CLI - Fail2ban 설정 문서 원본 보기

__FORCETOC__
=== fail2ban ===
fail2ban이란 brute-force 공격<ref>https://en.wikipedia.org/wiki/Brute-force_attack</ref>으로 부터 안전하게 시스템을 보호하기 이한 기능입니다. 이 기능을 사용하면 장비에 일정 회수 이상 로그인 실패하는 경우 해당 호스트가 일정 시간 동안 연결을 할 수 있게 막아 악의적인 시도를 통한 로그인을 방지 할 수 있습니다.<ref>https://en.wikipedia.org/wiki/Fail2ban</ref>

fail2ban 설정은 세가지 용어가 존재하는데 첫 번째는 "bantime"으로, 이것은 호스트가 얼마나 오래 차단될지를 나타냅니다. 두 번째는  "findtime"으로 접속 시도가 관찰되는 시간을 나타내며 마지막은 "maxretry"로 몇번의 실패가 일어나면 "jain" 처리할 것인지를 의미합니다.
{{note | Note that the fail2ban service blocks a client depending on its IP address. For example, Although a client whose IP address is 10.10.10.10 is blocking for the bantime, another client whose IP address is 20.20.20.20 can connect to the same device.}}

==== Verifying Current Configuration ====
If you want to verify the current configuration, enter the <code>show system fail2ban</code>. The result shows 
<pre>
LYSH@MyHostName# show system fail2ban
fail2ban(ssh)                 : active, bantime:10m, findtime:10m, maxretry:5
</pre>
{{note|Note that the above fail2ban configuration is the default. In other words, if you try to connect an imRAD device without knowing its password and you failed more than 5 times, your connection will be blocked for 10 minutes.}}

==== Configuring the fail2ban ====
You can configure the fail2ban in the configuration mode. enter the <code>fail2ban add <bantime> <findtime> <maxtetry> </code> in the configuration mode. The "bantime" and "findtime" is in seconds.
<pre>
LYSH@MyHostName# configure
configure# fail2ban add 300 1800 10	// "bantime" is 300 seconds, "findtime" is 1800 seconds, and "maxtetry" is 10.
configure# exit
LYSH@MyHostName# show system fail2ban
fail2ban(ssh)                 : active, bantime:300, findtime:1800, maxretry:10 
</pre>

==== Enable / Disable the fail2ban ====
If you do not want to fail2ban service, enter <code>fail2ban disable</code> in the configuration mode. Also you can enable it.
<pre>
LYSH@MyHostName# configure
configure# fail2ban disable		// disable the fail2ban service
configure# exit
LYSH@MyHostName# show system fail2ban
fail2ban(ssh)                 : inactive, bantime:300, findtime:1800, maxretry:10 

LYSH@MyHostName# configure
configure# fail2ban enable		// enable the fail2ban service
configure# exit
LYSH@MyHostName# show system fail2ban
fail2ban(ssh)                 : active, bantime:300, findtime:1800, maxretry:10 
</pre>