我有 Debian 10、Fail2Ban v0.10.6 和 iptables,我的过滤器可以<SUBNET>
正常工作。现在我有 Ubuntu 22.04、Fail2Ban v0.11.2,我尝试让它与 nftables 一起工作。我仅添加了jail.local
nftables。我的配置:
# /etc/fail2ban/fail2ban.conf
[DEFAULT]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 1d
dbmaxmatches = 10
[Definition]
[Thread]
# /etc/fail2ban/jail.local
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports
# /etc/fail2ban/jail.d/00-geologger.conf
[geologger]
enabled = true
__name__ = geologger
filter = geologger
action = %(action_)s
port = ssh,2222,smtp,465,submission
logpath = /var/log/geologger.log
backend = %(default_backend)s
bantime = 1m
maxretry = 1
findtime = 30m
# /etc/fail2ban/filter.d/geologger.conf
[INCLUDES]
before = common.conf
[Definition]
mode = normal
failregex = ipv4_addr=\([\d\./:]+-<SUBNET>\).*$
ignoreregex =
# nft list ruleset:
table ip filter {
chain INPUT {
}
chain FORWARD {
}
chain f2b-geologger {
}
}
table inet f2b-table {
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
}
}
以下是来自 fail2ban.log 的错误:
2023-02-03 14:09:18,948 fail2ban.filter [3985]: INFO [geologger] Found 178.127.150.0/24 - 2023-02-03 14:09:18
2023-02-03 14:09:19,552 fail2ban.actions [3985]: NOTICE [geologger] Ban 178.127.150.0/24
2023-02-03 14:09:19,673 fail2ban.utils [3985]: ERROR 7fc55d851980 -- exec: nft add table inet f2b-table
nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}
nft add set inet f2b-table addr-set-geologger \{ type ipv4_addr\; \}
for proto in $(echo 'tcp' | sed 's/,/ /g'); do
nft add rule inet f2b-table f2b-chain $proto dport \{ $(echo 'ssh,2222,smtp,465,submission' | sed s/:/-/g) \} ip saddr @addr-set-geologger reject
done
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'Error: Could not process rule: Numerical result out of range'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'add set inet f2b-table addr-set-geologger { type ipv4_addr; }'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: '^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'Error: No such file or directory'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: 'add rule inet f2b-table f2b-chain tcp dport { ssh,2999,smtp,465,submission } ip saddr @addr-set-geologger reject'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- stderr: ' ^^^^^^^^^^^^^^^^^^^'
2023-02-03 14:09:19,674 fail2ban.utils [3985]: ERROR 7fc55d851980 -- returned 1
2023-02-03 14:09:19,674 fail2ban.actions [3985]: ERROR Failed to execute ban jail 'geologger' action 'nftables-multiport' info 'ActionInfo({'ip': '178.127.150.0/24', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7fc55efa4940>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7fc55efa5000>})': Error starting action Jail('geologger')/nftables-multiport: 'Script error'
如何修复?
答案1
它有两个问题:1. 集合的长度必须小于16要将子网添加到 nftables,集合必须具有flags interval
。因此,我的修复方法如下:
# /etc/fail2ban/action.d/nftables-multiport.local
[Init]
addr_set = as-<name>
[Definition]
_nft_add_set = <nftables> add set <table_family> <table> <addr_set> \{ type <addr_type>\; flags interval\;\}
<_nft_for_proto-<type>-iter>
<nftables> add rule <table_family> <table> <chain> %(rule_stat)s
<_nft_for_proto-<type>-done>