l9rkdf648na2rle\"<\/span>\r\n3\uff09#node_name:\u00a0\"\"\u6539\u4e3a<\/span>\r\nnode_name:\u00a0\"XXXX_IP\"<\/span>\r\n4\uff09\u53d6\u6d88#update_interval:\u00a010\u7684\u6ce8\u91ca<\/span>\r\nupdate_interval:\u00a010\r\n5\uff09\u53d6\u6d88#send_status:\u00a0true\u00a0\u7684\u6ce8\u91ca<\/span>\r\nsend_status:\u00a0true<\/span>\r\n<\/code><\/pre>\n
          <\/div><\/p>\n
          (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
            \n
          • \n
            5\u3001\u542f\u52a8sidecar<\/section>\n<\/li>\n<\/ul>\n
            graylog-sidecar\u00a0-service\u00a0install\r\nsystemctl\u00a0restart\u00a0graylog-sidecar.service\r\nsystemctl\u00a0status\u00a0graylog-sidecar.service\u00a0\r\n<\/code><\/pre>\n
            <\/div><\/p>\n
            (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
            <\/div><\/p>\n
            (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
            \u4e09\u3001Graylog-Server\u4e0a\u914d\u7f6esidecar<\/span><\/h2>\n
              \n
            • \n
              1\u3001\u521b\u5efafilebeat\u7c7b\u578b\u7684log\u91c7\u96c6\u914d\u7f6e<\/section>\n<\/li>\n<\/ul>\n
              <\/div><\/p>\n
              (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
              <\/div><\/p>\n
              (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
              <\/div><\/p>\n
              (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
              \u914d\u7f6eInput(Beat\u7c7b\u578b)<\/p>\n
              <\/div><\/p>\n
              (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
              \u5e76\u6dfb\u52a0\u4e00\u4e2a\u56fa\u5b9a\u5b57\u6bb5 log_application \u503c\u8bbe\u4e3afail2ban<\/p>\n
              <\/div><\/p>\n
              (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                \n
              • \n
                2\u3001\u9632\u706b\u5899\u5f00\u542f5044\/TCP\u7aef\u53e3<\/section>\n<\/li>\n<\/ul>\n
                \u00a0firewall-cmd\u00a0--permanent\u00a0--zone=public\u00a0--add-port=5044\/tcp\r\n\u00a0firewall-cmd\u00a0--reload\r\n<\/code><\/pre>\n
                \n
                  \n
                • \n
                  3\u3001\u5efa\u8bae\u5355\u72ec\u914d\u7f6eindices\u548cStream\uff0c\u8fd9\u6837\u65b9\u4fbf\u641c\u7d22\u00a0<\/section>\n
                  <\/section>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n<\/li>\n<\/ul>\n
                  \u56db\u3001\u5bfc\u5165Fail2ban\u7684\u5957\u4ef6\u5305\u5e76\u914d\u7f6eGeo<\/span><\/h2>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  \u6ce8\u610f\uff1aPipelines\u4e2d\u8fde\u63a5\u7684Stream<\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  \u914d\u7f6eGeoIP<\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  \u4e94\u3001\u914d\u7f6eDashBoard<\/span><\/h2>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  \u53ef\u4ee5\u770b\u5230\u65e5\u5fd7\u5df2\u7ecf\u62c6\u89e3\u6210\u5f88\u591a\u5b57\u6bb5\uff0c\u65b9\u4fbf\u505a\u65e5\u5fd7\u5206\u6790\u4e0e\u7edf\u8ba1<\/p>\n
                  \u6700\u540e\u7684\u6548\u679c\u5982\u4e0b<\/span>\u00a0<\/span>
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  <\/div><\/p>\n
                  (\u56fe\u7247\u53ef\u70b9\u51fb\u653e\u5927\u67e5\u770b)<\/span><\/p>\n
                  \u603b\u7ed3\uff1a<\/span><\/h2>\n
                  1\u3001\u914d\u7f6e\u4e0a\u6709\u5f88\u591a\u5c0f\u7ec6\u8282\u9700\u8981\u6ce8\u610f\uff0c\u4f8b\u5982<\/p>\n
                  <\/div><\/p>\n
                  2\u3001GrayLog MarketPlace\u4e0a\u6709\u8bb8\u591a\u4f18\u79c0\u7684\u5957\u4ef6<\/p>\n
                  <\/div><\/p>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
                  \u5728GrayLog\u7684marketplace\u4e0a\u6709\u641c\u5230\u5173\u4e8eFail2ban\u65e5\u5fd7Grok\u4ee5\u53caPipeline\u7684\u5957\u4ef6\u5305  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,3],"tags":[],"class_list":["post-7574","post","type-post","status-publish","format-standard","hentry","category-linux","category-system"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7574"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7574\/revisions"}],"predecessor-version":[{"id":7824,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/7574\/revisions\/7824"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}