Linux防止SSH暴力破解的多种方法

sudo nano /etc/ssh/sshd_config

Port 2222

sudo systemctl restart sshd

sudo ufw allow 2222/tcp

PermitRootLogin no

sudo systemctl restart sshd

ssh-keygen -t rsa -b 4096

ssh-copy-id -p 2222 user@your-server-ip

PasswordAuthentication no
PubkeyAuthentication yes

sudo systemctl restart sshd

sudo apt update
sudo apt install fail2ban

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400
findtime = 600

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

sudo fail2ban-client status sshd

sudo ufw allow from 192.168.1.100 to any port 2222
sudo ufw deny 2222
sudo ufw enable

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.100" port protocol="tcp" port="2222" accept'
sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --reload

<dependencies>
    <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>1.4.11</version>
    </dependency>
    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-lang3</artifactId>
        <version>3.13.0</version>
    </dependency>
</dependencies>

import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.*;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class SSHMonitor {
    private static final Logger logger = LoggerFactory.getLogger(SSHMonitor.class);
    // 日志文件路径（Ubuntu/Debian）
    private static final String AUTH_LOG_PATH = "/var/log/auth.log";
    // 匹配失败登录的正则表达式
    private static final String FAILED_LOGIN_PATTERN =
            ".*Failed password for (?:invalid user )?(\\S+) from (\\d+\\.\\d+\\.\\d+\\.\\d+).*";
    // 白名单IP（不封禁）
    private static final Set<String> WHITE_LIST = Set.of(
            "127.0.0.1",
            "192.168.1.1", // 示例，替换成你的管理IP
            "10.0.0.1"
    );
    // 失败次数阈值
    private static final int MAX_RETRY = 5;
    // 封禁时长（秒）
    private static final int BAN_DURATION = 3600; // 1小时
    // 存储IP失败次数
    private final Map<String, Integer> failedAttempts = new HashMap<>();
    // 存储已封禁IP及解封时间
    private final Map<String, LocalDateTime> bannedIPs = new HashMap<>();
    public void startMonitoring() {
        ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
        // 每10秒扫描一次日志
        scheduler.scheduleAtFixedRate(this::scanAuthLog, 0, 10, TimeUnit.SECONDS);
        // 每分钟清理过期封禁
        scheduler.scheduleAtFixedRate(this::unbanExpiredIPs, 0, 1, TimeUnit.MINUTES);
        logger.info("SSH 暴力破解监控器已启动...");
    }
    private void scanAuthLog() {
        File logFile = new File(AUTH_LOG_PATH);
        if (!logFile.exists()) {
            logger.warn("日志文件不存在: {}", AUTH_LOG_PATH);
            return;
        }
        try (BufferedReader reader = new BufferedReader(new FileReader(logFile))) {
            String line;
            Pattern pattern = Pattern.compile(FAILED_LOGIN_PATTERN);
            while ((line = reader.readLine()) != null) {
                Matcher matcher = pattern.matcher(line);
                if (matcher.matches()) {
                    String user = matcher.group(1);
                    String ip = matcher.group(2);
                    if (WHITE_LIST.contains(ip)) {
                        continue; // 白名单跳过
                    }
                    failedAttempts.merge(ip, 1, Integer::sum);
                    int attempts = failedAttempts.get(ip);
                    logger.warn("检测到失败登录: 用户={} IP={} 尝试次数={}", user, ip, attempts);
                    if (attempts >= MAX_RETRY && !bannedIPs.containsKey(ip)) {
                        banIP(ip);
                    }
                }
            }
        } catch (IOException e) {
            logger.error("读取日志文件失败", e);
        }
    }
    private void banIP(String ip) {
        try {
            // 调用 iptables 封禁
            String cmd = String.format("iptables -A INPUT -s %s -j DROP", ip);
            Process process = Runtime.getRuntime().exec(cmd);
            process.waitFor();
            LocalDateTime unbanTime = LocalDateTime.now().plusSeconds(BAN_DURATION);
            bannedIPs.put(ip, unbanTime);
            logger.info("⛔ 已封禁 IP: {}，解封时间: {}", ip, unbanTime.format(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")));
            // 可选：发送邮件/企业微信/钉钉通知
            // sendAlert("SSH暴力破解警报", "IP " + ip + " 因多次失败登录已被封禁");
        } catch (Exception e) {
            logger.error("封禁IP失败: {}", ip, e);
        }
    }
    private void unbanExpiredIPs() {
        LocalDateTime now = LocalDateTime.now();
        List<String> toUnban = new ArrayList<>();
        for (Map.Entry<String, LocalDateTime> entry : bannedIPs.entrySet()) {
            if (now.isAfter(entry.getValue())) {
                toUnban.add(entry.getKey());
            }
        }
        for (String ip : toUnban) {
            try {
                String cmd = String.format("iptables -D INPUT -s %s -j DROP", ip);
                Process process = Runtime.getRuntime().exec(cmd);
                process.waitFor();
                bannedIPs.remove(ip);
                failedAttempts.remove(ip); // 清除计数
                logger.info("✅ 已解封 IP: {}", ip);
            } catch (Exception e) {
                logger.error("解封IP失败: {}", ip, e);
            }
        }
    }
    // 可扩展：发送告警通知
    private void sendAlert(String title, String content) {
        // 此处可集成邮件、Slack、企业微信、钉钉等
        // 示例略...
    }
    public static void main(String[] args) {
        new SSHMonitor().startMonitoring();
    }
}

mvn clean package

sudo java -jar ssh-monitor.jar

tail -f logs/app.log

#!/bin/bash
# download-blacklist.sh
API_KEY="your_api_key_here"
BLACKLIST_URL="https://api.abuseipdb.com/api/v2/blacklist?confidenceMinimum=90"
curl -G $BLACKLIST_URL \
  -H "Key: $API_KEY" \
  -H "Accept: application/json" \
  --data-urlencode "confidenceMinimum=90" \
  | jq -r '.data[].ipAddress' > /tmp/abuseip_blacklist.txt
while read ip; do
    iptables -A INPUT -s $ip -j DROP
done < /tmp/abuseip_blacklist.txt
logger "已从 AbuseIPDB 更新 $(wc -l < /tmp/abuseip_blacklist.txt) 个恶意IP"

0 2 * * * /path/to/download-blacklist.sh

sudo apt install libpam-google-authenticator

google-authenticator

sudo nano /etc/pam.d/sshd

auth required pam_google_authenticator.so

sudo nano /etc/ssh/sshd_config

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

sudo systemctl restart sshd

# 查看最近成功登录
last

# 查看失败登录
grep "Failed password" /var/log/auth.log | tail -20

# 统计攻击最频繁的IP
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr | head -10

sudo apt install knockd

[options]
    UseSyslog

[openSSH]
    sequence    = 7000,8000,9000
    seq_timeout = 10
    command     = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 2222 -j ACCEPT
    tcpflags    = syn

[closeSSH]
    sequence    = 9000,8000,7000
    seq_timeout = 10
    command     = /sbin/iptables -D INPUT -s %IP% -p tcp --dport 2222 -j ACCEPT
    tcpflags    = syn

sudo systemctl start knockd
sudo systemctl enable knockd

knock your-server-ip 7000 8000 9000
ssh -p 2222 user@your-server-ip

knock your-server-ip 9000 8000 7000

nmap -p 22,2222 your-server-ip

hydra -l root -P /path/to/passwords.txt ssh://your-server-ip:2222 -t 4