☰

Fail2Ban 正则表达式 SSH 与 auth.log 不匹配

tag-icon • tag-icon regex sshd fail2ban
Fail2Ban 正则表达式 SSH 与 auth.log 不匹配

我正在尝试让 Fail2Ban 与提供的 SSHD 配置一起工作。

当我跑步时：

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

输出为：

root@fw:/etc/fail2ban/filter.d# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/sshd.conf
Use         log file : /var/log/auth.log


Results
=======

Failregex: 5583 total
|-  #) [# of hits] regular expression
|   3) [4339] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*Failed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ (?:[\da-f]{2}:){15}[\da-f]{2}(, client user ".*", client host ".*")?))?\s*$
|   5) [1244] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*[iI](?:llegal|nvalid) user .* from <HOST>\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [19480] MONTH Day Hour:Minute:Second
`-

Lines: 19480 lines, 0 ignored, 5583 matched, 13897 missed
Missed line(s):: too many to print.  Use --print-all-missed to print all 13897 lines
root@fw:/etc/fail2ban/filter.d#

我的 auth.log 如下所示（示例）：

Oct 21 04:47:44 fw sshd[31558]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:44 fw sshd[31558]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:44 fw sshd[31558]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:46 fw sshd[31562]: Failed password for root from 218.2.0.125 port 12277 ssh2
Oct 21 04:47:46 fw sshd[31581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:48 fw sshd[31560]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 9188 ssh2]
Oct 21 04:47:48 fw sshd[31560]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:48 fw sshd[31560]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:48 fw sshd[31560]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:48 fw sshd[31581]: Failed password for root from 218.2.0.125 port 13148 ssh2
Oct 21 04:47:52 fw sshd[31595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:55 fw sshd[31595]: Failed password for root from 218.2.0.125 port 14409 ssh2
Oct 21 04:47:55 fw CRON[31494]: pam_unix(cron:session): session closed for user clamav
Oct 21 04:47:59 fw sshd[31562]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 12277 ssh2]
Oct 21 04:47:59 fw sshd[31562]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31562]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:59 fw sshd[31562]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:47:59 fw sshd[31581]: message repeated 5 times: [ Failed password for root from 218.2.0.125 port 13148 ssh2]
Oct 21 04:47:59 fw sshd[31581]: Disconnecting: Too many authentication failures for root [preauth]
Oct 21 04:47:59 fw sshd[31581]: fatal: Write failed: Connection reset by peer [preauth]
Oct 21 04:47:59 fw sshd[31581]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.2.0.125  user=root
Oct 21 04:47:59 fw sshd[31581]: PAM service(sshd) ignoring max retries; 6 > 3
Oct 21 04:48:00 fw sshd[31595]: message repeated 2 times: [ Failed password for root from 218.2.0.125 port 14409 ssh2]

我知道有些条目应该匹配，但我就是无法让它匹配。

经过研究，我发现这可能是由于日期格式所致，但建议的更改并common.conf没有任何区别。

fail2ban-regex另外，我运行了具有 auth.log 日期格式的手册，并且它按预期返回。

答案1

看起来有匹配，但是还不够。Debian 错误 #620364可能是罪魁祸首。解决方法记录在fail2ban 维基和堆栈溢出，是关闭rsyslog中的重复消息减少：

sudo sed -i 's/RepeatedMsgReduction\ on/RepeatedMsgReduction\ off/' /etc/rsyslog.conf
sudo service rsyslog restart
sudo service fail2ban restart

答案2

Failed password for root

与 ssh 的 fail2ban 过滤器中的第 3 个条目正确匹配，并且已更正https://github.com/fail2ban/fail2ban/commit/750e0c1e3dbce856437c115142d57f18b6c1fac7。

message repeated 5 times

是重复消息的结果，根据系统日志的更改进行修复（并且不需要重新启动 fail2ban）。

PAM 5....

可以匹配，但是这将是第一个“密码失败...”日志消息的重复，并且没有意义。

如果你遇到需要正则表达式的东西：

fail2ban-regex -D 'log line' /etc/fail2ban/filter.d/sshd.conf

并使用应该匹配的正则表达式附近的 URL 并进行编辑直到匹配为止。

相关内容