Estou tentando fazer com que o Fail2Ban funcione com a configuração SSHD fornecida.
Quando corro:
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
A saída é:
root@fw:/etc/fail2ban/filter.d# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/auth.log
Results
=======
Failregex: 5583 total
|- #) [# of hits] regular expression
| 3) [4339] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*Failed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ (?:[\da-f]{2}:){15}[\da-f]{2}(, client user ".*", client host ".*")?))?\s*$
| 5) [1244] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [19480] MONTH Day Hour:Minute:Second
`-
Lines: 19480 lines, 0 ignored, 5583 matched, 13897 missed
Missed line(s):: too many to print. Use --print-all-missed to print all 13897 lines
root@fw:/etc/fail2ban/filter.d#
Meu auth.log se parece com isto (exemplo):
Oct 21 04:47:44 fw sshd[31558]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:44 fw sshd[31558]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:44 fw sshd[31558]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:46 fw sshd[31562]: Failed password for root from 218.2.0.125 port 12277 ssh2
Oct 21 04:47:46 fw sshd[31581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:48 fw sshd[31560]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 9188 ssh2]
Oct 21 04:47:48 fw sshd[31560]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:48 fw sshd[31560]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:48 fw sshd[31560]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:48 fw sshd[31581]: Failed password for root from 218.2.0.125 port 13148 ssh2
Oct 21 04:47:52 fw sshd[31595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:55 fw sshd[31595]: Failed password for root from 218.2.0.125 port 14409 ssh2
Oct 21 04:47:55 fw CRON[31494]: pam_unix(cron:session): session closed for user clamav
Oct 21 04:47:59 fw sshd[31562]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 12277 ssh2]
Oct 21 04:47:59 fw sshd[31562]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31562]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:59 fw sshd[31562]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:59 fw sshd[31581]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 13148 ssh2]
Oct 21 04:47:59 fw sshd[31581]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31581]: fatal: Write failed: Connection reset by peer [preauth]
Oct 21 04:47:59 fw sshd[31581]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125 user=root
Oct 21 04:47:59 fw sshd[31581]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:48:00 fw sshd[31595]: message repeated 2 times: [ Failed password for root from 218.2.0.125 port 14409 ssh2]
Eu sei que há entradas que deveriam corresponder, mas simplesmente não consigo fazer com que correspondam.
Depois de pesquisar, descobri que pode ser devido ao formato da data, mas as alterações sugeridas common.confnão fizeram nenhuma diferença.
Além disso, executei um manual fail2ban-regexcom o formato de data de auth.log e ele retornou conforme o esperado.
Responder1
Parece que há correspondências, mas não o suficiente.Bug do Debian #620364provavelmente é o culpado. A solução alternativa, documentada nowiki sobre fail2baneEstouro de pilha, é desativar a redução de mensagens repetidas no rsyslog:
sudo sed -i 's/RepeatedMsgReduction\ on/RepeatedMsgReduction\ off/' /etc/rsyslog.conf
sudo service rsyslog restart
sudo service fail2ban restart
Responder2
Failed password for root
Corresponde corretamente à terceira entrada no filtro fail2ban para ssh e foi corrigidohttps://github.com/fail2ban/fail2ban/commit/750e0c1e3dbce856437c115142d57f18b6c1fac7.
message repeated 5 times
É uma consequência das mensagens duplicadas que são corrigidas de acordo com as alterações do syslog (e não requer reinicialização do fail2ban).
PAM 5....
Poderia ser correspondido, no entanto, isso seria uma duplicata das primeiras mensagens de log "Falha na senha.." e não faz sentido.
Se você encontrar algo para o qual precisa de uma regex:
fail2ban-regex -D 'log line' /etc/fail2ban/filter.d/sshd.conf
E use os URLs próximos ao regex que devem corresponder e edite-os até que correspondam.