fail2ban - 如何在暂时禁止 3 次后永久禁止 ip
fail2ban - how to ban ip permanently after it was baned 3 times temporarily
已通过本教程在 CentOS 8 上设置 fail2ban 服务：https://www.cyberciti.biz/faq/how-to-protect-ssh-with-fail2ban-on-centos-8/。
我已经按照上面的教程进行了类似的设置：
[DEFAULT]
# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):
bantime = 86400
# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime = 1200
maxretry = 3
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator. For example, add your
# static IP address that you always use for login such as 103.1.2.3
#ignoreip = 127.0.0.1/8 ::1 103.1.2.3
# Call iptables to ban IP address
banaction = iptables-multiport
# Enable sshd protection
[sshd]
enabled = true
我希望一个ip被临时封禁3次后永久封禁。怎么做？
持续禁止是不可取的 - 它只会不必要地使您的网络过滤器子系统（以及 fail2ban）过载...长期禁止就足够了。
如果你使用 v.0.11，你可以使用 bantime 增量功能，你的配置可能看起来像这个答案 - https://github.com/fail2ban/fail2ban/discussions/2952#discussioncomment-414693
[sshd]
# initial ban time:
bantime = 1h
# incremental banning:
bantime.increment = true
# default factor (causes increment - 1h -> 1d 2d 4d 8d 16d 32d ...):
bantime.factor = 24
# max banning time = 5 week:
bantime.maxtime = 5w
但请注意，如果启用此功能，它也会影响 maxretry，因此从已知的不良 IP 开始的第 2 次和后续禁令比第 3 次尝试后发生的要早得多（每次都会减半）。
您可以使用 jail [recidive] 和 bantime = -1 永久封禁。例子 jail.local:
# Jail for more extended banning of persistent abusers
# !!! WARNINGS !!!
# 1. Make sure that your loglevel specified in fail2ban.conf/.local
# is not at DEBUG level -- which might then cause fail2ban to fall into
# an infinite loop constantly feeding itself with non-informative lines
# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
# to maintain entries for failed logins for sufficient amount of time
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime = -1 ; permanent
findtime = 86400 ; 1 day
maxretry = 6
一般说明：
使用 SSH 密钥验证并在 sshd_config 中设置“AllowGroups”或“AllowUsers”。大多数 SSH 登录尝试都会在几次尝试后停止。我还注意到在我的服务器上，它在几个月或几年后越来越少。
已通过本教程在 CentOS 8 上设置 fail2ban 服务：https://www.cyberciti.biz/faq/how-to-protect-ssh-with-fail2ban-on-centos-8/。
我已经按照上面的教程进行了类似的设置：
[DEFAULT]
# Ban IP/hosts for 24 hour ( 24h*3600s = 86400s):
bantime = 86400
# An ip address/host is banned if it has generated "maxretry" during the last "findtime" seconds.
findtime = 1200
maxretry = 3
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator. For example, add your
# static IP address that you always use for login such as 103.1.2.3
#ignoreip = 127.0.0.1/8 ::1 103.1.2.3
# Call iptables to ban IP address
banaction = iptables-multiport
# Enable sshd protection
[sshd]
enabled = true
我希望一个ip被临时封禁3次后永久封禁。怎么做？
持续禁止是不可取的 - 它只会不必要地使您的网络过滤器子系统（以及 fail2ban）过载...长期禁止就足够了。
如果你使用 v.0.11，你可以使用 bantime 增量功能，你的配置可能看起来像这个答案 - https://github.com/fail2ban/fail2ban/discussions/2952#discussioncomment-414693
[sshd]
# initial ban time:
bantime = 1h
# incremental banning:
bantime.increment = true
# default factor (causes increment - 1h -> 1d 2d 4d 8d 16d 32d ...):
bantime.factor = 24
# max banning time = 5 week:
bantime.maxtime = 5w
但请注意，如果启用此功能，它也会影响 maxretry，因此从已知的不良 IP 开始的第 2 次和后续禁令比第 3 次尝试后发生的要早得多（每次都会减半）。
您可以使用 jail [recidive] 和 bantime = -1 永久封禁。例子 jail.local:
# Jail for more extended banning of persistent abusers
# !!! WARNINGS !!!
# 1. Make sure that your loglevel specified in fail2ban.conf/.local
# is not at DEBUG level -- which might then cause fail2ban to fall into
# an infinite loop constantly feeding itself with non-informative lines
# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
# to maintain entries for failed logins for sufficient amount of time
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
banaction = %(banaction_allports)s
bantime = -1 ; permanent
findtime = 86400 ; 1 day
maxretry = 6
一般说明： 使用 SSH 密钥验证并在 sshd_config 中设置“AllowGroups”或“AllowUsers”。大多数 SSH 登录尝试都会在几次尝试后停止。我还注意到在我的服务器上，它在几个月或几年后越来越少。