Re: Fail2ban? - LinuxFr.org

[^] # Re: Fail2ban?

Posté par rycks le 27 mai 2016 à 13:38. En réponse au message serveur kimsufi inaccessible pendant quelques minutes .... Évalué à 1.

Hello NeoX, ça progresse, j'ai un tcpdump qui donne ça:

13:34:48.199847 IP chezmoi.52413 > serveur_kimsufi.https: Flags [S], seq 1930877214, win 14600, options [mss 1460,sackOK,TS val 47366809 ecr 0,nop,wscale 6], length 0
13:34:48.199887 IP serveur_kimsufi.https > chezmoi.52413: Flags [S.], seq 2960920737, ack 1930877215, win 28960, options [mss 1460,sackOK,TS val 155095627 ecr 47366809,nop,wscale 7], length 0
13:34:48.233323 IP chezmoi.52413 > serveur_kimsufi.https: Flags [.], ack 1, win 229, options [nop,nop,TS val 47366818 ecr 155095627], length 0
13:34:48.234156 IP chezmoi.52413 > serveur_kimsufi.https: Flags [P.], seq 1:518, ack 1, win 229, options [nop,nop,TS val 47366818 ecr 155095627], length 517
13:34:48.234196 IP serveur_kimsufi.https > chezmoi.52413: Flags [.], ack 518, win 235, options [nop,nop,TS val 155095635 ecr 47366818], length 0
13:34:48.234969 IP serveur_kimsufi.https > chezmoi.52413: Flags [P.], seq 1:138, ack 518, win 235, options [nop,nop,TS val 155095635 ecr 47366818], length 137
13:34:48.268590 IP chezmoi.52413 > serveur_kimsufi.https: Flags [.], ack 138, win 245, options [nop,nop,TS val 47366827 ecr 155095635], length 0
13:34:48.269093 IP chezmoi.52413 > serveur_kimsufi.https: Flags [P.], seq 518:569, ack 138, win 245, options [nop,nop,TS val 47366827 ecr 155095635], length 51
13:34:48.271992 IP chezmoi.52413 > serveur_kimsufi.https: Flags [P.], seq 569:2209, ack 138, win 245, options [nop,nop,TS val 47366827 ecr 155095635], length 1640
13:34:48.272016 IP serveur_kimsufi.https > chezmoi.52413: Flags [.], ack 2209, win 261, options [nop,nop,TS val 155095645 ecr 47366827], length 0
13:34:48.307082 IP serveur_kimsufi.https > chezmoi.52413: Flags [P.], seq 138:932, ack 2209, win 261, options [nop,nop,TS val 155095653 ecr 47366827], length 794
13:34:48.380328 IP chezmoi.52413 > serveur_kimsufi.https: Flags [.], ack 932, win 270, options [nop,nop,TS val 47366855 ecr 155095653], length 0
13:34:49.809429 IP serveur_kimsufi.https > 193.50.102.131.51194: Flags [F.], seq 18580, ack 792, win 245, length 0
13:34:49.863651 IP serveur_kimsufi.https > 193.50.102.131.51194: Flags [.], ack 823, win 245, length 0
13:34:53.312265 IP serveur_kimsufi.https > chezmoi.52413: Flags [F.], seq 932, ack 2209, win 261, options [nop,nop,TS val 155096905 ecr 47366855], length 0
13:34:53.341454 IP chezmoi.52413 > serveur_kimsufi.https: Flags [P.], seq 2209:2240, ack 932, win 270, options [nop,nop,TS val 47368095 ecr 155095653], length 31
13:34:53.341953 IP chezmoi.52413 > serveur_kimsufi.https: Flags [F.], seq 2240, ack 932, win 270, options [nop,nop,TS val 47368095 ecr 155095653], length 0
13:34:53.341979 IP serveur_kimsufi.https > chezmoi.52413: Flags [.], ack 2241, win 261, options [nop,nop,TS val 155096912 ecr 47368095], length 0
13:34:53.345215 IP chezmoi.52413 > serveur_kimsufi.https: Flags [.], ack 933, win 270, options [nop,nop,TS val 47368096 ecr 155096905], length 0
13:34:59.881955 IP serveur_kimsufi.https > 193.50.102.131.51194: Flags [.], ack 823, win 245, length 0
13:35:00.646415 IP chezmoi.49201 > serveur_kimsufi.https: Flags [S], seq 2358183730, win 29200, options [mss 1460,sackOK,TS val 28768 ecr 0,nop,wscale 7], length 0
13:35:03.629235 IP chezmoi.62889 > serveur_kimsufi.https: Flags [S], seq 804453984, win 29200, options [mss 1460,sackOK,TS val 29513 ecr 0,nop,wscale 7], length 0
13:35:04.549683 IP chezmoi.63471 > serveur_kimsufi.https: Flags [S], seq 1241973132, win 29200, options [mss 1460,sackOK,TS val 29744 ecr 0,nop,wscale 7], length 0
13:35:04.625256 IP chezmoi.62889 > serveur_kimsufi.https: Flags [S], seq 804453984, win 29200, options [mss 1460,sackOK,TS val 29763 ecr 0,nop,wscale 7], length 0
13:35:04.805408 IP chezmoi.49893 > serveur_kimsufi.https: Flags [S], seq 3898300547, win 29200, options [mss 1460,sackOK,TS val 29808 ecr 0,nop,wscale 7], length 0
13:35:06.629307 IP chezmoi.62889 > serveur_kimsufi.https: Flags [S], seq 804453984, win 29200, options [mss 1460,sackOK,TS val 30264 ecr 0,nop,wscale 7], length 0
13:35:09.900887 IP serveur_kimsufi.https > 193.50.102.131.51194: Flags [R], seq 290896853, win 0, length 0
13:35:10.636678 IP chezmoi.62889 > serveur_kimsufi.https: Flags [S], seq 804453984, win 29200, options [mss 1460,sackOK,TS val 31266 ecr 0,nop,wscale 7], length 0

Et un tail -f sur mon fichier apache *.log (erreur ou access) ne donne RIEN, c'est zarb, je reçois des paquets sur le port 443 mais apache semble ne rien voir arriver ...

Ça vous fait penser à un truc ?

Je continue de creuser !

eric.linuxfr@sud-ouest.org