FreeBSD 中 fail2ban 默认设置已无法运行,若仍使用旧设置则需要检查

8 min

language: ja bn en es hi pt ru zh-cn zh-tw

你好,我是无能。

最近 FreeBSD 的 fail2ban 中,不知为何 sshd 规则不再进行 IP Ban 了。

当前规则

如下所示。

jail.local :

[sshd]
enabled = true
port    = all
filter = sshd
allowipv6 = auto
logpath = /var/log/auth.log
bantime = 10w
findtime = 1w
maxretry = 3

但是,hetzner 那边却在正常运行。这是为什么呢?

更新

看来 fail2ban 侧也更新了设置,新安装的版本似乎已经修复了。

正确:

[DEFAULT]
_daemon = sshd(?:-session)?

错误:

[DEFAULT]
_daemon = sshd

之前的 sshd 二进制文件现在被拆分为监听器二进制文件 sshd 和每个会话的二进制文件 sshd-session
部分日志消息有所变化

OpenSSH 9.8p1 已发布

  • sshd(8): the server has been split into a listener binary, sshd(8),
    and a per-session binary "sshd-session". This allows for a much
    smaller listener binary, as it no longer needs to support the SSH
    protocol. As part of this work, support for disabling privilege
    separation (which previously required code changes to disable) and
    disabling re-execution of sshd(8) has been removed. Further
    separation of sshd-session into additional, minimal binaries is
    planned for the future.

    sshd(8): 服务器被拆分为监听器二进制文件 sshd(8) 和每个会话的二进制文件
    "sshd-session"。这使得监听器二进制文件的大小可以变得
    非常小,因为它不再需要支持 SSH 协议。
    作为这项工作的一部分,删除了对禁用特权分离(以前需要
    修改代码才能禁用)和禁用 sshd(8) 重新执行的支持。
    计划在未来将 sshd-session 进一步拆分为更小的(功能性)二进制文件。

确认规则是否匹配 fail2ban 的 regex

修改后,使用以下命令进行确认

fail2ban-regex /var/log/auth.log /usr/local/etc/fail2ban/filter.d/sshd.conf

从昨天开始启用,抓到了不少。
对我来说,会尝试连接 sshd 的显然是坏家伙,所以我设置了封禁 10 周的严厉规则。对于尝试通过各种协议干坏事的家伙,则是封禁 52 周的重刑。
希望能定期导出报告啊。

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 18
|  |- Total failed:     201
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 16
   |- Total banned:     16
   `- Banned IP list:   76.164.199.128 213.209.159.159 211.215.17.214 80.94.92.184 27.79.3.114 62.210.236.6 45.148.10.121 175.199.67.164 151.115.61.11 103.251.247.158 161.132.53.175 103.193.177.213 37.77.150.223 2.57.121.112 2.57.122.238 2001:db8::1

另一个一直有效的服务器

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 9
|  |- Total failed:     136
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 217
   |- Total banned:     217
`- 封禁 IP 列表: 1.214.197.163 101.126.143.178 101.36.119.184 101.36.122.139 101.47.8.188 102.218.89.110 103.106.194.74 103.117.56.120 103.146.159.14 103.165.139.145 103.172.236.15 103.186.1.59 103.187.165.26 103.190.214.241 103.4.145.50 103.49.62.60 103.56.30.33 103.86.198.162 104.234.186.31 105.96.13.6 107.150.119.24 109.172.55.48 109.199.104.147 109.91.4.177 112.216.108.62 112.216.120.67 112.217.199.222 112.74.189.236 115.91.48.142 116.177.172.47 116.193.191.46 116.203.78.192 117.6.44.221 118.127.40.41 118.196.30.45 118.26.36.195 118.99.102.162 119.28.9.170 121.141.219.98 121.179.93.147 121.229.9.110 121.237.180.222 121.43.130.56 121.43.68.127 122.10.115.18 122.177.243.178 125.124.183.254 125.16.27.190 138.197.107.71 14.103.118.186 141.98.234.187 142.171.168.165 147.45.145.178 147.50.103.212 151.115.167.122 151.115.60.168 152.32.131.112 152.32.135.217 152.32.211.151 152.32.226.88 154.125.102.6 154.204.183.232 154.241.59.248 155.4.244.107 158.160.228.40 160.242.45.113 163.7.8.79 165.154.22.6 165.154.6.102 165.154.6.49 171.244.135.35 171.25.158.68 172.174.72.225 172.245.28.15 174.114.168.200 175.107.201.149 175.198.28.246 177.53.215.134 178.176.225.79 181.115.147.5 181.191.128.18 181.23.112.179 182.253.171.9 183.91.11.36 184.189.6.211 185.225.191.217 185.226.89.235 185.228.135.197 185.9.193.111 187.251.123.104 189.231.243.175 190.119.63.98 193.24.211.95 193.32.162.151 193.46.255.86 197.199.224.52 197.227.8.186 198.98.55.71 2.26.97.156 2.57.121.112 2.57.121.25 2.57.122.238 2.57.122.96 20.12.41.6 20.203.42.204 200.24.69.113 201.184.50.251 202.165.22.58 202.165.29.123 202.184.144.220 202.4.106.201 203.116.129.55 203.228.30.198 207.154.254.44 207.180.229.239 210.79.190.22 213.209.159.159 217.154.42.110 222.108.100.117 222.110.147.56 222.110.147.58 223.197.186.7 223.197.248.209 23.27.197.82 36.255.220.44 39.104.209.215 40.117.97.0 41.242.115.84 41.86.34.139 43.134.187.172 43.154.202.17 43.155.21.198 43.156.71.43 43.157.98.118 43.167.212.236 43.245.97.82 45.121.147.48 45.144.233.139 45.148.10.121 45.148.10.183 45.161.237.218 45.165.14.197 45.194.37.246 45.196.236.141 45.205.1.8 45.91.193.105 46.250.250.119 49.228.239.106 5.182.83.231 50.99.170.152 51.15.145.170 51.158.182.190 51.75.247.232 52.224.109.126 54.38.52.18 58.225.220.117 59.98.148.5 70.65.44.183 72.253.251.7 77.105.132.10 78.128.112.74 80.94.92.168 80.94.92.171 80.94.92.183 80.94.92.184 85.239.61.85 85.8.183.115 87.251.64.147 89.190.156.19 89.190.156.34 92.118.39.56 92.118.39.62 92.118.39.72 92.118.39.76 93.93.202.165 171.25.158.74 45.175.37.18 203.192.232.180 196.188.63.205 101.47.159.125 136.232.11.10 130.162.132.75 87.251.64.149 189.217.130.86 45.38.41.162 129.121.84.193 27.79.3.114 12.163.139.34 121.43.139.74 171.25.158.73 112.78.10.55 12.156.67.18 137.255.13.209 118.193.33.128 221.163.5.228 62.210.238.132 191.5.31.61 45.66.228.255 159.223.94.24 182.40.195.233 128.14.225.164 219.151.191.44 182.253.156.173 152.52.15.213 114.35.59.237 36.50.54.62 34.124.213.151 163.7.6.74 74.243.239.219 222.255.214.79 165.22.71.233 182.93.7.194 45.43.55.121 101.36.108.213 45.144.233.56 43.164.1.207 172.190.24.225

Related Posts