在自己的linux主機該如何ban IP?

[哈啦]

作者: ismile";p=&quot

哈拉大的主機有裝 iptables 嗎? --> lsmod | grep ip_tables

然後用 iptables -L -n | grep 61.175.128.31

看看有沒有出現類似,

DROP all -- 61.175.128.31 0.0.0.0/0
DROP all -- 61.175.128.31 [主機 IP]

應該是有。而執行iptables -L -n | grep 61.175.128.31之後出現如下：
DROP all -- 61.175.128.31 0.0.0.0/0

就這一行。

[dx2]

裝上bfd吧，裝之前先裝好apf
1. Login to your server via SSH as Root.

2. Type: wget http://www.rfxnetworks.com/downloads/bfd-current.tar.gz

3. Type: tar -xvzf bfd-current.tar.gz

4. Type: cd bfd*

5. Now let's install BFD onto the server.
Type: ./install.sh

:: You Should See ::
.: BFD installed
Install path: /usr/local/bfd
Config path: /usr/local/bfd/conf.bfd
Executable path: /usr/local/sbin/bfd

6. Now we need to edit the configuration file, and set some options.
Don't worry the BFD Configuration isn't hard to edit or understand!
Type: pico -w /usr/local/bfd/conf.bfd

7. Now we need to find the line to edit:
Press: CTRL-W
Type: ALERT_USR
Change ALERT_USR="0" TO ALERT_USR="1"
Right below that we need to change the email:
Change EMAIL_USR="root" TO EMAIL_USR="you@yoursite.com"

8. That wasn't to bad let's save and exit the file
Press: CTRL-X then type Y then hit enter

9. Now we have to prevent locking yourself out of the server.
Type: pico -w /usr/local/bfd/ignore.hosts

10. Add any IP address that you want to be ignored from the rules. If your server provider is doing monitoring add their IP(s) here. Since you need these IPs open in APF as well you can copy the IPs you used in APF.
Type: pico -w /etc/apf/allow_hosts.rules
Then scroll down to the bottom and copy those IPs (drag mouse over that's it)
Press: CTRL-X
Type: pico -w /usr/local/bfd/ignore.hosts
Paste those IPs to the bottom. You should also add your home IP if you hadn't done so before. If your home IP is dynamic this is not a good idea, and you should get a static IP.
Press: CTRL-X then Y to save then enter.

11. Now lets run BDF!!!
Type: /usr/local/sbin/bfd -s

[ismile]

用 iptables -I INPUT -s 61.175.128.31 -j DROP 加入後，只要 iptable 重開，或是主機重開，設定就沒了。

裝 APF 或 Kiss, 比用 iptables 指令快多了 ...

[哈啦]

Dec 20 20:07:48 jjj sshd(pam_unix)[3279]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.63.239.11 
Dec 20 20:07:52 jjj sshd(pam_unix)[3281]: check pass; user unknown
Dec 20 20:07:52 jjj sshd(pam_unix)[3281]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.63.239.11 
Dec 20 20:07:56 jjj sshd(pam_unix)[3283]: check pass; user unknown
Dec 20 20:07:56 jjj sshd(pam_unix)[3283]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=211.63.239.11 
Dec 20 20:07:59 jjj sshd(pam_unix)[3285]: check pass; user unknown

想再請問一下，我從/var/log/messages裡看到以上的訊息連續一整排，我摘取一小段，請問有誰能解釋一下上面的文字代表什麼意義嗎？我大致猜是有從211.63.239.11 這個IP來的人不斷企圖進入主機，是嗎？那有成功嗎？

請高手指教一下，謝謝先

[vincentliao]

它要破您的 root 帳號密碼 uid=0
failure ==) 沒成功.

[哈啦]

可惡。
不是系統都有三次失誤的限制嗎？它如何能連續不斷的試？

還有，有無方法ban掉一整個區段的ip？例如我想直接封掉來自韓國的ip？

[alextung]

很簡單，211.63.239.11的用戶想用ssh登入您的主機，

哈啦有在玩Linux應該知道sshd是幹麻的，
我的作法你可以用用看，
1.
/etc/hosts.deny
加入以下
sshd : ALL : spawn (/bin/echo Security notice from host `/bin/hostname`; \
/bin/echo; /usr/sbin/safe_finger @%h ) | \
/bin/mail -s "%d -%h security" xxx@xxx.xxx.xxx & \
: twist ( /bin/echo -e "\n\nWARNING connectin not allowed. Your attempt has been logged. \n\n\n警告！您尚未允許登入，您的連線將會被紀錄，並且作為以後的參考\n ". )

紅色處填上您的email信箱

2.
開啟/etc/hosts.allow
sshd: 192.168.1.

這裡要注意最後面有一個點

3.以後若是你要使用sshd登入您的server就只能在您的local或者主機登入了，
(若是您的主機使用固定ip，可以採用兩張網卡，或者將網卡設定第二個ip)

4.
最簡單的阻擋某一個特定ip的方法則是在/etc/hosts.deny裡面加上
sshd: xxx.xxx.xxx.xxx(IP)

[vincentliao]

1.都是用程式在跑的.如果沒破成功就沒關希
2.ip可能是假的.
3.[ban掉一整個區段的ip]比較沒意義
4.用 ghost 將硬碟整顆備份到 DVD-rw,比較可行.
5.....
6.....

[哈啦]

十分感謝。我會加緊研究一下。
不過我基本上屬於幼稚園程度 ，所以只會用一些基本如httpd.conf的設定等等。其它大概都看嘸。

[alextung]

若是大大不用sshd的話，最簡單的方式就關掉它吧！
1.
/etc/rc.d/init.d/sshd stop
或者
service sshd stop

2.
進入setup選單，設定不要一開機就啟動sshd