在Mandriva 2008.1上防止使用Fail2ban进行强力攻击
版本1.0
作者:Falko Timme
在本文中,我将介绍如何在Mandriva 2008.1系统上安装和配置fail2ban 。 Fail2ban是一种工具,用于观察各种服务(例如SSH,FTP,SMTP,Apache等)的登录尝试,如果从同一个IP地址或主机一次又一次发现登录尝试失败,则fail2ban将停止该IP的进一步登录尝试地址/主机通过使用iptables防火墙规则进行阻止。
本文档不附带任何形式的保证! 我想说,这不是设立这样一个制度的唯一办法。 实现这一目标有很多方法,但这是我所采取的方式。 我不会保证这将为您工作!
1初步说明
Fail2ban类似于本教程中涵盖的DenyHosts : http : //www.youcl.com/preventing_ssh_dictionary_attacks_with_denyhosts ,但与关注SSH的DenyHosts不同,fail2ban可以配置为监视将登录尝试写入日志文件的任何服务,以及而不是使用/etc/hosts.deny
来阻止IP地址/主机,fail2ban可以使用iptables和/etc/hosts.deny
。
在此示例中,我将配置fail2ban以监视对SSH服务器,Proftpd服务器,登录尝试.htaccess / .htpasswd保护的网站,到Courier POP3和Courier IMAP以及SASL(用于发送电子邮件)的登录尝试。 我将安装Mandriva 2008.1可用的fail2ban软件包。 它配有默认配置,但不幸的是,配置对于大多数上述服务并不适用。 因此,我将创建一个自定义的fail2ban配置,我已经测试,并为我工作。
2安装fail2ban
在安装任何软件包之前,我们必须启用main
, main_updates
, contrib
和contrib_updates
存储库。 请访问http://easyurpmi.zarb.org/ - 它应该提供您需要运行以启用这些存储库的命令。 在我的情况下,我跑了
urpmi.addmedia contrib ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2008.1/i586/media/contrib/release with media_info/hdlist.cz
urpmi.addmedia --update contrib_updates ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2008.1/i586/media/contrib/updates with media_info/hdlist.cz
urpmi.addmedia main ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2008.1/i586/media/main/release with media_info/hdlist.cz
urpmi.addmedia --update main_updates ftp://distrib-coffee.ipsl.jussieu.fr/pub/linux/MandrivaLinux/official/2008.1/i586/media/main/updates with media_info/hdlist.cz
Fail2ban可以安装如下:
urpmi fail2ban
然后我们启动fail2ban:
/etc/init.d/fail2ban start
您将在/ etc / fail2ban
目录中找到所有fail2ban配置文件。
3配置fail2ban
fail2ban的默认行为在/etc/fail2ban/jail.conf文件中配置
。 看看它,这不难理解。 有一个[DEFAULT]
部分适用于所有其他部分,除非默认选项在其他部分中覆盖。
我在这里解释一些配置选项:
-
ignoreip
:这是一个空格分隔的IP地址列表,不能被fail2ban阻止。 例如,如果连接到服务器的计算机具有静态IP地址,则可能需要在此处列出。 -
bantime
:如果被fail2ban(600秒= 10分钟)捕获,主机被阻止的时间(秒)。 -
maxretry
:最大 主机被fail2ban阻止之前失败的登录尝试次数。 -
过滤器
:指在/etc/fail2ban/filter.d中的相应过滤器文件。 -
action
:指在/etc/fail2ban/action.d中的相应操作文件。 -
logpath
:fail2ban检查失败的登录尝试的日志文件。
这是我的/etc/fail2ban/jail.conf
文件:
vi /etc/fail2ban/jail.conf
# Fail2Ban configuration file # # Author: Cyril Jaquier # # $Revision: 617 $ # # The DEFAULT allows a global definition of the options. They can be override # in each jail afterwards. [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be # defined using space separator. ignoreip = 127.0.0.1 192.168.0.99 # "bantime" is the number of seconds that a host is banned. bantime = 600 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. findtime = 600 # "maxretry" is the number of failures before a host get banned. maxretry = 3 # "backend" specifies the backend used to get files modification. Available # options are "gamin", "polling" and "auto". This option can be overridden in # each jail too (use "gamin" for a jail and "polling" for another). # # gamin: requires Gamin (a file alteration monitor) to be installed. If Gamin # is not installed, Fail2ban will use polling. # polling: uses a polling algorithm which does not require external libraries. # auto: will choose Gamin if available and polling otherwise. backend = auto # This jail corresponds to the standard configuration in Fail2ban 0.6. # The mail-whois action send a notification e-mail with a whois request # in the body. [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com] logpath = /var/log/auth.log maxretry = 5 [proftpd-iptables] enabled = true filter = proftpd action = iptables[name=ProFTPD, port=ftp, protocol=tcp] sendmail-whois[name=ProFTPD, dest=you@mail.com] logpath = /var/log/proftpd/proftpd.log maxretry = 6 [sasl-iptables] enabled = true filter = sasl backend = polling action = iptables[name=sasl, port=smtp, protocol=tcp] sendmail-whois[name=sasl, dest=you@mail.com] logpath = /var/log/mail/info.log [apache-tcpwrapper] enabled = true filter = apache-auth action = hostsdeny logpath = /var/log/httpd/*error_log maxretry = 6 [postfix-tcpwrapper] enabled = true filter = postfix action = hostsdeny sendmail[name=Postfix, dest=you@mail.com] logpath = /var/log/mail/info.log bantime = 300 [courierpop3] enabled = true port = pop3 filter = courierlogin action = iptables[name=%(__name__)s, port=%(port)s] logpath = /var/log/mail/info.log maxretry = 5 [courierimap] enabled = true port = imap2 filter = courierlogin action = iptables[name=%(__name__)s, port=%(port)s] logpath = /var/log/mail/info.log maxretry = 5 [ssh-tcpwrapper] enabled = false filter = sshd action = hostsdeny sendmail-whois[name=SSH, dest=you@mail.com] ignoreregex = for myuser from logpath = /var/log/auth.log [vsftpd-notification] enabled = false filter = vsftpd action = sendmail-whois[name=VSFTPD, dest=you@mail.com] logpath = /var/log/vsftpd.log maxretry = 5 bantime = 1800 [vsftpd-iptables] enabled = false filter = vsftpd action = iptables[name=VSFTPD, port=ftp, protocol=tcp] sendmail-whois[name=VSFTPD, dest=you@mail.com] logpath = /var/log/vsftpd.log maxretry = 5 bantime = 1800 [apache-badbots] enabled = false filter = apache-badbots action = iptables-multiport[name=BadBots, port="http,https"] sendmail-buffered[name=BadBots, lines=5, dest=you@mail.com] logpath = /var/www/*/logs/access_log bantime = 172800 maxretry = 1 [apache-shorewall] enabled = false filter = apache-noscript action = shorewall sendmail[name=Postfix, dest=you@mail.com] logpath = /var/log/apache2/error_log [ssh-ipfw] enabled = false filter = sshd action = ipfw[localhost=192.168.0.1] sendmail-whois[name="SSH,IPFW", dest=you@mail.com] logpath = /var/log/auth.log ignoreip = 168.192.0.1 [named-refused-udp] enabled = false filter = named-refused action = iptables-multiport[name=Named, port="domain,953", protocol=udp] sendmail-whois[name=Named, dest=you@mail.com] logpath = /var/log/named/security.log ignoreip = 168.192.0.1 [named-refused-tcp] enabled = false filter = named-refused action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] sendmail-whois[name=Named, dest=you@mail.com] logpath = /var/log/named/security.log ignoreip = 168.192.0.1 |
我的客户端计算机具有静态IP地址192.168.0.99
,并且因为我不想被锁定,我已经将它添加到了ignoreip
列表。
我想控制登录尝试SSH,Apache,Proftpd,Courier-POP3,Courier-IMAP和Sasl,所以我设置为这些服务设置为true
,对所有其他服务为false
。 请注意,某些服务(如SSH)可能会被iptables或TCPWrappers( /etc/hosts.deny
)阻止。 决定你喜欢哪种方法。
确保使用您自己的电子邮件地址替换电子邮件地址you@mail.com
,以便当有人被fail2ban阻止时收到通知。
如果您将该文件与默认的/etc/fail2ban/jail.conf
进行比较,您还会注意到我已经更改了一些日志文件,因为默认的/etc/fail2ban/jail.conf
中的日志文件对于Mandriva是不正确的2008.1。
每当我们修改fail2ban配置时,我们必须重新启动fail2ban,所以这是我们现在所做的:
/etc/init.d/fail2ban restart
已经这样了 Fail2ban登录到/var/log/fail2ban.log
,以便您可以检查该文件,以确定/什么主机被阻止。 如果主机被fail2ban阻止,它看起来像这样:
2008-08-12 17:49:09,466 fail2ban.actions: WARNING [apache-tcpwrapper] Ban 1.2.3.4
2008-08-12 18:08:33,213 fail2ban.actions: WARNING [sasl-iptables] Ban 1.2.3.4
2008-08-12 18:26:37,769 fail2ban.actions: WARNING [courierlogin] Ban 1.2.3.4
2008-08-12 18:39:06,765 fail2ban.actions: WARNING [courierimap] Ban 1.2.3.4
您还可以检查防火墙,看看是否有任何主机被阻止。 只需运行
iptables -L
对于使用TCPWrappers阻止主机的服务,请查看/etc/hosts.deny
。
链接
- Fail2ban: http : //www.fail2ban.org
- Mandriva: http : //www.mandriva.com