Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- ubuntu:18-04_server_install [2019/05/30 12:24] – [Reaktivierung von ifupdown] Hinweis zur Deinstallation Sebastian Hetzel
+++ ubuntu:18-04_server_install [2019/06/27 23:02] (aktuell) – [Reaktivierung von ifupdown] Deaktivierung weiterer Dienst Sebastian Hetzel
@@ Zeile 95: / Zeile 95: @@
 systemctl stop systemd-resolved.service
 systemctl mask systemd-resolved.service
+</code>
+<code>
+systemctl disable systemd-networkd-wait-online.service
+systemctl stop systemd-networkd-wait-online.service
+systemctl mask systemd-networkd-wait-online.service
 </code>
@@ Zeile 325: / Zeile 331: @@
 ===== Fail2Ban =====
+Fail2Ban sollte meiner Meinung nach auf jeder Maschine laufen, die über SSH im Internet administriert wird. Natürlich ist die Absicherung weiterer Dienste wie SMTP, FTP, usw. ebenso sinnvoll.
+==== Installation und erste Konfiguration ====
+<code>
+# aptitude install fail2ban
+</code>
+<file >
+[...]
+# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
+# will not ban a host which matches an address in this list. Several addresses
+# can be defined using space (and/or comma) separator.
+#ignoreip = 127.0.0.1/8 ::1
+ignoreip = 127.0.0.1/8
+[...]
+# External command that will take an tagged arguments to ignore, e.g. <ip>,
+# and return true if the IP is to be ignored. False otherwise.
+#
+# ignorecommand = /path/to/command <ip>
+ignorecommand =
+# "bantime" is the number of seconds that a host is banned.
+bantime  = 86400
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = 600
+# "maxretry" is the number of failures before a host get banned.
+maxretry = 6
+[...]
+#
+# JAILS
+#
+#
+# SSH servers
+#
+[sshd]
+enabled = true
+# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
+# normal (default), ddos, extra or aggressive (combines all).
+# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
+#mode   = normal
+port    = 4444
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+[...]
+</file>
 ==== IP entsperren ====