Fail2Ban 고급 — 커스텀 필터·액션·화이트리스트

/etc/fail2ban/
├── fail2ban.conf        # 메인 설정 (수정 금지)
├── jail.conf            # 기본 jail 설정 (수정 금지)
├── fail2ban.local       # 로컬 오버라이드
├── jail.local           # jail 로컬 설정 (여기서 수정)
├── filter.d/            # 필터 정의
└── action.d/            # 액션 정의

# /etc/fail2ban/jail.local
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 192.168.0.0/16

[sshd]
enabled  = true
port     = 2222
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = 24h

# /etc/fail2ban/filter.d/myapp.conf
[Definition]
# 실패 로그 예시: 2025-05-27 10:23:45 LOGIN_FAILED from 203.0.113.45
failregex = ^%Y-%m-%d %H:%M:%S LOGIN_FAILED from <HOST>$
            ^.* authentication failure.* rhost=<HOST>.*$

# 무시할 패턴
ignoreregex = ^.* from 127\.0\.0\.1.*$

# 필터 테스트
fail2ban-regex /var/log/myapp/auth.log /etc/fail2ban/filter.d/myapp.conf -v

# jail에 추가
# /etc/fail2ban/jail.local
[myapp]
enabled  = true
filter   = myapp
logpath  = /var/log/myapp/auth.log
maxretry = 5
bantime  = 2h

# /etc/fail2ban/filter.d/nginx-auth.conf
[Definition]
failregex = ^<HOST> -.*"POST /api/login HTTP.*" (401|403) .*$

# /etc/fail2ban/jail.local
[nginx-auth]
enabled  = true
filter   = nginx-auth
logpath  = /var/log/nginx/access.log
maxretry = 10
findtime = 5m
bantime  = 1h

# /etc/fail2ban/action.d/slack-notify.conf
[Definition]
actionstart =
actionstop =
actioncheck =
actionban = curl -X POST -H 'Content-type: application/json' \
    --data '{"text":"🚫 Fail2Ban: <ip> banned in <name> (%(bantime)s)"}' \
    https://hooks.slack.com/services/YOUR/WEBHOOK/URL
actionunban =

# jail.local에 추가
[myapp]
action = iptables-multiport[name=myapp, port="80,443"]
         slack-notify

# IP 화이트리스트 (영구 무시)
# jail.local [DEFAULT] ignoreip에 추가
ignoreip = 127.0.0.1/8 1.2.3.4 10.0.0.0/8

# 즉시 특정 IP 차단 (수동)
fail2ban-client set sshd banip 203.0.113.45

# 차단 해제
fail2ban-client set sshd unbanip 203.0.113.45

# 전체 상태
fail2ban-client status

# 특정 jail 상태
fail2ban-client status sshd

# 현재 차단된 IP 목록
fail2ban-client status sshd | grep "Banned IP"

# 실시간 로그
tail -f /var/log/fail2ban.log

# 재시작 (설정 변경 후)
sudo systemctl reload fail2ban