☰

Bitnami 上 authpriv.notice 日志的位置

tag-icon • tag-icon ip-address blacklist bitnami network-security
Bitnami 上 authpriv.notice 日志的位置

我在 AWS LightSail 上有一个 Bitnami 服务器 Ubuntu Xenial。我遵循本教程按国家/地区限制 SSH 连接。此脚本ipfilter.sh过滤 IP 地址：

#!/bin/bash
# License: WTFPL

# UPPERCASE space-separated country codes to ACCEPT
ALLOW_COUNTRIES="US UK"
LOGDENY_FACILITY="authpriv.notice"

if [ $# -ne 1 ]; then
  echo "Usage:  `basename $0` " 1>&2
  exit 0 # return true in case of config issue
fi

if [[ "`echo $1 | grep ':'`" != "" ]] ; then
  COUNTRY=`/usr/bin/geoiplookup6 "$1" | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`
else
  COUNTRY=`/usr/bin/geoiplookup "$1" | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`
fi
[[ $COUNTRY = "IP Address not found" || $ALLOW_COUNTRIES =~ $COUNTRY ]] && RESPONSE="ALLOW" || RESPONSE="DENY"

if [[ "$RESPONSE" == "ALLOW" ]] ; then
  logger -p $LOGDENY_FACILITY "$RESPONSE sshd connection from $1 ($COUNTRY)"
  exit 0
else
  logger -p $LOGDENY_FACILITY "$RESPONSE sshd connection from $1 ($COUNTRY)"
  exit 1
fi

我将其设置为：

sudo -y apt-get install geoip-bin geoip-database

sudo echo "sshd: ALL" > /etc/hosts.deny
sudo echo "vsftpd: ALL" >> /etc/hosts.deny

sudo echo "sshd: ALL: spawn /path/to/file/ipfilter.sh %a" > /etc/hosts.allow

我使用 重新启动了 SSH 守护程序sudo systemctl restart ssh.service。我尝试从另一个国家/地区进行连接，并检查文件/var/log/syslog和/var/log/auth.log，其中未显示此事件。该文件/etc/rsyslog.conf未显示 authpriv 设施的日志记录位置。

我如何检查此 IP 过滤器是否正常工作？

相关内容