URL: https://linuxfr.org/forums/linux-debian-ubuntu/posts/fail2ban-ninvoque-pas-iptables
Title: fail2ban n'invoque pas iptables
Authors: eldiablo
Date: 2010年04月12日T02:25:54+02:00
Tags: debian
Score: 0
Bonjour à tous !
Afin de renforcer la sécurité d'un serveur, je cherche mettre en place fail2ban.
Notre but est de bloquer une IP pendant 4 heures si on a 6 échecs de connexion sur cinq minutes.
Le serveur dont il est question ici est une Debian Lenny.
La version du package utilisé est bien la dernière pour Lenny : 0.8.3-2sid1
Hélas, lors des tests, fail2ban n'a banni aucune IP.
Extrait de /var/log/auth.log :
(...)
Apr 11 22:45:18 xxx sshd[28514]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh (...)
Apr 11 22:45:21 xxx sshd[28514]: Failed password for invalid user elis from xxx.xxx.xxx.xxx port 36988 ssh2
Apr 11 22:45:22 xxx sshd[28517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh (...)
Apr 11 22:45:23 xxx sshd[28517]: Failed password for invalid user elis from xxx.xxx.xxx.xxx port 37418 ssh2
(...)
Extrait de /var/log/fail2ban.log :
(...)
2010年04月11日 22:45:22,596 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2010年04月11日 22:45:22,597 fail2ban.filter.datedetector: DEBUG Sorting the template list
2010年04月11日 22:45:27,597 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2010年04月11日 22:45:27,597 fail2ban.filter.datedetector: DEBUG Sorting the template list
(...)
Or, fail2ban me semble configuré correctement.
Extrait de /etc/fail2ban/jail.conf :
[DEFAULT]
ignoreip = 127.0.0.1
findtime = 300
bantime = 14400
maxretry = 6
backend = polling
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
Extrait de /etc/fail2ban/filter.d/ :
[INCLUDES]
before = common.conf
[Definition]
_daemon = sshd
failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$
£spaces£ £/spaces£^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$
£spaces£ £/spaces£^%(__prefix_line)sFailed (?:password|publickey) for .* from (?: port \d*)?(?: ssh\d*)?$
£spaces£ £/spaces£^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$
£spaces£ £/spaces£^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from \s*$
£spaces£ £/spaces£^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers$
£spaces£ £/spaces£^%(__prefix_line)sUser .+ from not allowed because none of user's groups are listed in AllowGroups\s*$
£spaces£ £/spaces£^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.*)?\s*$
£spaces£ £/spaces£^%(__prefix_line)srefused connect from \S+ \(\)\s*$
£spaces£ £/spaces£^%(__prefix_line)sAddress .* POSSIBLE BREAK-IN ATTEMPT\s*$
J'ai testé avec "fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf"
fail2ban a détecté correctement les différentes erreurs.
Une dizaine d'IPs remplissaient les conditions pour un ban.
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/auth.log
Results
=======
Failregex
| (...)
|
`- Number of matches:
£spaces£ £/spaces£[1] 0 match(es)
£spaces£ £/spaces£[2] 0 match(es)
£spaces£ £/spaces£[3] 1713 match(es)
£spaces£ £/spaces£[4] 0 match(es)
£spaces£ £/spaces£[5] 1079 match(es)
£spaces£ £/spaces£[6] 0 match(es)
£spaces£ £/spaces£[7] 0 match(es)
£spaces£ £/spaces£[8] 0 match(es)
£spaces£ £/spaces£[9] 0 match(es)
£spaces£ £/spaces£[10] 0 match(es)
Quelqu'un aurait-il une piste ?
Merci d'avance,