13
私はサーバでssh bruteforceを気付きました。実際にはfail2banによって禁止されていたはずですが、何らかの理由でそれを禁止していません。 fail2banに問題があるほとんどの人は正規表現に問題があると思われますが、ここで問題はないようです。fail2ban ssh bruteforceが正規表現を禁止しない
jail.conf
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
findtime = 6000
bantime = 86400
fail2banのクライアントのステータスSSH
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 0
| `- Total failed: 0
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0
fail2banの、正規表現/var/log/auth.logの/ etc/fail2banの/フィルタの一部.d/sshd.conf
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/auth.log
Results
=======
Failregex
|- Regular expressions:
| [1] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM:)?Authentication failure for .* from <HOST>\s*$
| [2] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM:)?User not known to the underlying authentication module for .* from <HOST>\s*$
| [3] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Failed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
| [4] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*ROOT LOGIN REFUSED.* FROM <HOST>\s*$
| [5] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
| [6] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because not listed in AllowUsers$
| [7] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
| [8] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*refused connect from \S+ \(<HOST>\)\s*$
| [9] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Address <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
| [10] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\
S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 380 match(es)
[4] 0 match(es)
[5] 353 match(es)
[6] 26 match(es)
[7] 0 match(es)
[8] 0 match(es)
[9] 0 match(es)
[10] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
[2]
[3]
198.245.50.151 (Sat Dec 21 15:18:12 2013)
198.245.50.151 (Sat Dec 21 15:18:15 2013)
198.245.50.151 (Sat Dec 21 15:18:18 2013)
198.245.50.151 (Sat Dec 21 15:18:21 2013)
198.245.50.151 (Sat Dec 21 15:18:24 2013)
..................
Date template hits:
23379 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
..................
Success, the total number of match is 759
私は多くの正規表現マッチを持っていても、なぜfail2banは禁止しないのですか？
よろしく、 魚
そのご意見ありがとうございます。ボックスでNTPクライアントが実行されており、少なくとも/var/log/auth.logと/var/log/fail2ban.logは同じタイムゾーンを使用しています。しかし、あなたが正しいかもしれない、私はタイムゾーンの問題を検索しようとします。 – fish
__owncloud 9__で同じ問題が発生した場合、日付形式が本当に原因でした。 owncloudの設定ファイルの_UTC_に設定されています。 –