fail2ban 无法设置 iptables 规则

fail2ban 无法设置 iptables 规则

我对 iptables 和 fail2ban 都只有一点点了解,但我的邮件服务器有很多我想摆脱的传入连接。

我在 /etc/fail2ban/jail.conf 中有这个配置块

[postfix-sasl]
enabled  = true
port     = smtp,465,submission,imap3,imaps,pop3,pop3s
logpath  = %(postfix_log)s
backend  = %(postfix_backend)s

但我认为,虽然正确检测到了禁令,但根本没有效果,因为我看到 fail2ban 日志报告了 iptables 错误,这里是 fail2ban 启动后并尝试恢复先前发现的禁令的一段日​​志:

2018-01-22 14:53:23,365 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- stdout: b''
2018-01-22 14:53:23,365 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- stderr: b"iptables v1.6.0: invalid port/service `smtp,465,submission,imap3,imaps,pop3,pop3s' specified\nTry `iptables -h' or 'iptables --help' for more information.\n"
2018-01-22 14:53:23,366 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- returned 2
2018-01-22 14:53:23,366 fail2ban.actions        [26127]: ERROR   Failed to start jail 'postfix-sasl' action 'iptables': Error starting action
2018-01-22 14:53:23,366 fail2ban.actions        [26127]: NOTICE  [postfix-sasl] Ban 80.82.70.210
2018-01-22 14:53:23,470 fail2ban.action         [26127]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-postfix-sasl[ \t]' -- stdout: b''
2018-01-22 14:53:23,470 fail2ban.action         [26127]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-postfix-sasl[ \t]' -- stderr: b''
2018-01-22 14:53:23,471 fail2ban.action         [26127]: ERROR   iptables -w -n -L INPUT | grep -q 'f2b-postfix-sasl[ \t]' -- returned 1
2018-01-22 14:53:23,471 fail2ban.CommandAction  [26127]: ERROR   Invariant check failed. Trying to restore a sane environment
2018-01-22 14:53:23,679 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- stdout: b''
2018-01-22 14:53:23,680 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- stderr: b"iptables v1.6.0: invalid port/service `smtp,465,submission,imap3,imaps,pop3,pop3s' specified\nTry `iptables -h' or 'iptables --help' for more information.\n"
2018-01-22 14:53:23,680 fail2ban.action         [26127]: ERROR   iptables -w -N f2b-postfix-sasl
iptables -w -A f2b-postfix-sasl -j RETURN
iptables -w -I INPUT -p tcp --dport smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl -- returned 2
2018-01-22 14:53:23,680 fail2ban.actions        [26127]: ERROR   Failed to execute ban jail 'postfix-sasl' action 'iptables' info 'CallingMap({'failures': 2, 'time': 1516629203.366475, 'matches': 'Jan 22 14:05:12 ysengr postfix/smtpd[25386]: warning: unknown[80.82.70.210]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\nJan 22 14:05:59 ysengr postfix/smtpd[25386]: warning: unknown[80.82.70.210]: SASL LOGIN authentication failed: UGFzc3dvcmQ6', 'ip': '80.82.70.210', 'ipmatches': <function Actions.__checkBan.<locals>.<lambda> at 0xb6a5c344>, 'ipjailmatches': <function Actions.__checkBan.<locals>.<lambda> at 0xb6a5c38c>, 'ipjailfailures': <function Actions.__checkBan.<locals>.<lambda> at 0xb6a5c41c>, 'ipfailures': <function Actions.__checkBan.<locals>.<lambda> at 0xb6a5c3d4>})': Error starting action

我尝试阅读了这篇文章,但无法从中获得任何有价值的信息。有人能帮我正确设置吗?非常感谢

编辑:这是两个软件的版本

root@ysengr:/etc/fail2ban# fail2ban-server -V
Fail2Ban v0.9.6

Copyright (c) 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors
Copyright of modifications held by their respective authors.
Licensed under the GNU General Public License v2 (GPL).

Written by Cyril Jaquier <[email protected]>.
Many contributions by Yaroslav O. Halchenko <[email protected]>.
root@ysengr:/etc/fail2ban# iptables -V
iptables v1.6.0

按照指示,我重置了banactioniptables 多端口,但日志显示相同的错误。这次在单独的终端中运行日志中报告的 iptables 命令行,它给了我以下内容:

root@ysengr:/etc/fail2ban# iptables -w -I INPUT -p tcp -m multiport --dports 25,465,587,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl
iptables v1.6.0: invalid port/service `imap3' specified

确实,imap3 不存在,/etc/services所以我像这样添加了它

root@ysengr:/etc/fail2ban# grep imap3 /etc/services 
imap2       143/tcp     imap imap3      # Interim Mail Access P 2 and 4

答案1

为了禁止多个端口,您banaction需要将其设置为iptables-multiport。这是默认值,但根据您显示的日志输出,您显然将其设置为其他值。

尝试重置banaction = iptables-multiport

相关内容