我有 Debian 10，带有 iptables 的 Fail2Ban v0.10.6 和我的过滤器<SUBNET>。现在我有 Ubuntu 22.04，Fail2Ban v0.11.2，我试图让它与 nftables 一起工作。jail.local我只为 nftables添加。我的配置：
# /etc/fail2ban/fail2ban.conf
[DEFAULT]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 1d
dbmaxmatches = 10
[Definition]
[Thread]
# /etc/fail2ban/jail.local
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports
# /etc/fail2ban/jail.d/00-geologger.conf
[geologger]
enabled = true
__name__ = geologger
filter = geologger
action = %(action_)s
port = ssh,2222,smtp,465,submission
logpath = /var/log/geologger.log
backend = %(default_backend)s
bantime = 1m
maxretry = 1
findtime = 30m
# /etc/fail2ban/filter.d/geologger.conf
[INCLUDES]
before = common.conf
[Definition]
mode = normal
failregex = ipv4_addr=\([\d\./:]+-<SUBNET>\).*$
ignoreregex =
# nft list ruleset:
table ip filter {
chain INPUT {
}
chain FORWARD {
}
chain f2b-geologger {
}
}
table inet f2b-table {
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
}
}
这是来自 fail2ban.log 的错误：
2023-02-03 14:09:18,948 fail2ban.filter [3985]: INFO [geologger] Found 178.127.150.0/24 - 2023-02-03 14:09:18
2023-02-03 14:09:19,552 fail2ban.actions [3985]: NOTICE [geologger] Ban 178.127.150.0/24
2023-02-03 14:09:19,673 fail2ban.utils [3985]: ERROR 7fc55d851980 -- exec: nft add table inet f2b-table
nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}
nft add set inet f2b-table addr-set-geologger \{ type ipv4_addr\; \}
for proto in $(echo 'tcp' | sed 's/,/ /g'); do
nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'ssh,2222,smtp,465,submission' | sed s/:/-/g) \} ip saddr @addr-set-geologger reject
done
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'Error: Could not process rule: Numerical result out of range'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'add set inet f2b-table addr-set-geologger { type ipv4_addr; }'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'Error: No such file or directory'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'add rule inet f2b-table f2b-chain tcp dport { ssh,2999,smtp,465,submission } ip saddr @addr-set-geologger reject'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: ' ^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- returned 1
2023-02-03 14:09:19,674 fail2ban.actions [3985]: ERROR Failed to execute ban jail 'geologger' action 'nftables-multiport' info 'ActionInfo({'ip': '178.127.150.0/24', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7fc55efa4940>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7fc55efa5000>})': Error starting action Jail('geologger')/nftables-multiport: 'Script error'
如何解决？
