feat(security): fail2ban sshd.local с ignoreip admin и banaction ufw.

2026-06-15 15:06:53 +10:00
parent fc12d35f23
commit a7de0d0555
3 changed files with 8 additions and 0 deletions
@@ -29,6 +29,7 @@ command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt i
 install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
 install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
 install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
+install -m 0644 "$F2B_DIR/sshd.local" /etc/fail2ban/jail.d/sshd.local

 log "fail2ban-regex haproxy-json-reject"
 fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
@@ -44,4 +45,5 @@ systemctl restart fail2ban
 sleep 1
 fail2ban-client status
 fail2ban-client status haproxy-reject
+fail2ban-client status sshd
 log "done"
@@ -0,0 +1,4 @@
+[sshd]
+enabled = true
+banaction = ufw
+ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121