使用 dpkg 手动安装软件包是否会阻止未来的升级路径？

Question

tamo_bln

Asked: 2024-11-13 05:22:17 +0800 CST2024-11-13 05:22:17 +0800 CST 2024-11-13 05:22:17 +0800 CST

Fail2ban 已启用并处于活动状态，但未在 Ubuntu Server 24.04 上的 iptables 中添加任何规则

772

看来我无法让 fail2ban 工作。

我已经启动并运行 ufw，状态如下：

~$ sudo ufw status

Status: active

To                         Action      From
--                         ------      ----
25/tcp                     ALLOW       Anywhere
2278/tcp                   ALLOW       Anywhere
80,143,443,465,587,993/tcp ALLOW       Anywhere
110,995/tcp                ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
22/tcp                     DENY        Anywhere
25/tcp (v6)                ALLOW       Anywhere (v6)
2278/tcp (v6)              ALLOW       Anywhere (v6)
80,143,443,465,587,993/tcp (v6) ALLOW       Anywhere (v6)
110,995/tcp (v6)           ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
22/tcp (v6)                DENY        Anywhere (v6)

我没有对jail.conf文件做任何更改，只是创建了一个jail.local文件。

/etc/fail2ban/jail.local

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1/128

[sshd]
#mode   = normal
enabled = true
bantime = 1h
port    = 2278
filter = sshd
logpath = /var/log/auth.log
maxretry = 5



[postfix]
enabled = true
bantime = 1h
mode    = more
port    = smtp,465,submission
filter = postfix
logpath = /var/log/mail.log

[postfix-sasl]
enabled = true
bantime = 1h
maxretry = 5
filter   = postfix[mode=auth]
port     = smtp,465,submission,imap,imaps,pop3,pop3s
logpath  = /var/log/mail.log

~$ sudo fail2ban-client status
Status
|- Number of jail:      3
`- Jail list:   postfix, postfix-sasl, sshd

~$ sudo fail2ban-client status postfix
Status for the jail: postfix
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=postfix.service
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

我手动禁止了一个 IP：

~$ sudo fail2ban-client -vvv set postfix banip 1.2.3.4
 +   32 743F3BD1E080 fail2ban.configreader     INFO  Loading configs for fail2ban under /etc/fail2ban
 +   32 743F3BD1E080 fail2ban.configreader     DEBUG Reading configs for fail2ban under /etc/fail2ban
 +   33 743F3BD1E080 fail2ban.configreader     DEBUG Reading config files: /etc/fail2ban/fail2ban.conf
 +   33 743F3BD1E080 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf']
 +   33 743F3BD1E080 fail2ban.configparserinc  TRACE     Reading file: /etc/fail2ban/fail2ban.conf
 +   33 743F3BD1E080 fail2ban.configparserinc  INFO    Loading files: ['/etc/fail2ban/fail2ban.conf']
 +   33 743F3BD1E080 fail2ban.configparserinc  TRACE     Shared file: /etc/fail2ban/fail2ban.conf
 +   34 743F3BD1E080 fail2ban                  INFO  Using socket file /var/run/fail2ban/fail2ban.sock
 +   34 743F3BD1E080 fail2ban                  INFO  Using pid file /var/run/fail2ban/fail2ban.pid, [INFO] logging to /var/log/fail2ban.log
 +   34 743F3BD1E080 fail2ban                  HEAVY CMD: ['set', 'postfix', 'banip', '1.2.3.4']
 +   73 743F3BD1E080 fail2ban                  HEAVY OK : 1
 +   73 743F3BD1E080 fail2ban.beautifier       HEAVY Beautify 1 with ['set', 'postfix', 'banip', '1.2.3.4']
1
 +   73 743F3BD1E080 fail2ban                  DEBUG Exit with code 0

命令iptables -nL没有显示该IP已经被fail2ban禁止：

~$ sudo iptables -nL
Chain INPUT (policy DROP)
target     prot opt source               destination
ufw-before-logging-input  0    --  0.0.0.0/0            0.0.0.0/0
ufw-before-input  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-input  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-logging-input  0    --  0.0.0.0/0            0.0.0.0/0
ufw-reject-input  0    --  0.0.0.0/0            0.0.0.0/0
ufw-track-input  0    --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
target     prot opt source               destination
ufw-before-logging-forward  0    --  0.0.0.0/0            0.0.0.0/0
ufw-before-forward  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-forward  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-logging-forward  0    --  0.0.0.0/0            0.0.0.0/0
ufw-reject-forward  0    --  0.0.0.0/0            0.0.0.0/0
ufw-track-forward  0    --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ufw-before-logging-output  0    --  0.0.0.0/0            0.0.0.0/0
ufw-before-output  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-output  0    --  0.0.0.0/0            0.0.0.0/0
ufw-after-logging-output  0    --  0.0.0.0/0            0.0.0.0/0
ufw-reject-output  0    --  0.0.0.0/0            0.0.0.0/0
ufw-track-output  0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-after-forward (1 references)
target     prot opt source               destination

Chain ufw-after-input (1 references)
target     prot opt source               destination
ufw-skip-to-policy-input  17   --  0.0.0.0/0            0.0.0.0/0            udp dpt:137
ufw-skip-to-policy-input  17   --  0.0.0.0/0            0.0.0.0/0            udp dpt:138
ufw-skip-to-policy-input  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:139
ufw-skip-to-policy-input  6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:445
ufw-skip-to-policy-input  17   --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
ufw-skip-to-policy-input  17   --  0.0.0.0/0            0.0.0.0/0            udp dpt:68
ufw-skip-to-policy-input  0    --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST

Chain ufw-after-logging-forward (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-input (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-after-logging-output (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-after-output (1 references)
target     prot opt source               destination

Chain ufw-before-forward (1 references)
target     prot opt source               destination
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 3
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 11
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 12
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ufw-user-forward  0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-before-input (1 references)
target     prot opt source               destination
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ufw-logging-deny  0    --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
DROP       0    --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 3
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 11
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 12
ACCEPT     1    --  0.0.0.0/0            0.0.0.0/0            icmptype 8
ACCEPT     17   --  0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
ufw-not-local  0    --  0.0.0.0/0            0.0.0.0/0
ACCEPT     17   --  0.0.0.0/0            224.0.0.251          udp dpt:5353
ACCEPT     17   --  0.0.0.0/0            239.255.255.250      udp dpt:1900
ufw-user-input  0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-forward (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            ctstate NEW limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW AUDIT] "

Chain ufw-before-logging-input (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            ctstate NEW limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW AUDIT] "

Chain ufw-before-logging-output (1 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            ctstate NEW limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW AUDIT] "

Chain ufw-before-output (1 references)
target     prot opt source               destination
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ufw-user-output  0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-logging-allow (0 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "

Chain ufw-logging-deny (2 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW AUDIT INVALID] "
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "

Chain ufw-not-local (1 references)
target     prot opt source               destination
RETURN     0    --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCAL
RETURN     0    --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICAST
RETURN     0    --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCAST
ufw-logging-deny  0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10
DROP       0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-reject-forward (1 references)
target     prot opt source               destination

Chain ufw-reject-input (1 references)
target     prot opt source               destination

Chain ufw-reject-output (1 references)
target     prot opt source               destination

Chain ufw-skip-to-policy-forward (0 references)
target     prot opt source               destination
DROP       0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-input (7 references)
target     prot opt source               destination
DROP       0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-skip-to-policy-output (0 references)
target     prot opt source               destination
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-track-forward (1 references)
target     prot opt source               destination

Chain ufw-track-input (1 references)
target     prot opt source               destination

Chain ufw-track-output (1 references)
target     prot opt source               destination
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            ctstate NEW
ACCEPT     17   --  0.0.0.0/0            0.0.0.0/0            ctstate NEW

Chain ufw-user-forward (1 references)
target     prot opt source               destination

Chain ufw-user-input (1 references)
target     prot opt source               destination
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:25
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:2278
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,143,443,465,587,993
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            multiport dports 110,995
ACCEPT     6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80
DROP       6    --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Chain ufw-user-limit (0 references)
target     prot opt source               destination
LOG        0    --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
REJECT     0    --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain ufw-user-limit-accept (0 references)
target     prot opt source               destination
ACCEPT     0    --  0.0.0.0/0            0.0.0.0/0

Chain ufw-user-logging-forward (0 references)
target     prot opt source               destination

Chain ufw-user-logging-input (0 references)
target     prot opt source               destination

Chain ufw-user-logging-output (0 references)
target     prot opt source               destination

Chain ufw-user-output (1 references)
target     prot opt source               destination

Fail2ban 服务正在运行。

~$ sudo systemctl status fail2ban.service
● fail2ban.service - Fail2Ban Service
     Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; preset: enabled)
     Active: active (running) since Tue 2024-11-12 21:09:28 CET; 1h 6min ago
       Docs: man:fail2ban(1)
   Main PID: 1001 (fail2ban-server)
      Tasks: 9 (limit: 4556)
     Memory: 49.7M (peak: 53.2M)
        CPU: 10.557s
     CGroup: /system.slice/fail2ban.service
             └─1001 /usr/bin/python3 /usr/bin/fail2ban-server -xf start

Nov 12 21:09:28 crosis systemd[1]: Started fail2ban.service - Fail2Ban Service.
Nov 12 21:09:29 crosis fail2ban-server[1001]: 2024-11-12 21:09:29,352 fail2ban.configreader   [1001]: WARNING 'allowipv6' not defined in 'Definition'. Using default one: 'auto'
Nov 12 21:09:30 crosis fail2ban-server[1001]: Server ready

我是不是漏掉了什么？我是不是做错了什么？

1 个回答

Voted

Sven Ellwanger · Answer 1 · 2024-12-11T04:51:54+08:00

Best Answer

Sven Ellwanger

2024-12-11T04:51:54+08:002024-12-11T04:51:54+08:00

检查你的 jail 操作：fail2ban-client get postfix 操作或 fail2ban-client get sshd 操作

可能您的 /etc/fail2ban/paths-debian.conf 不正确（例如我的 nftables 作为 banactions）。

检查你的 /etc/fail2ban/jail.conf - #before = routes-distro.conf

0

Fail2ban 已启用并处于活动状态，但未在 Ubuntu Server 24.04 上的 iptables 中添加任何规则

如何运行 .sh 脚本？

如何安装 .tar.gz（或 .tar.bz2）文件？

如何列出所有已安装的软件包

无法锁定管理目录 (/var/lib/dpkg/) 是另一个进程在使用它吗？

Fail2ban 已启用并处于活动状态，但未在 Ubuntu Server 24.04 上的 iptables 中添加任何规则

1 个回答

相关问题