13
我剛剛注意到我的服務器上有一個ssh bruteforce，實際上它應該被fail2ban禁止，但由於某種原因它並沒有禁止它。大多數遇到fail2ban問題的人似乎都遇到了他們的正則表達式問題，這在這裏似乎沒有問題。fail2ban不禁止ssh bruteforce但正則表達式工作
部分的jail.conf
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
findtime = 6000
bantime = 86400
的fail2ban-客戶端狀態的ssh
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 0
| `- Total failed: 0
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0
的fail2ban正則表達式/var/log/auth.log的/ etc /的fail2ban /過濾器.d/sshd.conf
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/auth.log
Results
=======
Failregex
|- Regular expressions:
| [1] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM:)?Authentication failure for .* from <HOST>\s*$
| [2] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM:)?User not known to the underlying authentication module for .* from <HOST>\s*$
| [3] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Failed (?:password|publickey) for .* from <HOST>(?: port \d*)?(?: ssh\d*)?$
| [4] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*ROOT LOGIN REFUSED.* FROM <HOST>\s*$
| [5] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
| [6] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because not listed in AllowUsers$
| [7] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*authentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
| [8] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*refused connect from \S+ \(<HOST>\)\s*$
| [9] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S
+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*Address <HOST> .* POSSIBLE BREAK-IN ATTEMPT!*\s*$
| [10] ^\s*(?:\S+)?(?:kernel: \[\d+\.\d+\])?(?:@vserver_\S+)?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\
S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 380 match(es)
[4] 0 match(es)
[5] 353 match(es)
[6] 26 match(es)
[7] 0 match(es)
[8] 0 match(es)
[9] 0 match(es)
[10] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
[2]
[3]
198.245.50.151 (Sat Dec 21 15:18:12 2013)
198.245.50.151 (Sat Dec 21 15:18:15 2013)
198.245.50.151 (Sat Dec 21 15:18:18 2013)
198.245.50.151 (Sat Dec 21 15:18:21 2013)
198.245.50.151 (Sat Dec 21 15:18:24 2013)
..................
Date template hits:
23379 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
..................
Success, the total number of match is 759
任何想法，爲什麼fail2ban不禁止，即使我有很多正則表達式匹配？
問候， 魚
謝謝你的建議。一個NTP客戶端正在運行，至少/var/log/auth.log和/var/log/fail2ban.log使用相同的時區。但你可能是對的，我會嘗試尋找時區問題。 – fish
與__owncloud 9__有同樣的問題，日期格式確實是罪魁禍首。它在owncloud的配置文件中設置爲_UTC_。 –