☰

Fail2ban 无法在 raspbian (ssh) 上运行

tag-icon • tag-icon ssh raspbian fail2ban
Fail2ban 无法在 raspbian (ssh) 上运行

我刚刚在我的树莓派 (Raspbian) 上进行了全新安装，但我无法失败2ban做任何事情，它都不会阻止任何失败的 ssh 登录。我检查以确保它指向正确的日志文件（/var/log/auth.log），它确实指向正确的日志文件，我已确认 iptables 处于活动状态，fail2ban 已启动，sshd jail 已打开，服务正在端口 22 上运行，我真的不知道此时该怎么做，我以前从未遇到过这么多让它与 ssh 一起工作的麻烦。它通常开箱即用。这是我的日志过滤器和身份验证日志：

日志：

Jan 22 21:11:25 PI2 sshd[22700]: pam_unix(sshd:auth): authentication failure; lo gname= uid=0 euid=0 tty=ssh ruser= rhost=216.4.56.163 user=pi
Jan 22 21:11:27 PI2 sshd[22700]: Failed password for pi from 216.4.56.163 port 1 6290 ssh2
Jan 22 21:11:27 PI2 sshd[22700]: error: Received disconnect from 216.4.56.163: 3 : com.jcraft.jsch.JSchException: Auth cancel [preauth]
Jan 22 21:17:01 PI2 CRON[22783]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 21:17:01 PI2 CRON[22783]: pam_unix(cron:session): session closed for user root
Jan 22 21:17:30 PI2 sshd[22809]: pam_unix(sshd:auth): authentication failure; lo gname= uid=0 euid=0 tty=ssh ruser= rhost=183.3.202.106 user=root
Jan 22 21:17:33 PI2 sshd[22809]: Failed password for root from 183.3.202.106 por t 16766 ssh2
Jan 22 21:17:36 PI2 sshd[22809]: Failed password for root from 183.3.202.106 por t 16766 ssh2
Jan 22 21:17:38 PI2 sshd[22809]: Failed password for root from 183.3.202.106 por t 16766 ssh2
Jan 22 21:17:39 PI2 sshd[22809]: Received disconnect from 183.3.202.106: 11: [p reauth]
Jan 22 21:17:39 PI2 sshd[22809]: PAM 2 more authentication failures; logname= ui d=0 euid=0 tty=ssh ruser= rhost=183.3.202.106 user=root`

筛选：

sshd.conf          [----]  0 L:[ 17+21  38/ 38] *(1772/1772b) <EOF>       [*][X]
    ^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*
    ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
    ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
    ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in
    ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in Deny
    ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any gro
    ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
    ^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$
    ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is lis
    ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's
ignoreregex =.

我很确定这是日志过滤器，但我不确定如何修复它。

答案1

弄清楚了，

问题是我为不同的服务设置了自定义监狱，但配置不正确，导致 fail2ban 无法正确启动。

因此，当我运行“service fail2ban status”时，在我修复另一个jail之前我会得到这个：

 ● fail2ban.service - LSB: Start/stop fail2ban
   Loaded: loaded (/etc/init.d/fail2ban)
   Active: active (exited) since Mon 2016-01-25 18:41:50 EST; 3s ago
  Process: 11673 ExecStop=/etc/init.d/fail2ban stop (code=exited, status=0/SUCCESS)
  Process: 11683 ExecStart=/etc/init.d/fail2ban start (code=exited, status=0/SUCCESS)

Jan 25 18:41:50 PI2 fail2ban[11683]: Starting authentication failure monitor: fail2banERROR  No file(s) found for glob /wrong/way/service.log #edit to your needs
Jan 25 18:41:50 PI2 fail2ban[11683]: ERROR  Failed during configuration: Have not found any log file for service jail
Jan 25 18:41:50 PI2 fail2ban[11683]: failed!
Jan 25 18:41:50 PI2 systemd[1]: Started LSB: Start/stop fail2ban.

在我修复它之后：

 ● fail2ban.service - LSB: Start/stop fail2ban
   Loaded: loaded (/etc/init.d/fail2ban)
   Active: active (running) since Mon 2016-01-25 18:43:03 EST; 3s ago
  Process: 11774 ExecStop=/etc/init.d/fail2ban stop (code=exited, status=0/SUCCESS)
  Process: 11784 ExecStart=/etc/init.d/fail2ban start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/fail2ban.service
           └─11795 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid

Jan 25 18:43:03 PI2 fail2ban[11784]: Starting authentication failure monitor: fail2ban.
Jan 25 18:43:03 PI2 systemd[1]: Started LSB: Start/stop fail2ban.

相关内容