FreeBSD 上的 fail2ban 在預設設定下已無法運作，若仍沿用舊設定則需要進行確認

8 min

fail2banfreebsdセキュリティ
language: ja bn en es hi pt ru zh-cn zh-tw

你好，我是無能。

最近 FreeBSD 的 fail2ban 因為某些原因，sshd 規則不再執行 IP Ban 了。

目前的規則

如下所示。

jail.local :

[sshd]
enabled = true
port    = all
filter = sshd
allowipv6 = auto
logpath = /var/log/auth.log
bantime = 10w
findtime = 1w
maxretry = 3

但是，hetzner 那邊卻正常運作。這是為什麼呢？

更新

看來 fail2ban 那邊也更新了設定，新安裝的版本似乎已經修正了。

正確：

[DEFAULT]
_daemon = sshd(?:-session)?

錯誤：

[DEFAULT]
_daemon = sshd

之前的 sshd 執行檔現在被拆分為監聽器執行檔 sshd 和每個工作階段的執行檔 sshd-session
部分日誌訊息有所變動

OpenSSH 9.8p1 已發佈

  • sshd(8): the server has been split into a listener binary, sshd(8),
    and a per-session binary "sshd-session". This allows for a much
    smaller listener binary, as it no longer needs to support the SSH
    protocol. As part of this work, support for disabling privilege
    separation (which previously required code changes to disable) and
    disabling re-execution of sshd(8) has been removed. Further
    separation of sshd-session into additional, minimal binaries is
    planned for the future.

    sshd(8)：伺服器被拆分為監聽器執行檔 sshd(8) 和每個工作階段的執行檔 "sshd-session"。這使得監聽器執行檔的體積可以變得非常小，因為它不再需要支援 SSH 協定。作為這項工作的一部分，刪除了對停用權限分離（以前需要修改程式碼才能停用）和停用 sshd(8) 重新執行的支援。未來計劃將 sshd-session 進一步拆分為更小的最小（功能）單位執行檔群。

確認規則是否符合 fail2ban 的 regex

修正後，使用以下指令進行確認

fail2ban-regex /var/log/auth.log /usr/local/etc/fail2ban/filter.d/sshd.conf

從昨天開始套用，抓到了不少。
對我來說，會嘗試連線 sshd 的顯然是壞蛋，所以我設定了封鎖 10 週的嚴厲規則。至於那些嘗試透過各種協定做壞事的人，則是封鎖 52 週的重刑。
真想定期把這些匯出成報告。

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 18
|  |- Total failed:     201
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 16
   |- Total banned:     16
   `- Banned IP list:   76.164.199.128 213.209.159.159 211.215.17.214 80.94.92.184 27.79.3.114 62.210.236.6 45.148.10.121 175.199.67.164 151.115.61.11 103.251.247.158 161.132.53.175 103.193.177.213 37.77.150.223 2.57.121.112 2.57.122.238 2001:db8::1

另一個一直都有效的伺服器

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 9
|  |- Total failed:     136
|  `- Journal matches:  _SYSTEMD_UNIT=ssh.service + _COMM=sshd
`- Actions
   |- Currently banned: 217
   |- Total banned:     217`- 封鎖的 IP 列表：   1.214.197.163 101.126.143.178 101.36.119.184 101.36.122.139 101.47.8.188 102.218.89.110 103.106.194.74 103.117.56.120 103.146.159.14 103.165.139.145 103.172.236.15 103.186.1.59 103.187.165.26 103.190.214.241 103.4.145.50 103.49.62.60 103.56.30.33 103.86.198.162 104.234.186.31 105.96.13.6 107.150.119.24 109.172.55.48 109.199.104.147 109.91.4.177 112.216.108.62 112.216.120.67 112.217.199.222 112.74.189.236 115.91.48.142 116.177.172.47 116.193.191.46 116.203.78.192 117.6.44.221 118.127.40.41 118.196.30.45 118.26.36.195 118.99.102.162 119.28.9.170 121.141.219.98 121.179.93.147 121.229.9.110 121.237.180.222 121.43.130.56 121.43.68.127 122.10.115.18 122.177.243.178 125.124.183.254 125.16.27.190 138.197.107.71 14.103.118.186 141.98.234.187 142.171.168.165 147.45.145.178 147.50.103.212 151.115.167.122 151.115.60.168 152.32.131.112 152.32.135.217 152.32.211.151 152.32.226.88 154.125.102.6 154.204.183.232 154.241.59.248 155.4.244.107 158.160.228.40 160.242.45.113 163.7.8.79 165.154.22.6 165.154.6.102 165.154.6.49 171.244.135.35 171.25.158.68 172.174.72.225 172.245.28.15 174.114.168.200 175.107.201.149 175.198.28.246 177.53.215.134 178.176.225.79 181.115.147.5 181.191.128.18 181.23.112.179 182.253.171.9 183.91.11.36 184.189.6.211 185.225.191.217 185.226.89.235 185.228.135.197 185.9.193.111 187.251.123.104 189.231.243.175 190.119.63.98 193.24.211.95 193.32.162.151 193.46.255.86 197.199.224.52 197.227.8.186 198.98.55.71 2.26.97.156 2.57.121.112 2.57.121.25 2.57.122.238 2.57.122.96 20.12.41.6 20.203.42.204 200.24.69.113 201.184.50.251 202.165.22.58 202.165.29.123 202.184.144.220 202.4.106.201 203.116.129.55 203.228.30.198 207.154.254.44 207.180.229.239 210.79.190.22 213.209.159.159 217.154.42.110 222.108.100.117 222.110.147.56 222.110.147.58 223.197.186.7 223.197.248.209 23.27.197.82 36.255.220.44 39.104.209.215 40.117.97.0 41.242.115.84 41.86.34.139 43.134.187.172 43.154.202.17 43.155.21.198 43.156.71.43 43.157.98.118 43.167.212.236 43.245.97.82 45.121.147.48 45.144.233.139 45.148.10.121 45.148.10.183 45.161.237.218 45.165.14.197 45.194.37.246 45.196.236.141 45.205.1.8 45.91.193.105 46.250.250.119 49.228.239.106 5.182.83.231 50.99.170.152 51.15.145.170 51.158.182.190 51.75.247.232 52.224.109.126 54.38.52.18 58.225.220.117 59.98.148.5 70.65.44.183 72.253.251.7 77.105.132.10 78.128.112.74 80.94.92.168 80.94.92.171 80.94.92.183 80.94.92.184 85.239.61.85 85.8.183.115 87.251.64.147 89.190.156.19 89.190.156.34 92.118.39.56 92.118.39.62 92.118.39.72 92.118.39.76 93.93.202.165 171.25.158.74 45.175.37.18 203.192.232.180 196.188.63.205 101.47.159.125 136.232.11.10 130.162.132.75 87.251.64.149 189.217.130.86 45.38.41.162 129.121.84.193 27.79.3.114 12.163.139.34 121.43.139.74 171.25.158.73 112.78.10.55 12.156.67.18 137.255.13.209 118.193.33.128 221.163.5.228 62.210.238.132 191.5.31.61 45.66.228.255 159.223.94.24 182.40.195.233 128.14.225.164 219.151.191.44 182.253.156.173 152.52.15.213 114.35.59.237 36.50.54.62 34.124.213.151 163.7.6.74 74.243.239.219 222.255.214.79 165.22.71.233 182.93.7.194 45.43.55.121 101.36.108.213 45.144.233.56 43.164.1.207 172.190.24.225

Related Posts