제공된 SSHD 구성을 사용하여 Fail2Ban을 작동시키려고 합니다.
내가 실행할 때 :
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
출력은 다음과 같습니다
root@fw:/etc/fail2ban/filter.d# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/auth.log
Results
=======
Failregex: 5583 total
|- #) [# of hits] regular expression
| 3) [4339] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*Failed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ (?:[\da-f]{2}:){15}[\da-f]{2}(, client user ".*", client host ".*")?))?\s*$
| 5) [1244] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [19480] MONTH Day Hour:Minute:Second
`-
Lines: 19480 lines, 0 ignored, 5583 matched, 13897 missed
Missed line(s):: too many to print. Use --print-all-missed to print all 13897 lines
root@fw:/etc/fail2ban/filter.d#
내 auth.log는 다음과 같습니다(샘플).
Oct 21 04:47:44 fw sshd[31558]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:44 fw sshd[31558]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:44 fw sshd[31558]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:46 fw sshd[31562]: Failed password for root from 218.2.0.125 port 12277 ssh2
Oct 21 04:47:46 fw sshd[31581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:48 fw sshd[31560]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 9188 ssh2]
Oct 21 04:47:48 fw sshd[31560]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:48 fw sshd[31560]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:48 fw sshd[31560]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:48 fw sshd[31581]: Failed password for root from 218.2.0.125 port 13148 ssh2
Oct 21 04:47:52 fw sshd[31595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:55 fw sshd[31595]: Failed password for root from 218.2.0.125 port 14409 ssh2
Oct 21 04:47:55 fw CRON[31494]: pam_unix(cron:session): session closed for user clamav
Oct 21 04:47:59 fw sshd[31562]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 12277 ssh2]
Oct 21 04:47:59 fw sshd[31562]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31562]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:59 fw sshd[31562]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:59 fw sshd[31581]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 13148 ssh2]
Oct 21 04:47:59 fw sshd[31581]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31581]: fatal: Write failed: Connection reset by peer [preauth]
Oct 21 04:47:59 fw sshd[31581]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:59 fw sshd[31581]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:48:00 fw sshd[31595]: message repeated 2 times: [ Failed password for root from 218.2.0.125 port 14409 ssh2]
일치해야 하는 항목이 있다는 것을 알고 있지만 일치시킬 수 없습니다.
조사한 결과 날짜 형식에 문제가 있을 수 있다는 사실을 발견했지만 제안된 변경 사항은 common.conf아무런 차이가 없었습니다.
또한 fail2ban-regexauth.log 날짜 형식으로 매뉴얼을 실행했는데 예상대로 반환되었습니다.
답변1
일치하는 항목이 있는 것 같지만 충분하지 않습니다.데비안 버그 #620364아마도 비난받을 것입니다. 해결 방법은Fail2ban 위키그리고스택 오버플로, rsyslog에서 반복 메시지 감소를 끄는 것입니다.
sudo sed -i 's/RepeatedMsgReduction\ on/RepeatedMsgReduction\ off/' /etc/rsyslog.conf
sudo service rsyslog restart
sudo service fail2ban restart
답변2
Failed password for root
SSH용 FAIL2BAN 필터의 세 번째 항목과 올바르게 일치하며 수정되었습니다.https://github.com/fail2ban/fail2ban/commit/750e0c1e3dbce856437c115142d57f18b6c1fac7.
message repeated 5 times
syslog 변경 사항에 따라 수정된 중복된 메시지의 결과입니다(fail2ban 재시작이 필요하지 않음).
PAM 5....
일치할 수 있지만 이는 첫 번째 "실패한 비밀번호.." 로그 메시지와 중복되므로 의미가 없습니다.
무언가를 발견하면 다음에 대한 정규식이 필요합니다.
fail2ban-regex -D 'log line' /etc/fail2ban/filter.d/sshd.conf
그리고 일치해야 하는 정규식 근처의 URL을 사용하고 일치할 때까지 편집합니다.