[DEFAULT]

 

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not

# ban a host which matches an address in this list. Several addresses can be

# defined using space separator.

ignoreip = 127.0.0.1/8

 

# External command that will take an tagged arguments to ignore, e.g. ,

# and return true if the IP is to be ignored. False otherwise.

#

# ignorecommand = /path/to/command

ignorecommand =

 

# "bantime" is the number of seconds that a host is banned.

bantime  = 600

 

# A host is banned if it has generated "maxretry" during the last "findtime"

# seconds.

findtime  = 600

 

# "maxretry" is the number of failures before a host get banned.

maxretry = 3

 

# "backend" specifies the backend used to get files modification.

# Available options are "pyinotify", "gamin", "polling" and "auto".

# This option can be overridden in each jail as well.

#

# pyinotify: requires pyinotify (a file alteration monitor) to be installed.

#              If pyinotify is not installed, Fail2ban will use auto.

# gamin:     requires Gamin (a file alteration monitor) to be installed.

#              If Gamin is not installed, Fail2ban will use auto.

# polling:   uses a polling algorithm which does not require external libraries.

# auto:      will try to use the following backends, in order:

#              pyinotify, gamin, polling.

backend = auto

 

# "usedns" specifies if jails should trust hostnames in logs,

#   warn when DNS lookups are performed, or ignore all hostnames in logs

#

# yes:   if a hostname is encountered, a DNS lookup will be performed.

# warn:  if a hostname is encountered, a DNS lookup will be performed,

#        but it will be logged as a warning.

# no:    if a hostname is encountered, will not be used for banning,

#        but it will be logged as info.

usedns = warn

ignoreip = 127.0.0.1 #忽略的IP列表,不受设置限制（白名单）
bantime = 600 #屏蔽时间，单位：秒
findtime = 600 #这个时间段内超过规定次数会被ban掉
maxretry = 3 #最大尝试次数
backend = auto #日志修改检测机制（gamin、polling和auto这三种）
[ssh-iptables] #针对各服务的检查配置，如设置bantime、findtime、maxretry和全局冲突，服务优先级大于全局设置
enabled = true #是否激活此项（true/false）
filter = sshd #过滤规则filter的名字，对应filter.d目录下的sshd.conf
action = iptables[name=SSH, port=ssh, protocol=tcp] #动作的相关参数
sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com] #触发报警的收件人
logpath = /var/log/secure #检测的系统的登陆日志文件
maxretry = 5 #最大尝试次数

CentOS 6:
service fail2ban restart
CentOS 7:
systemctl restart fail2ban.service

CentOS 6:
chkconfig fail2ban on
CentOS 7:
systemctl enable fail2ban