为什么fail2ban不禁止这种攻击？

10

我安装了fail2ban以禁止对ssh密码进行暴力破解尝试。对于禁止在此计算机上禁用密码身份验证，存在一些业务要求。

使用同一厨师食谱安装了fail2ban，该厨师食谱有效地禁止了对其他计算机的ssh攻击。有一个配置的ssh监狱：

# service fail2ban status
fail2ban-server (pid  5480) is running...
WARNING 'pidfile' not defined in 'Definition'. Using default one: '/var/run/fail2ban/fail2ban.pid'
Status
|- Number of jail:  1
`- Jail list:       ssh

手动禁止用户的作品：

# fail2ban-client set ssh banip 103.41.124.46

但这似乎并没有自动禁止任何人：

# cat /var/log/fail2ban.log
2014-11-20 18:23:47,069 fail2ban.server [67569]: INFO    Exiting Fail2ban
2014-11-20 18:44:59,202 fail2ban.server [5480]: INFO    Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.14
2014-11-20 18:44:59,213 fail2ban.jail   [5480]: INFO    Creating new jail 'ssh'
2014-11-20 18:44:59,214 fail2ban.jail   [5480]: INFO    Jail 'ssh' uses poller
2014-11-20 18:44:59,249 fail2ban.jail   [5480]: INFO    Initiated 'polling' backend
2014-11-20 18:44:59,270 fail2ban.filter [5480]: INFO    Added logfile = /var/log/secure
2014-11-20 18:44:59,271 fail2ban.filter [5480]: INFO    Set maxRetry = 6
2014-11-20 18:44:59,272 fail2ban.filter [5480]: INFO    Set findtime = 600
2014-11-20 18:44:59,272 fail2ban.actions[5480]: INFO    Set banTime = 300
2014-11-20 18:44:59,431 fail2ban.jail   [5480]: INFO    Jail 'ssh' started
2014-11-21 11:09:37,447 fail2ban.actions[5480]: WARNING [ssh] Ban 103.41.124.46
2014-11-21 11:10:32,602 fail2ban.actions[5480]: WARNING [ssh] Ban 122.225.97.75
2014-11-21 11:14:37,899 fail2ban.actions[5480]: WARNING [ssh] Unban 103.41.124.46
2014-11-21 11:15:32,976 fail2ban.actions[5480]: WARNING [ssh] Unban 122.225.97.75
2014-11-21 11:30:06,295 fail2ban.comm   [5480]: WARNING Command ['ban', 'ssh', '189.203.240.89'] has failed. Received Exception('Invalid command',)
2014-11-21 11:30:33,966 fail2ban.actions[5480]: WARNING [ssh] Ban 189.203.240.89
2014-11-21 11:35:34,303 fail2ban.actions[5480]: WARNING [ssh] Unban 189.203.240.89

例如，这是/var/log/messages应该被捕获并禁止的攻击：

Nov 21 07:51:32 my_hostname sshd[51074]: Failed password for root from 122.225.109.219 port 1788 ssh2
Nov 21 07:51:34 my_hostname sshd[51072]: Failed password for root from 122.225.109.219 port 58285 ssh2
Nov 21 07:51:35 my_hostname sshd[51076]: Failed password for invalid user admin from 122.225.109.219 port 2221 ssh2
Nov 21 07:51:35 my_hostname sshd[51074]: Failed password for root from 122.225.109.219 port 1788 ssh2
Nov 21 07:51:37 my_hostname sshd[51072]: Failed password for root from 122.225.109.219 port 58285 ssh2
Nov 21 07:51:37 my_hostname sshd[51074]: Failed password for root from 122.225.109.219 port 1788 ssh2
Nov 21 07:51:38 my_hostname sshd[51076]: Failed password for invalid user admin from 122.225.109.219 port 2221 ssh2
Nov 21 07:51:38 my_hostname sshd[51084]: Failed password for root from 122.225.109.219 port 3501 ssh2
Nov 21 07:51:39 my_hostname sshd[51072]: Failed password for root from 122.225.109.219 port 58285 ssh2

这也正在登录/var/log/secure：

Nov 25 16:06:40 cluster-122-1413591380-db sshd[75769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:06:46 cluster-122-1413591380-db sshd[75769]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:06:48 cluster-122-1413591380-db sshd[75778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:06:55 cluster-122-1413591380-db sshd[75778]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:06:57 cluster-122-1413591380-db sshd[75780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:03 cluster-122-1413591380-db sshd[75780]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:05 cluster-122-1413591380-db sshd[75793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:12 cluster-122-1413591380-db sshd[75793]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:13 cluster-122-1413591380-db sshd[75797]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:21 cluster-122-1413591380-db sshd[75797]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:22 cluster-122-1413591380-db sshd[75803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:28 cluster-122-1413591380-db sshd[75803]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:29 cluster-122-1413591380-db sshd[75809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:36 cluster-122-1413591380-db sshd[75809]: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root
Nov 25 16:07:38 cluster-122-1413591380-db sshd[75811]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.41.124.41  user=root

这是我的jail.local：

# Fail2Ban configuration file.
#
# The configuration here inherits from /etc/fail2ban/jail.conf. Any setting
# omitted here will take it's value from that file
#
# Author: Yaroslav O. Halchenko <snip>
#
#

# The DEFAULT allows a global definition of the options. They can be overridden
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 127.0.0.1/8
findtime = 600
bantime  = 300
maxretry = 5

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now
backend = polling

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section
action = %(action_)s

#
# JAILS
#

# Next jails can inherit from the configuration in /etc/fail2ban/jail.conf.
# Enable any defined in that file jail by including
#
# [SECTION_NAME]
# enabled = true
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local


[ssh]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 6

[ssh-iptables]

enabled = false

为什么fail2ban不起作用？或者，为什么没有我的手动干预，它为什么不禁止上面的攻击者？

ssh  security  firewall  fail2ban 
— 狮子座
source
1
您应始终关注的端口始终为22。远程端口无关。您应该问的是，不是如何更改端口，而是为什么fail2ban无法正常工作。
— 迈克尔·汉普顿
我已经更新了问题。
— 2014年
1
2014-11-21 11:30:06,295 fail2ban.comm [5480]: WARNING Command ['ban', 'ssh', '189.203.240.89'] has failed. Received Exception('Invalid command',)是时候看看action您正在运行的了。东西没去那里。
— 迈克尔·汉普顿
1
这个守护程序的名字不错的选择
— arielnmz 2014年
1
好。将来，切勿从您的问题中删除这些重要信息（并感谢您以后的编辑）
— gparent

Answers:

7

该参数logpath应设置为将记录SSH尝试记录的日志文件的路径。因此，如果为/var/log/messages，则/var/log/secure显然是不正确的。

将logpath参数更改为正确的文件。

— 祖父母
source
1
/var/log/secure对于Red Hat派生的系统将是正确的。
— 迈克尔·汉普顿
— user9517
1
/var/log/auth.log在某些系统上也是如此。
— fatal_error 2014年
1
尝试将您的发行版软件包用于fail2ban或denyhosts，因为它将针对发行版的身份验证日志进行预定制。您还可以创建一个文件，例如/etc/rsyslog.d/50-auth-logpath.conf（或等效文件），以将身份验证失败日志发送到fail2ban寻找的日志文件。
— fatal_error 2014年
@gparent：对不起，延迟响应。在这种情况下，我不愿意接受您的回答，因为信息也被记录到/ var / log / secure中，而不仅仅是/ var / log / messages。我已将其添加到帖子中。你能看看吗？
— 狮子座
5

在RHEL和CentOS上，身份验证错误进入/ var / log / messages或/ var / log安全：

# cat /etc/rsyslog.conf | grep auth
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages
# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

默认情况下，sshd配置为SyslogFacility设置为AUTH，该密码转到/ var / log / messages。如果按如下方式覆盖/ etc / ssh / sshd_config，它将改为转至/ var / log / secure：

SyslogFacility AUTHPRIV

我正在使用SoftLayer云上的计算机，它们的基本映像配置在去年的某个时候从AUTHPRIV更改为AUTH。

默认情况下，fail2ban在/etc/fail2ban/jail.local中具有以下监狱：

[ssh]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 6

我建议向/etc/fail2ban/jail.local添加第二个监狱：

[ssh-log-messages]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/messages
maxretry = 6

之后，重新启动fail2ban以使第二个监狱生效：

service fail2ban restart

另一种方法是在/etc/fail2ban/filter.d/sshd.conf中扩展sshd正则表达式。/ var / log / secure和/ var / log / messages中都有足够的信息来禁止IP。不幸的是，fail2ban无法在不添加备用正则表达式的情况下解析所有消息。这留作练习。

— 狮子座
source
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.