這個問題讓我發瘋。我配置了一個監獄來防止過多的 http post 到我的網頁伺服器。
似乎fail2ban伺服器接受了我的新監獄，但在fail2ban伺服器中沒有任何效果。
以下是我的 jam.local 配置的一部分（順便說一句，fail2ban 中的 sshd 運作得很好）。
#global setting
bantime = 1h
findtime = 1h
maxretry = 5
backend = systemd
banaction = firewallcmd-rich-rules[actiontype=]
banaction_allports = firewallcmd-rich-rules[actiontype=]
[sshd]
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode = normal
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
[webpost]
enabled = true
filter = webpost
logpath = /var/log/message
以下是filter.d/資料夾中的webpost.conf：
[Definition]
failregex = ^.*myserver python3.6\[.*\]: <HOST> - - \[.*\] ".*POST \/enquiry HTTP.*".*-$
ignoreregex =
datepattern = ^%%b %%d %%H:%%M:%%S
fail2ban 中的正規表示式測試正在運行，輸出如下：
fail2ban-regex /var/log/messages /etc/fail2ban/filter.d/webpost.conf
Running tests
=============
Use failregex filter file : webpost, basedir: /etc/fail2ban
Use datepattern : ^%b %d %H:%M:%S : ^MON Day 24hour:Minute:Second
Use log file : /var/log/messages
Use encoding : UTF-8
Results
=======
Failregex: 115 total
|- #) [# of hits] regular expression
| 1) [115] ^.*myserver python3.6\[.*\]: <HOST> - - \[.*\] ".*POST \/enquiry HTTP.*".*-$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [115989] ^MON Day 24hour:Minute:Second
`-
Lines: 115989 lines, 0 ignored, 115 matched, 115874 missed
[processed in 2.65 sec]
fail2ban 日誌也會顯示所有已載入且運作正常的內容。
2023-09-07 17:27:09,868 fail2ban.filtersystemd [969]: NOTICE [webpost] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
2023-09-07 17:27:10,061 fail2ban.filtersystemd [969]: INFO [webpost] Jail is in operation now (process new journal entries)
2023-09-07 17:27:10,063 fail2ban.jail [969]: INFO Jail 'webpost' started
在我向我的網站發送大量 http post 請求後，fail2ban 似乎沒有檢測到 /var/log/message 中的任何 http post 請求。 fail2ban 僅偵測 sshd 嘗試。完全沒有偵測到任何網路貼文！
2023-09-07 17:36:46,206 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:45
2023-09-07 17:36:48,739 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:48
2023-09-07 17:36:52,034 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:51
2023-09-07 17:36:55,241 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:36:54
2023-09-07 17:37:57,290 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:37:56
2023-09-07 17:37:57,769 fail2ban.actions [969]: NOTICE [sshd] Ban 180.101.88.228
2023-09-07 17:37:57,795 fail2ban.filter [969]: INFO [pam-generic] Found 180.101.88.228 - 2023-09-07 17:37:57
2023-09-07 17:37:59,280 fail2ban.filter [969]: INFO [sshd] Found 180.101.88.228 - 2023-09-07 17:37:58
我不知道問題出在哪裡。
答案1
fail2ban.filtersystemd [969]: NOTICE [webpost] Jail started without 'journalmatch' set...
您的預設值backend似乎是systemd，這意味著它會監視 systemd 日誌而不是日誌路徑。
只需添加backend = auto到監獄：
[webpost]
...
logpath = /var/log/message
+ backend = auto