|
Rozmiar: 6235
Komentarz: INIT
|
Rozmiar: 0
Komentarz: Ponowne utworzenie z szablonu
|
| Usunięcia zostały oznaczone w ten sposób. | Dodatki zostały oznaczone w ten sposób. |
| Linia 1: | Linia 1: |
| #format wiki #language pl <<TableOfContents>> = Konfiugracja fail2ban = W ports pojawił się bardzo fajny skrypt napisany w [[http://www.python.org|pythonie|target="_blank"]], który powoduje dopisywanie regułek blokujących dla adresów IP, które próbują atakować serwer. == Konfiguracja globalna == Konfiguracja globalna to dwa pliki: {{{#!shell /usr/local/etc/fail2ban/fail2ban.conf /usr/local/etc/fail2ban/jail.conf }}} === JAIL === Nie należy odnosić tego do mechanizmu jail(8). Jest to raczej sparowanie akcji oraz sposobu filtrowania wraz z ustawieniami, jaki plik logu należy przeglądać. == Akcje == Akcje (czyli co robić, jeżeli wystąpi zdarzenie) zapisane są w podkatalogu `action.d/`. Każda usługa (np. bsd-ipfw) jest zapisany w stosownym pliku `.conf`. == Filtry == Co należy filtrować (REGEXPy), których należy poszukiwać w logach, aby uruchomić akcję ''banowania''. == Poprawki dla FreeBSD == Niestety fail2ban powstał głównie z myślą o Linuxie oraz iptables. Dlatego też trzeba odpowiednio połatać konfigurację specyficznie dla FreeBSD. Oto różnice (patche): === fail2ban.conf === {{{#!diff numbers=off --- fail2ban.conf.orig 2010-02-25 15:00:00.000000000 +0100 +++ fail2ban.conf 2010-02-25 14:52:22.000000000 +0100 @@ -22,7 +22,7 @@ # Only one log target can be specified. # Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log # -logtarget = /var/log/fail2ban.log +logtarget = /var/log/fail2ban/fail2ban.log # Option: socket # Notes.: Set the socket file. This is used to communicate with the daemon. Do }}} === jail.conf === {{{#!diff numbers=off --- jail.conf.orig 2012-08-01 03:45:04.000000000 +0200 +++ jail.conf 2012-12-08 02:24:25.000000000 +0100 @@ -23,14 +23,14 @@ ignoreip = 127.0.0.1/8 # "bantime" is the number of seconds that a host is banned. -bantime = 600 +bantime = 1200 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. -findtime = 600 +findtime = 60 # "maxretry" is the number of failures before a host get banned. -maxretry = 3 +maxretry = 2 # "backend" specifies the backend used to get files modification. # Available options are "pyinotify", "gamin", "polling" and "auto". @@ -219,12 +219,11 @@ [ssh-ipfw] -enabled = false +enabled = true filter = sshd -action = ipfw[localhost=192.168.0.1] - sendmail-whois[name="SSH,IPFW", dest=you@example.com] +action = ipfw[localhost=37.59.20.105] logpath = /var/log/auth.log -ignoreip = 168.192.0.1 +ignoreip = 91.121.4.86 62.111.156.254 # These jails block attacks against named (bind9). By default, logging is off # with bind9 installation. You will need something like this: }}} === action.d/ipfw.conf === {{{#!diff numbers=off --- ipfw.conf.orig 2012-08-01 03:45:04.000000000 +0200 +++ ipfw.conf 2012-12-08 02:14:46.000000000 +0100 @@ -12,14 +12,14 @@ # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # -actionstart = +actionstart = ipfw add 64000 deny ip from table\(22\) to any # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # -actionstop = +actionstop = ipfw delete 64000 # Option: actioncheck @@ -37,7 +37,7 @@ # <time> unix timestamp of the ban time # Values: CMD # -actionban = ipfw add deny tcp from <ip> to <localhost> <port> +actionban = ipfw table 22 add <ip> # Option: actionunban @@ -48,7 +48,7 @@ # <time> unix timestamp of the ban time # Values: CMD # -actionunban = ipfw delete `ipfw list | grep -i <ip> | awk '{print $1;}'` +actionunban = ipfw table 22 delete <ip> [Init] @@ -62,4 +62,4 @@ # Notes.: the local IP address of the network interface # Values: IP # -localhost = 127.0.0.1 +localhost = 37.59.20.105176.241.247.193 }}} A następnie bsd-ipfw.conf przekopiować jako ipfw.conf === filter.d/ssh.conf === {{{#!diff numbers=off --- sshd.conf.orig 2008-05-12 10:31:56.000000000 +0200 +++ sshd.conf 2010-02-25 15:06:49.000000000 +0100 @@ -2,7 +2,7 @@ # # Author: Cyril Jaquier # -# $Revision: 663 $ +# $Revision: 728 $ # [INCLUDES] @@ -20,17 +20,20 @@ # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for -# (?:::f{4,6}:)?(?P<host>\S+) +# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) # Values: TEXT # -failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$ - ^%(__prefix_line)sFailed [-/\w]+ for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$ +failregex = ^%(__prefix_line)s(?:error: PAM: )?[A|a]uthentication (?:failure|error) for .* from <HOST>\s*$ + ^%(__prefix_line)sDid not receive identification string from <HOST>$ + ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$ + ^%(__prefix_line)sFailed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$ ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$ ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$ ^%(__prefix_line)sUser \S+ from <HOST> not allowed because not listed in AllowUsers$ ^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$ ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$ - ^%(__prefix_line)sAddress <HOST> .* POSSIBLE BREAK-IN ATTEMPT\s*$ + ^%(__prefix_line)sreverse mapping checking getaddrinfo for .* \[<HOST>\] .* POSSIBLE BREAK-IN ATTEMPT!$ + ^%(__prefix_line)sUser \S+ from <HOST> not allowed because none of user's groups are listed in AllowGroups$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. }}} (tak naprawdę wystarczy skopiować bsd-sshd.conf jako sshd.conf). HOST |
