이 문제는 나를 미치게 만든다. 내 웹 서버에 과도한 http 게시를 방지하기 위해 감옥을 구성했습니다.
Fail2ban 서버가 내 새 감옥을 수락하는 것 같지만 Fail2ban 서버에서는 아무것도 적용되지 않습니다.
다음은 내 Jail.local 구성의 일부입니다(fail2ban의 sshd는 완벽하게 작동합니다).
#global setting
bantime = 1h
findtime = 1h
maxretry = 5
backend = systemd
banaction = firewallcmd-rich-rules[actiontype=]
banaction_allports = firewallcmd-rich-rules[actiontype=]
[sshd]
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode = normal
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
[webpost]
enabled = true
filter = webpost
logpath = /var/log/message
다음은 filter.d/ 폴더의 webpost.conf입니다.
[Definition]
failregex = ^.*myserver python3.6\[.*\]: <HOST> - - \[.*\] ".*POST \/enquiry HTTP.*".*-$
ignoreregex =
datepattern = ^%%b %%d %%H:%%M:%%S
Fail2ban의 정규식 테스트가 작동 중이며 출력은 다음과 같습니다.
fail2ban-regex /var/log/messages /etc/fail2ban/filter.d/webpost.conf
Running tests
=============
Use failregex filter file : webpost, basedir: /etc/fail2ban
Use datepattern : ^%b %d %H:%M:%S : ^MON Day 24hour:Minute:Second
Use log file : /var/log/messages
Use encoding : UTF-8
Results
=======
Failregex: 115 total
|- #) [# of hits] regular expression
| 1) [115] ^.*myserver python3.6\[.*\]: <HOST> - - \[.*\] ".*POST \/enquiry HTTP.*".*-$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [115989] ^MON Day 24hour:Minute:Second
`-
Lines: 115989 lines, 0 ignored, 115 matched, 115874 missed
[processed in 2.65 sec]
Fail2ban 로그에는 모든 것이 로드되고 제대로 작동했음을 보여줍니다.
2023-09-07 17:27:09,868 fail2ban.filtersystemd [969]: NOTICE [webpost] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
2023-09-07 17:27:10,061 fail2ban.filtersystemd [969]: INFO [webpost] Jail is in operation now (process new journal entries)
2023-09-07 17:27:10,063 fail2ban.jail [969]: INFO Jail 'webpost' started
내 웹사이트에 많은 http 게시물 요청을 보낸 후 Fail2ban이 /var/log/message에서 http 게시물을 감지하지 못한 것처럼 보입니다. Fail2ban은 sshd 시도만 감지합니다. 웹 게시물이 전혀 감지되지 않습니다!
2023-09-07 17:36:46,206 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:45
2023-09-07 17:36:48,739 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:48
2023-09-07 17:36:52,034 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:51
2023-09-07 17:36:55,241 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:54
2023-09-07 17:37:57,290 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:37:56
2023-09-07 17:37:57,769 fail2ban.actions [969]: NOTICE [sshd] Ban 180.101.88.228
2023-09-07 17:37:57,795 fail2ban.filter [969]: INFO [pam-generic] Found 180.101.88.228 - 2023-09-07 17:37:57
2023-09-07 17:37:59,280 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:37:58
문제가 어디에 있는지 모르겠습니다.
답변1
fail2ban.filtersystemd [969]: NOTICE [webpost] Jail started without 'journalmatch' set...
기본값은 로그 경로가 아닌 시스템 저널을 모니터링한다는 의미 backend입니다 .systemd
backend = auto감옥에 추가하기만 하면 됩니다 :
[webpost]
...
logpath = /var/log/message
+ backend = auto