debian/ubuntu系列

#安装fail2ban
apt update && apt install fail2ban rsyslog -y

#配置 your-key改为你的abuseipdb  apikey
nano /etc/fail2ban/jail.local

[DEFAULT]
action_abuseipdb = abuseipdb

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

action = %(action_)s
         %(action_abuseipdb)s[abuseipdb_apikey="your-key", abuseipdb_category="18,22"]


#如果之前有默认配置
mv /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.bak

#重启fail2ban配置 如果没有错误就没问题
systemctl restart sshd
systemctl restart fail2ban
fail2ban-client reload

提示 fail2ban版本要大于0.10     fail2ban-client -V 查看版本

官方默认配置最新版

wget -O /etc/fail2ban/action.d/abuseipdb.conf https://github.com/fail2ban/fail2ban/raw/refs/heads/master/config/action.d/abuseipdb.conf

官方配置示例

https://www.abuseipdb.com/fail2ban.html

查看ssh日志是否存在

ls -l /var/log/auth.log

查看状态

systemctl status fail2ban