Заметил в логах перебор паролей на ftp сервере (proftpd) - решил банить учасников перебора.
Из всевозможного софта выбрал /usr/ports/security/py-fail2ban.
В системе как фаервол юзается PF.
Думаю что связка py-fail2ban + PF всем известна.
- парсим лог
- злоумышленников добавляем в таблицу PF
- в PF настраиваем бан из этой таблицы на определенные порты и т.д.
В разрезе PF все отлично работает, через консоль указанная IP попадает в таблицу и получает нужный бан.
Вопрос возникает с fail2ban:
jail.conf
Код: Выделить всё
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 600
findtime = 600
maxretry = 5
backend = auto
[proftpd-pf]
enabled = true
filter = proftpd
action = pf[table=ftp-ban-ip]
logpath = /var/log/proftpd.access_log
maxretry = 4
bantime = 3600Код: Выделить всё
[Definition]
actionstart = /sbin/pfctl -t <table> -T add <ip>
actionstop =
actioncheck =
actionban = /sbin/pfctl -t <table> -T add <ip>
actionunban =
Код: Выделить всё
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
# failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
# \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
# \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
# \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$
# \^<HOST> .* .* .*PASS.* 530
failregex = <HOST> .* .* .*PASS.* 530
ignoreregex =
Лог:
Код: Выделить всё
111.222.333.444 UNKNOWN ftp [16/May/2011:15:00:28 +0300] "USER user" 331 -
111.222.333.444 UNKNOWN ftp [16/May/2011:15:00:28 +0300] "PASS (hidden)" 530 -
111.222.333.444 UNKNOWN ftp [16/May/2011:15:00:28 +0300] "USER user" 331 -
111.222.333.444 UNKNOWN ftp [16/May/2011:15:00:28 +0300] "PASS (hidden)" 530 -
Код: Выделить всё
...
failregex = <HOST> .* .* .*PASS.* 530
...
Код: Выделить всё
fail2ban-regex /var/log/proftpd.access_log "<HOST> .* .* .*PASS.* 530"
/usr/local/lib/python2.6/site-packages/server/filter.py:442: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import md5
Running tests
=============
Use regex line : <HOST> .* .* .*PASS.* 530
Use log file : /var/log/proftpd.access_log
Results
=======
Failregex
|- Regular expressions:
| [1] <HOST> .* .* .*PASS.* 530
|
`- Number of matches:
[1] 65 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
...
111.222.333.444 (Sun May 08 06:04:09 2011)
111.222.333.444 (Sun May 08 06:04:09 2011)
111.222.333.444 (Sun May 08 06:04:09 2011)
111.222.333.444 (Sun May 08 06:04:09 2011)
...
Date template hits:
1 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
3885 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>
Success, the total number of match is 65
However, look at the above section 'Running tests' which could contain important
information.
Далее т.к. в /action.d/pf.conf стоит
Код: Выделить всё
actionstart = /sbin/pfctl -t <table> -T add <ip>
Код: Выделить всё
2011-05-17 10:05:19,749 fail2ban.comm : DEBUG Command: ['stop']
2011-05-17 10:05:19,939 fail2ban.actions: DEBUG Flush ban list
2011-05-17 10:05:19,939 fail2ban.actions.action: DEBUG
2011-05-17 10:05:19,942 fail2ban.actions.action: DEBUG returned successfully
2011-05-17 10:05:19,942 fail2ban.actions: DEBUG proftpd-pf: action terminated
2011-05-17 10:05:20,000 fail2ban.filter : DEBUG proftpd-pf: filter terminated
2011-05-17 10:05:20,000 fail2ban.jail : INFO Jail 'proftpd-pf' stopped
2011-05-17 10:05:20,000 fail2ban.server : DEBUG Removed socket file /var/run/fail2ban/fail2ban.sock
2011-05-17 10:05:20,001 fail2ban.server : DEBUG Socket shutdown
2011-05-17 10:05:20,001 fail2ban.server : DEBUG Remove PID file /var/run/fail2ban/fail2ban.pid
2011-05-17 10:05:20,001 fail2ban.server : INFO Exiting Fail2ban
2011-05-17 10:05:22,441 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.4
2011-05-17 10:05:22,442 fail2ban.comm : DEBUG Command: ['add', 'proftpd-pf', 'auto']
2011-05-17 10:05:22,442 fail2ban.jail : INFO Creating new jail 'proftpd-pf'
2011-05-17 10:05:22,443 fail2ban.jail : INFO Jail 'proftpd-pf' uses poller
2011-05-17 10:05:22,460 fail2ban.filter : DEBUG Created Filter
2011-05-17 10:05:22,460 fail2ban.filter : DEBUG Created FilterPoll
2011-05-17 10:05:22,461 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'addlogpath', '/var/log/proftpd.access_log']
2011-05-17 10:05:22,461 fail2ban.filter : INFO Added logfile = /var/log/proftpd.access_log
2011-05-17 10:05:22,461 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'maxretry', '4']
2011-05-17 10:05:22,462 fail2ban.filter : INFO Set maxRetry = 4
2011-05-17 10:05:22,462 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'addignoreip', '127.0.0.1']
2011-05-17 10:05:22,462 fail2ban.filter : DEBUG Add 127.0.0.1 to ignore list
2011-05-17 10:05:22,463 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'findtime', '600']
2011-05-17 10:05:22,463 fail2ban.filter : INFO Set findtime = 600
2011-05-17 10:05:22,464 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'bantime', '3600']
2011-05-17 10:05:22,464 fail2ban.actions: INFO Set banTime = 3600
2011-05-17 10:05:22,464 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'addfailregex', '<HOST> .* .* .*PASS.* 530']
2011-05-17 10:05:22,466 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'addaction', 'pf']
2011-05-17 10:05:22,466 fail2ban.actions.action: DEBUG Created Action
2011-05-17 10:05:22,467 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'actionban', 'pf', '/sbin/pfctl -t <table> -T add <ip>']
2011-05-17 10:05:22,467 fail2ban.actions.action: DEBUG Set actionBan = /sbin/pfctl -t <table> -T add <ip>
2011-05-17 10:05:22,467 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'actionstop', 'pf', '']
2011-05-17 10:05:22,467 fail2ban.actions.action: DEBUG Set actionStop =
2011-05-17 10:05:22,468 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'actionstart', 'pf', '/sbin/pfctl -t <table> -T add <ip>']
2011-05-17 10:05:22,468 fail2ban.actions.action: DEBUG Set actionStart = /sbin/pfctl -t <table> -T add <ip>
2011-05-17 10:05:22,469 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'actionunban', 'pf', '']
2011-05-17 10:05:22,469 fail2ban.actions.action: DEBUG Set actionUnban =
2011-05-17 10:05:22,469 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'actioncheck', 'pf', '']
2011-05-17 10:05:22,469 fail2ban.actions.action: DEBUG Set actionCheck =
2011-05-17 10:05:22,470 fail2ban.comm : DEBUG Command: ['set', 'proftpd-pf', 'setcinfo', 'pf', 'table', 'ftp-ban-ip']
2011-05-17 10:05:22,470 fail2ban.comm : DEBUG Command: ['start', 'proftpd-pf']
2011-05-17 10:05:22,471 fail2ban.filter : DEBUG /var/log/proftpd.access_log has been modified
2011-05-17 10:05:22,471 fail2ban.jail : INFO Jail 'proftpd-pf' started
2011-05-17 10:05:22,471 fail2ban.actions.action: DEBUG /sbin/pfctl -t ftp-ban-ip -T add <ip>
2011-05-17 10:05:22,474 fail2ban.filter.datedetector: DEBUG Sorting the template list
2011-05-17 10:05:22,476 fail2ban.actions.action: ERROR /sbin/pfctl -t ftp-ban-ip -T add <ip> returned 200
Код: Выделить всё
2011-05-17 10:05:22,476 fail2ban.actions.action: ERROR /sbin/pfctl -t ftp-ban-ip -T add <ip> returned 200
Думаю что я не верно написал фильтр для анализа лога.
Помогите решить данный вопрос ...
