主页 / ubuntu / 问题

问题[fail2ban](ubuntu)

Martin Hope
MohammedSimba
Asked: 2020-04-09 01:02:41 +0800 CST
  • 0

刚刚使用此线程在 Ubuntu 14.04 上从 f2b v0.9.6 升级到 v0.10.5 ，并且根据我从以前版本复制的旧监狱，它正常禁止。

但是当我重新启动服务时，它只保留被配置的启用监狱禁止的 IP。fail2ban-client set sshd banip 1.2.3.4当我重新启动时，所有手动禁止的 IP都消失了。这不是我使用的旧版本的正常行为。

请问有什么帮助吗？

更新：刚刚在 2 台 Ubuntu 16.04 服务器上测试（作为全新安装和升级）f2b，它的行为相同。似乎与 Ubuntu 版本无关

iptables firewall 16.04 14.04 fail2ban
Martin Hope
Joshi
Asked: 2020-01-05 06:49:07 +0800 CST
  • 17
78.128.113.62 - - [04/Jan/2020:19:59:33 +0530] "GET /efk-dashboard HTTP/1.1" 404 66914 "-" "python-requests/2.13.0"

即使我运行了命令，也有多个这样的访问记录

ufw deny from 78.128.113.58/24 to any  # for ufw
ip route add unreachable 78.128.113    # for fail2ban

添加ip后我还重新启动了fail2ban服务。

如何解决这个问题？我没有主意了。

server ufw fail2ban
Martin Hope
alebal
Asked: 2019-11-01 12:42:46 +0800 CST
  • 5

我经常不得不向 apache-badbots.conf 文件添加新规则，而且每次我怀疑它不再有效时......

例如，这是我当前的 apache-badbots.conf 文件：

    [Definition]

badbotscustom = MQQBrowser|LieBaoFast|Mb2345Browser|zh-CN|python-requests|LinkpadBot|MegaIndex|Buck|SemrushBot|SeznamBot|JobboerseBot|AhrefsBot|AhrefsBot/6.1|MJ12bot|[email protected]|SemrushBot/6~bl|cortex|Cliqzbot|Baiduspider|serpstatbot|Go 1.1 package http|Python-urllib|StormCrawler|archive.org_bot|CCBot|BLEXBot|ltx71|DotBot|EmailCollector|WebEMailExtrac|Track$
badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrow$

#failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*".*(?:%(badbots)s|%(badbotscustom)s).*"$

ignoreregex =

datepattern = ^[^\[]*\[({DATE})
              {^LN-BEG}

昨天我添加了“MQQBrowser | LieBaoFast | Mb2345Browser | zh-CN”，今天我在访问日志中看到了很多 MQQBrowser 和 LieBaoFast。

sudo cat /var/log/apache2/access.log | awk -F\" '{print $6}' | sort | uniq -c | sort -n
    ...
3408 Mozilla/5.0(Linux;U;Android 5.1.1;zh-CN;OPPO A33 Build/LMY47V) AppleWebKit/537.36(KHTML,like Gecko) Version/4.0 Chrome/40.0.2214.89 UCBrowser/11.7.0.953 Mobile Safari/537.36
3418 Mozilla/5.0(Linux;Android 5.1.1;OPPO A33 Build/LMY47V;wv) AppleWebKit/537.36(KHTML,link Gecko) Version/4.0 Chrome/42.0.2311.138 Mobile Safari/537.36 Mb2345Browser/9.0
3444 Mozilla/5.0 (Linux; Android 7.0; FRD-AL00 Build/HUAWEIFRD-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/53.0.2785.49 Mobile MQQBrowser/6.2 TBS/043602 Safari/537.36 MicroMessenger/6.5.16.1120 NetType/WIFI Language/zh_CN
3473 Mozilla/5.0(Linux;Android 5.1.1;OPPO A33 Build/LMY47V;wv) AppleWebKit/537.36(KHTML,link Gecko) Version/4.0 Chrome/43.0.2357.121 Mobile Safari/537.36 LieBaoFast/4.51.3

怎么了？它在工作吗？有没有办法判断是否有错误以及错误是什么？

我更新是因为它仍然不理解某些东西，例如今天我发现其他应该在我的日志中被禁止的机器人。

只是为了理解，这个过滤器在服务器的访问 .log 中查找我在 apache-badbots.conf 中添加的字符串，如果找到它会向 fail2ban 添加一条规则，对吗？

  • 例如，如果我写“netEstate NE Crawler”或只写“​​netEstate”有区别吗？
  • 为什么这个字符串“ atSpider/1\.0”有所有这些斜线？
  • 所有 ”。” 必须以斜线开头？( China Local Browse 2\.6|DataCha0s/2\.0|DBrowse 1\.4b)
  • 电子邮件可以用作字符串吗？（例如：[email protected]）
  • 带有“”之类的空格的字符串Go 1.1 package http是正确的还是会产生错误？
  • 可以使用“-”字符吗？（例如：python-requests、Python-urllib）
  • 可以使用“_”字符吗？（例如：archive.org_bot）
fail2ban
Martin Hope
alebal
Asked: 2019-02-06 21:41:31 +0800 CST
  • 6

如何创建过滤器以使用 fail2ban 阻止这些？

    476 Mozilla/5.0 (compatible; BLEXBot/1.0; +http://webmeup-crawler.com/)
    892 ltx71 - (http://ltx71.com/)
    5367 Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, [email protected])
   6449 Barkrowler/0.9 (+http://www.exensa.com/crawl)

这份名单由此而来：

sudo cat /var/log/apache2/access.log | awk -F\" '{print $6}' | sort | uniq -c | sort -n

我已经尝试过 apache-badbot.conf，但它似乎不起作用......

fail2ban
Martin Hope
Gary
Asked: 2018-12-15 16:11:34 +0800 CST
  • 1

最近我用最新的安全更新更新了 ubuntu 16.04，突然间，ignoreip 停止了 fail2ban 的运行我评论了这条线，它开始工作有什么想法吗？我尝试在我的 jail.local 文件中为每个添加逗号和忽略 IP

ignoreip = 127.0.0.0/8 10.0.0.0/8 192.168.0.0/16
16.04 fail2ban
Martin Hope
ComputerScientist
Asked: 2018-12-08 17:13:46 +0800 CST
  • 1

我有一个关于在我的一台机器上启动 fail2ban 的基本问题。我今天有一台新安装的 Ubuntu 16.04 的机器，我正在遵循来自源代码的各种关于 fail2ban 的说明，例如this、this、this和this。（我正在关注几个来交叉引用每个，并且因为官方的fail2ban FAQ（我也在交叉引用，公平起见）似乎已经过时，因为它指的是fail2ban 0.8（并且没有有特定于 Ubuntu 的说明），而我有 0.9.3：

$ fail2ban-client --version
Fail2Ban v0.9.3

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <[email protected]>.
Many contributions by Yaroslav O. Halchenko <[email protected]>.

我通过安装fail2ban

sudo apt-get install fail2ban

还有 sendmail，它可能允许发送电子邮件。

$ sudo apt-get install sendmail
Reading package lists... Done
Building dependency tree       
Reading state information... Done
sendmail is already the newest version (8.15.2-3).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

按照上面指南中的说明，我将/etc/fail2ban/jail.conf文件复制到/etc/fail2ban/jail.local中，注释掉所有行，然后只在/etc/fail2ban/jail.local. （在下文中，我粘贴了 vim 中出现的行号，这可能有助于检查您是否有类似的 jail 文件。）

(1) 最大重试次数，我改成3次，所以在系统阻止用户ssh-ing之前应该有3次尝试失败。

 65 # # "maxretry" is the number of failures before a host get banned.
 66 maxretry = 3

(2) 和 (3)：我更改了这两项，第一项是我的个人电子邮件（即[mypersonalemail]），另一项是计算机名称。我只是输入了“计算机名”——这里的电子邮件会更好吗？

129 destemail = [mypersonalemail]
130 
131 # # Sender email address used solely for some actions
132 sender = ComputerName

(4) 最后，我将动作更改为更具表现力的动作，因此它会发出电子邮件通知。

201 # # Choose default action.  To change, just override value of 'action' with the
202 # # interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
203 # # globally (section [DEFAULT]) or per specific section
204 action = %(action_mwl)s

有了这个，下一步似乎是以某种方式启动服务。我对在这里获得花哨的正则表达式或定制监狱或摆弄 IP 表不感兴趣。在这一点上，我感兴趣的只是启动服务，并通过让我用故意错误的密码反复 ssh 进入机器来测试它。

不幸的是，当我尝试启动服务时，出现错误：

$ sudo service fail2ban start
Job for fail2ban.service failed because the control process exited with error code. See "systemctl status fail2ban.service" and "journalctl -xe" for details.

带输出（计算机名称是机器的名称）：

$ systemctl status fail2ban.service
● fail2ban.service - Fail2Ban Service
   Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)
   Active: failed (Result: start-limit-hit) since Fri 2018-12-07 17:03:55 PST; 29s ago
     Docs: man:fail2ban(1)
  Process: 21838 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)
 Main PID: 6381 (code=killed, signal=TERM)
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Start request repeated too quickly.
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'start-limit-hit'.

和

$ journalctl -xe
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has finished shutting down.
Dec 07 17:03:55 computer-name systemd[1]: Starting Fail2Ban Service...
-- Subject: Unit fail2ban.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has begun starting up.
Dec 07 17:03:55 computer-name fail2ban-client[21838]: ERROR  Failed during configuration: File contains no section headers.
Dec 07 17:03:55 computer-name fail2ban-client[21838]: file: '/etc/fail2ban/jail.local', line: 66
Dec 07 17:03:55 computer-name fail2ban-client[21838]: 'maxretry = 3\n'
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Control process exited, code=exited status=255
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'exit-code'.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Service hold-off time over, scheduling restart.
Dec 07 17:03:55 computer-name systemd[1]: Stopped Fail2Ban Service.
-- Subject: Unit fail2ban.service has finished shutting down
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has finished shutting down.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Start request repeated too quickly.
Dec 07 17:03:55 computer-name systemd[1]: Failed to start Fail2Ban Service.
-- Subject: Unit fail2ban.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit fail2ban.service has failed.
-- 
-- The result is failed.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Unit entered failed state.
Dec 07 17:03:55 computer-name systemd[1]: fail2ban.service: Failed with result 'start-limit-hit'.
Dec 07 17:04:32 computer-name org.gtk.vfs.Daemon[1529]: ** (process:3758): WARNING **: Couldn't create directory monitor on smb://x-gnome-

有人有什么建议吗？谢谢。

PS：有一些类似的问题：

  • 这似乎与 sendmail/postfix 有问题，但我已经安装了 sendmail，大概应该足够了吗？
  • 这个类似，但专注于 apache2，而我专注于 fail2ban，不关心 apache2。
ssh apache2 sendmail fail2ban
Martin Hope
NoFence
Asked: 2018-08-06 23:17:52 +0800 CST
  • 6

几天前我安装了ubuntu服务器（18.04版本）。我尝试使用 apt 工具安装 fail2ban，但无法做到。

这里有一些关于我的情况的信息。

root@ubuntu:~# cat /etc/os-release | grep -i version
VERSION="18.04.1 LTS (Bionic Beaver)"
VERSION_ID="18.04"
VERSION_CODENAME=bionic

root@ubuntu:~# apt search fail2ban
Sorting... Done
Full Text Search... Done

为什么我不能在 ubuntu 软件包存储库上搜索 fail2ban？

18.04 fail2ban