Linux用root强制踢掉已登录用户；用fail2ban阻止ssh暴力破解root密码

时间：2023-03-09 03:30:42
Linux用root强制踢掉已登录用户；用fail2ban阻止ssh暴力破解root密码

Linux用root强制踢掉已登录用户

首先使用w命令查看所有在线用户：

[root@VM_152_184_centos /]# w

 20:50:14 up 9 days,  5:58,  3 users,  load average: 0.21, 0.05, 0.02

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    101.45.224.253   20:48    0.00s  0.00s  0.00s w

root     pts/1    101.45.224.253   20:49   17.00s  0.00s  0.00s -bash

hmj      pts/2    101.45.224.253   20:50    2.00s  0.00s  0.00s -bash

执行命令：

pkill -kill -t TTY值

例：踢掉已登录用户hmj

pkill -kill -t pts/2

再用w命令查看是否已经强制踢掉：

[root@VM_152_184_centos /]# w

 20:55:10 up 9 days,  6:03,  2 users,  load average: 0.03, 0.03, 0.00

USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT

root     pts/0    101.45.224.253   20:48    0.00s  0.00s  0.00s w

root     pts/1    101.45.224.253   20:49    5:13   0.00s  0.00s -bash

用fail2ban阻止ssh暴力破解root密码

安装fail2ban工具来实现防暴力破解，防止恶意攻击，锁定恶意攻击IP。
 
1、如果是centos系统，先yum安装fail2ban

[root@VM_152_184_centos /]# yum -y install fail2ban

2、为了更好的看到有哪些IP在尝试暴利破解，先定义好日志文件路径

[root@VM_152_184_centos /]# cat /etc/fail2ban/fail2ban.conf |grep -v ^#

 

[Definition]

 

loglevel = 3

 

logtarget = SYSLOG　　//这里是日志路径，可以自定义，比如：/var/log/fail2ban.log

 

socket = /var/run/fail2ban/fail2ban.sock

 

pidfile = /var/run/fail2ban/fail2ban.pid

3、自定义主配置文件（当然，也可以不修改，保持默认配置）

[root@VM_152_184_centos /]# cat /etc/fail2ban/jail.conf |grep -v ^# |less

 

[DEFAULT]

 

ignoreip = 127.0.0.1/8

 

bantime  = 600　　//屏蔽、锁定时间，单位：s

 

findtime  = 600　　//600s内尝试登陆失败超过规定次数将被锁定

 

maxretry = 3　　//最大登陆失败次数

 

backend = auto

 

usedns = warn

4、最后，启动fail2ban，使其配置生效

[root@VM_152_184_centos /]# service fail2ban start

最后，再查看一下fail2ban日志文件，可以看到已经屏蔽的IP列表（Ban ip是屏蔽/锁定的IP，Unban ip是自动解锁的IP）

[root@VM_152_184_centos /]# cat /var/log/fail2ban.log | grep "ban"

2014-04-15 21:12:18,053 fail2ban.actions: WARNING [ssh-iptables] Ban 198.104.137.151

2014-04-15 21:42:19,037 fail2ban.actions: WARNING [ssh-iptables] Unban 198.104.137.151

2014-04-15 22:12:16,001 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.218

2014-04-15 22:42:16,305 fail2ban.actions: WARNING [ssh-iptables] Unban 116.10.191.218

2014-04-15 23:02:02,609 fail2ban.actions: WARNING [ssh-iptables] Ban 117.34.91.170

2014-04-15 23:26:10,651 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.172

2014-04-15 23:28:02,391 fail2ban.actions: WARNING [ssh-iptables] Ban 198.104.137.151

2014-04-15 23:32:03,428 fail2ban.actions: WARNING [ssh-iptables] Unban 117.34.91.170

2014-04-15 23:46:07,364 fail2ban.actions: WARNING [ssh-iptables] Ban 116.10.191.205

2014-04-15 23:56:10,893 fail2ban.actions: WARNING [ssh-iptables] Unban 116.10.191.172