![fail2ban - 更改禁令未按预期进行](https://linux22.com/image/781652/fail2ban%20-%20%E6%9B%B4%E6%94%B9%E7%A6%81%E4%BB%A4%E6%9C%AA%E6%8C%89%E9%A2%84%E6%9C%9F%E8%BF%9B%E8%A1%8C.png)
我正在使用 fail2ban 来缓解对我的 Web 服务器 (Ubuntu 18.04lts) 的攻击。这种方法确实很有效,但最近我注意到回击的趋势越来越明显。因此我为这些攻击添加了一条新规则:
[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800
虽然这也按预期工作,但被禁止的地址数量已经达到 100 个,并且还在不断增长。为了避免性能影响,我尝试将此规则更改为使用 ipset :
[repeatOffence]
# enabled = false
enabled = true
filter = repeatOffence
port = http,https,smtp
logpath = /var/log/fail2ban.log
maxretry = 3
banaction = iptables-ipset-proto6.conf
banaction_allports = iptables-ipset-proto6-allports.conf
# search up to 2 days
findtime = 172800
# ban for a week
bantime = 604800
但重新启动fail2ban时,它会报告
Found no accessible config files for 'action.d/iptables-ipset-proto6.conf' under /etc/fail2ban
Unable to read action 'iptables-ipset-proto6.conf'
该文件具有与 action.d/iptables.conf 相同的权限
jail.conf 中对 banaction 的其他引用不使用文字值,例如
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]```
我错过了什么?
答案1
问题在于 fail2ban 中的文件扩展名很重要;fail2ban 会自动附加它们,因此它会查找“iptables-ipset-proto6.conf.conf”。修改配置(如下所示)可解决此问题:
banaction = iptables-ipset-proto6
banaction_allports = iptables-ipset-proto6-allports