# cd /usr/ports/security/py-fail2ban/
# make install clean
配置服务：
# service fail2ban enable
查看 fail2ban 安装后说明
# pkg info -D security/py-fail2ban
py311-fail2ban-1.1.0_1:
On install:
Please do not edit the fail2ban.conf, jail.conf, or any other
files in the distributen as they will be overwritten upon each
upgrade of the port. Instead, create new files named *.local e.g.
fail2ban.local or jail.local.
# 请不要直接修改 fail2ban.conf、jail.conf 或其他官方提供的配置文件，
# 因为它们会在每次升级该软件包时被覆盖。
# 应该创建 *.local 文件，如 fail2ban.local 或 jail.local，来自定义配置。
For more information, see the official manual:
http://www.fail2ban.org/wiki/index.php/MANUAL_0_8#Configuration
# 更多信息可参见官方手册。
If you have custom filters or actions and you are upgrading from
0.9.x please check them.
# 如果你定义了自定义过滤器或操作，且从 0.9.x 升级而来，请检查其兼容性。
Users of pf: please read the notes in action.d/pf.conf and the
discussion at https://github.com/fail2ban/fail2ban/pull/1925
# 使用 pf 防火墙的用户请阅读 action.d/pf.conf 中的注释，
# 以及上面 GitHub 讨论链接中的相关说明。
Please note that fail2ban will put curly braces '{}' around the
ports in the action so you shouldn't do it yourself.
# 注意：fail2ban 会自动在动作命令中将端口号用大括号 {} 包裹，
# 因此你自己不需要再加。
# service ipfilter enable
# service ipfilter start
即可。终于不用再配置了，默认就可以用
测试效果
测试主动拉黑 IP 以查看效果
# fail2ban-client set sshd banip 192.168.179.1
TTY 输出
Mar 25 15:27:B8 gkla sshd[970]: error : maximum authentication attempts exceeded for ykla from 192.168.179.1 port 8652 ssh2 [ preauth ]
已经链接的 ssh 服务也会被强制断开。
查看状态
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 4
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 1
|- Total banned: 1
`- Banned IP list: 192.168.179.1
解禁 IP
# fail2ban-client set sshd unbanip 192.168.179.1
1
# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 1
| |- Total failed: 4
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 0
|- Total banned: 1
`- Banned IP list:
