主页 / user-554779

vvkatwss vvkatwss's questions

Martin Hope
vvkatwss vvkatwss
Asked: 2023-02-07 04:16:53 +0800 CST
  • 6

我有 Debian 10，带有 iptables 的 Fail2Ban v0.10.6 和我的过滤器<SUBNET>。现在我有 Ubuntu 22.04，Fail2Ban v0.11.2，我试图让它与 nftables 一起工作。jail.local我只为 nftables添加。我的配置：

# /etc/fail2ban/fail2ban.conf
[DEFAULT]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 1d
dbmaxmatches = 10
[Definition]
[Thread]

# /etc/fail2ban/jail.local
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports

# /etc/fail2ban/jail.d/00-geologger.conf
[geologger]
enabled     = true
__name__    = geologger
filter      = geologger
action      = %(action_)s
port        = ssh,2222,smtp,465,submission
logpath     = /var/log/geologger.log
backend     = %(default_backend)s
bantime     = 1m
maxretry    = 1
findtime    = 30m

# /etc/fail2ban/filter.d/geologger.conf 
[INCLUDES]
before = common.conf
[Definition]
mode      = normal
failregex = ipv4_addr=\([\d\./:]+-<SUBNET>\).*$

ignoreregex =

# nft list ruleset:
table ip filter {
    chain INPUT {
    }

    chain FORWARD {
    }

    chain f2b-geologger {
    }
}
table inet f2b-table {
    chain f2b-chain {
        type filter hook input priority filter - 1; policy accept;
    }
}

这是来自 fail2ban.log 的错误：

2023-02-03 14:09:18,948 fail2ban.filter         [3985]: INFO    [geologger] Found 178.127.150.0/24 - 2023-02-03 14:09:18
2023-02-03 14:09:19,552 fail2ban.actions        [3985]: NOTICE  [geologger] Ban 178.127.150.0/24
2023-02-03 14:09:19,673 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- exec: nft add table inet f2b-table
nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}
nft add set inet f2b-table addr-set-geologger \{ type ipv4_addr\; \}
for proto in $(echo 'tcp' | sed 's/,/ /g'); do
nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'ssh,2222,smtp,465,submission' | sed s/:/-/g) \} ip saddr @addr-set-geologger reject
done
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: 'Error: Could not process rule: Numerical result out of range'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: 'add set inet f2b-table addr-set-geologger { type ipv4_addr; }'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: 'Error: No such file or directory'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: 'add rule inet f2b-table f2b-chain tcp dport { ssh,2999,smtp,465,submission } ip saddr @addr-set-geologger reject'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- stderr: '                                                                                      ^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils          [3985]: ERROR   7fc55d851980 -- returned 1
2023-02-03 14:09:19,674 fail2ban.actions        [3985]: ERROR   Failed to execute ban jail 'geologger' action 'nftables-multiport' info 'ActionInfo({'ip': '178.127.150.0/24', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7fc55efa4940>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7fc55efa5000>})': Error starting action Jail('geologger')/nftables-multiport: 'Script error'

如何解决？

fail2ban