fail2ban Problem

AllOnline · Feb 3, 2011

Hallo,

euch nervt es wahrscheinlich schon, aber ich finde keinen Fehler:

Code:

p043:/var/log# tail -f /var/log/fail2ban.log
2011-02-03 18:33:24,147 fail2ban.jail   : INFO   Jail 'sasl' uses poller
2011-02-03 18:33:24,148 fail2ban.filter : INFO   Added logfile = /var/log/mail.log
2011-02-03 18:33:24,149 fail2ban.filter : INFO   Set maxRetry = 3
2011-02-03 18:33:24,151 fail2ban.filter : INFO   Set findtime = 600
2011-02-03 18:33:24,151 fail2ban.actions: INFO   Set banTime = 600
2011-02-03 18:33:24,159 fail2ban.jail   : INFO   Jail 'vsftpd' started
2011-02-03 18:33:24,167 fail2ban.jail   : INFO   Jail 'ssh-ddos' started
2011-02-03 18:33:24,197 fail2ban.jail   : INFO   Jail 'ssh' started
2011-02-03 18:33:24,223 fail2ban.jail   : INFO   Jail 'postfix' started
2011-02-03 18:33:24,291 fail2ban.jail   : INFO   Jail 'sasl' started

Aber es bant und logt nicht weiter :-(

Code:

ignoreip = 127.0.0.1
bantime  = 600
findtime = 600
maxretry = 3
backend = auto

destemail = root@localhost

banaction = iptables-multiport
protocol = tcp


[ssh]
enabled = true
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6


[pam-generic]

enabled = false
# pam-generic filter can be customized to monitor specific subset of 'tty's
filter  = pam-generic
# port actually must be irrelevant but lets leave it all for some possible uses
port = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[ssh-ddos]

enabled = true
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6


[vsftpd]
enabled  = true
port     = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /var/log/vsftpd.log

[postfix]
enabled  = true
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log

[sasl]
enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
logpath  = /var/log/mail.log

Handelt sich um Debian!
Die Pfade stimmen!

Wäre nett wenn Ihr mir helfen könntet.

weiß einer zudem, wie ich die apache funktionalität für Confixx einstellen kann?!
/home/www/webX/log/apache.log

edit: Evtl zu Sicherheit verschieben.

dev · Feb 3, 2011

Was sagen:

Code:

iptables -L -v

und

Code:

netstat -tapn

und

Code:

/etc/init.d/fail2ban status

?

Und: Hast Du an den Filtern rumgespielt?

In meiner Lenny f2b.conf steht folgendes:

# yoh: For some reason Debian shipped python-gamin didn't work as expected
# This issue left ToDo, so polling is default backend for now
backend = polling

Bei Dir steht auto, sollte trotzdem funktionieren, aber manchmal steckt man nicht drin.

AllOnline · Feb 3, 2011

Code:

p043:/var/log# iptables -L -v
Chain INPUT (policy ACCEPT 15M packets, 4012M bytes)
 pkts bytes target     prot opt in     out     source               destination
   26  7516 fail2ban-sasl  tcp  --  any    any     anywhere             anywhere            multiport dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
   26  7516 fail2ban-postfix  tcp  --  any    any     anywhere             anywhere            multiport dports smtp,ssmtp
  493 38612 fail2ban-ssh-ddos  tcp  --  any    any     anywhere             anywhere            multiport dports ssh
  493 38612 fail2ban-ssh  tcp  --  any    any     anywhere             anywhere            multiport dports ssh
   70  3192 fail2ban-vsftpd  tcp  --  any    any     anywhere             anywhere            multiport dports ftp,ftp-data,ftps,ftps-data

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 15M packets, 13G bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain fail2ban-postfix (1 references)
 pkts bytes target     prot opt in     out     source               destination
   26  7516 RETURN     all  --  any    any     anywhere             anywhere

Chain fail2ban-sasl (1 references)
 pkts bytes target     prot opt in     out     source               destination
   26  7516 RETURN     all  --  any    any     anywhere             anywhere

Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in     out     source               destination
  493 38612 RETURN     all  --  any    any     anywhere             anywhere

Chain fail2ban-ssh-ddos (1 references)
 pkts bytes target     prot opt in     out     source               destination
  493 38612 RETURN     all  --  any    any     anywhere             anywhere

Chain fail2ban-vsftpd (1 references)
 pkts bytes target     prot opt in     out     source               destination
   70  3192 RETURN     all  --  any    any     anywhere             anywhere

Code:

p043:/var/log# netstat -tapn
Aktive Internetverbindungen (Server und stehende Verbindungen)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:40806           0.0.0.0:*               LISTEN      2044/rpc.statd
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      24046/mysqld
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      2033/portmap
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN      15313/vsftpd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      2194/sshd
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      31970/master
tcp        0      0 127.0.0.1:703           0.0.0.0:*               LISTEN      3495/famd
tcp        0      0 xxxx:54965     xxxx:80         TIME_WAIT   -
tcp        0      0 xxxx:54964     xxxx:80         TIME_WAIT   -
tcp        0      0 xxxx:54963     xxxx:80         TIME_WAIT   -
tcp        0      0 xxxx:54966     xxxx:80         TIME_WAIT   -
tcp        0    xxxx:22        xxxx:49793     VERBUNDEN   14645/sshd: toor [p
tcp        0      0 xxxx:54967     xxxx:80         TIME_WAIT   -
tcp        0      1 xxxx:54968     xxxx:80         SYN_SENT    15320/apache2
tcp6       0      0 :::110                  :::*                    LISTEN      2949/couriertcpd
tcp6       0      0 :::143                  :::*                    LISTEN      2933/couriertcpd
tcp6       0      0 :::80                   :::*                    LISTEN      15020/apache2
tcp6       0      0 :::22                   :::*                    LISTEN      2194/sshd
tcp6       0      0 :::3000                 :::*                    LISTEN      3232/ntop
tcp6       0      0 :::443                  :::*                    LISTEN      15020/apache2 
[...] aktuelle IP verbindungen auf port 80
VERBUNDEN   15320/apache2

Code:

p043:/var/log# /etc/init.d/fail2ban status
Status of authentication failure monitor:fail2ban is running.

backend = polling hatte ich vorher :-(

dev · Feb 3, 2011

Eine Frage bleibt noch unbeantwortet!

Log Dich bitte mehrfach falsch ein (>3x) und teste danach mal die Filter:

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

hafgan · Feb 3, 2011

Mir ist das mal passiert:
http://serversupportforum.de/forum/virtuelle-server/42272-fail2ban-reagiert-nicht.html#post264088

Passen die Einstellungen von Datum und Uhrzeit? Werden in den zu kontrollierenden Log-Dateien die richtigen Uhrzeiten angegeben.

AllOnline · Feb 4, 2011

dpkg-reconfigure tzdata muss ich heute nachmittag mal schauen.

$ dpkg-reconfigure tzdata
sh: dpkg-reconfigure: command not found

Nein ich habe nichts an den Filtern gemacht!

ssh wird momentan noch von denyhosts gemacht,
mir gehts vorallem um ftp!

Leider gerade keine vollen Zugriff auf den Server :-(

Danke euch!

AllOnline · Feb 5, 2011

vielleicht hilft das weiter?!:

Code:

 ,441 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.3
 ,441 fail2ban.comm   : DEBUG  Command: ['add', 'vsftpd', 'polling']
 ,442 fail2ban.jail   : INFO   Creating new jail 'vsftpd'
 ,442 fail2ban.jail   : INFO   Jail 'vsftpd' uses poller
 ,458 fail2ban.filter : DEBUG  Created Filter
 ,458 fail2ban.filter : DEBUG  Created FilterPoll
 ,459 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addlogpath', '/var/log/vsftpd.log']
 ,460 fail2ban.filter : INFO   Added logfile = /var/log/vsftpd.log
 ,460 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'maxretry', '5']
 ,461 fail2ban.filter : INFO   Set maxRetry = 5
 ,461 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addignoreip', '127.0.0.1']
 ,461 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
 ,462 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addignoreip', 'xxx.xxx.xxx.xxx']
 ,462 fail2ban.filter : DEBUG  Add xxx.xxx.xxx.xxx to ignore list
 ,463 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'findtime', '600']
 ,463 fail2ban.filter : INFO   Set findtime = 600
 ,463 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'bantime', '600']
 ,464 fail2ban.actions: INFO   Set banTime = 600
 ,464 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addfailregex', 'vsftpd(?:\\(pam_unix\\))?(?:\\[\\d+\\])?:.* authentication fail$
 ,467 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addfailregex', '\\[.+\\] FAIL LOGIN: Client "<HOST>"\\s*$']
 ,468 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'addaction', 'iptables-multiport']
 ,469 fail2ban.actions.action: DEBUG  Created Action
 ,469 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j DRO$
 ,469 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 ,470 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'actionstop', 'iptables-multiport', 'iptables -D INPUT -p <protocol> -m multipor$
 ,470 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
 ,471 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A f$
 ,471 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 ,472 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j DRO$
 ,472 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
 ,472 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'actioncheck', 'iptables-multiport', 'iptables -n -L INPUT | grep -q fail2ban-<n$
 ,473 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 ,473 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
 ,474 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'setcinfo', 'iptables-multiport', 'name', 'vsftpd']
 ,475 fail2ban.comm   : DEBUG  Command: ['set', 'vsftpd', 'setcinfo', 'iptables-multiport', 'port', 'ftp,ftp-data,ftps,ftps-data']
 ,475 fail2ban.comm   : DEBUG  Command: ['add', 'ssh-ddos', 'polling']
 ,476 fail2ban.jail   : INFO   Creating new jail 'ssh-ddos'
 ,476 fail2ban.jail   : INFO   Creating new jail 'ssh-ddos'
 ,476 fail2ban.jail   : INFO   Jail 'ssh-ddos' uses poller
 ,476 fail2ban.filter : DEBUG  Created Filter
 ,476 fail2ban.filter : DEBUG  Created FilterPoll
 ,477 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'addlogpath', '/var/log/auth.log']
 ,477 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
 ,478 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'maxretry', '6']
 ,478 fail2ban.filter : INFO   Set maxRetry = 6
 ,478 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'addignoreip', '127.0.0.1']
 ,479 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
 ,479 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'addignoreip', 'xxx.xxx.xxx.xxx']
 ,479 fail2ban.filter : DEBUG  Add xxx.xxx.xxx.xxx to ignore list
 ,480 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'findtime', '600']
 ,480 fail2ban.filter : INFO   Set findtime = 600
 ,481 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'bantime', '600']
 ,481 fail2ban.actions: INFO   Set banTime = 600
 ,481 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'addfailregex', 'sshd(?:\\[\\d+\\])?: Did not receive identification string fr$
 ,483 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'addaction', 'iptables-multiport']
 ,483 fail2ban.actions.action: DEBUG  Created Action
 ,484 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j D$
 ,484 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 ,485 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'actionstop', 'iptables-multiport', 'iptables -D INPUT -p <protocol> -m multip$
 ,485 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
 ,486 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A$
 ,486 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 ,486 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j D$
 ,487 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
 ,487 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'actioncheck', 'iptables-multiport', 'iptables -n -L INPUT | grep -q fail2ban-$
 ,487 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 ,488 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
 ,489 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'setcinfo', 'iptables-multiport', 'name', 'ssh-ddos']
 ,490 fail2ban.comm   : DEBUG  Command: ['set', 'ssh-ddos', 'setcinfo', 'iptables-multiport', 'port', 'ssh']
 ,490 fail2ban.comm   : DEBUG  Command: ['add', 'ssh', 'polling']
 ,490 fail2ban.jail   : INFO   Creating new jail 'ssh'
 ,490 fail2ban.jail   : INFO   Jail 'ssh' uses poller
 ,491 fail2ban.filter : DEBUG  Created Filter
 ,491 fail2ban.filter : DEBUG  Created FilterPoll
 ,491 fail2ban.filter : DEBUG  Created FilterPoll
 ,492 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addlogpath', '/var/log/auth.log']
 ,492 fail2ban.filter : INFO   Added logfile = /var/log/auth.log
 ,492 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'maxretry', '6']
 ,493 fail2ban.filter : INFO   Set maxRetry = 6
 ,493 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addignoreip', '127.0.0.1']
 ,493 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
 ,494 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addignoreip', 'xxx.xxx.xxx.xxx']
 ,494 fail2ban.filter : DEBUG  Add xxx.xxx.xxx.xxx to ignore list
 ,495 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'findtime', '600']
 ,495 fail2ban.filter : INFO   Set findtime = 600
 ,495 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'bantime', '600']
 ,496 fail2ban.actions: INFO   Set banTime = 600
 ,496 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,504 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,509 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,514 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,519 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,525 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,532 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', "^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,540 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,549 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,558 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addfailregex', '^\\s*(?:\\S+ )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?$
 ,569 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'addaction', 'iptables-multiport']
 ,569 fail2ban.actions.action: DEBUG  Created Action
 ,570 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j DROP']
 ,570 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 ,571 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'actionstop', 'iptables-multiport', 'iptables -D INPUT -p <protocol> -m multiport -$
 ,571 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
 ,572 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A fail$
 ,572 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 ,573 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j DROP']
 ,573 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
 ,573 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'actioncheck', 'iptables-multiport', 'iptables -n -L INPUT | grep -q fail2ban-<name$
 ,574 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 ,574 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
 ,575 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'setcinfo', 'iptables-multiport', 'name', 'ssh']
 ,575 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'setcinfo', 'iptables-multiport', 'name', 'ssh']
 ,575 fail2ban.comm   : DEBUG  Command: ['set', 'ssh', 'setcinfo', 'iptables-multiport', 'port', 'ssh']
 ,576 fail2ban.comm   : DEBUG  Command: ['add', 'postfix', 'polling']
 ,576 fail2ban.jail   : INFO   Creating new jail 'postfix'
 ,576 fail2ban.jail   : INFO   Jail 'postfix' uses poller
 ,577 fail2ban.filter : DEBUG  Created Filter
 ,577 fail2ban.filter : DEBUG  Created FilterPoll
 ,577 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'addlogpath', '/var/log/mail.log']
 ,578 fail2ban.filter : INFO   Added logfile = /var/log/mail.log
 ,578 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'maxretry', '5']
 ,578 fail2ban.filter : INFO   Set maxRetry = 5
 ,579 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'addignoreip', '127.0.0.1']
 ,579 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
 ,580 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'addignoreip', 'xxx.xxx.xxx.xxx']
 ,580 fail2ban.filter : DEBUG  Add xxx.xxx.xxx.xxx to ignore list
 ,581 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'findtime', '600']
 ,581 fail2ban.filter : INFO   Set findtime = 600
 ,581 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'bantime', '600']
 ,581 fail2ban.actions: INFO   Set banTime = 600
 ,582 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'addfailregex', 'reject: RCPT from (.*)\\[<HOST>\\]: 554']
 ,584 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'addaction', 'iptables-multiport']
 ,584 fail2ban.actions.action: DEBUG  Created Action
 ,584 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j DR$
 ,584 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 ,585 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'actionstop', 'iptables-multiport', 'iptables -D INPUT -p <protocol> -m multipo$
 ,585 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
 ,586 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A $
 ,586 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 ,587 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j DR$
 ,587 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
 ,588 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'actioncheck', 'iptables-multiport', 'iptables -n -L INPUT | grep -q fail2ban-<$
 ,588 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 ,588 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
 ,589 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'setcinfo', 'iptables-multiport', 'name', 'postfix']
 ,590 fail2ban.comm   : DEBUG  Command: ['set', 'postfix', 'setcinfo', 'iptables-multiport', 'port', 'smtp,ssmtp']
 ,590 fail2ban.comm   : DEBUG  Command: ['add', 'sasl', 'polling']
 ,590 fail2ban.jail   : INFO   Creating new jail 'sasl'
 ,590 fail2ban.comm   : DEBUG  Command: ['add', 'sasl', 'polling']
 ,590 fail2ban.jail   : INFO   Creating new jail 'sasl'
 ,591 fail2ban.jail   : INFO   Jail 'sasl' uses poller
 ,591 fail2ban.filter : DEBUG  Created Filter
 ,591 fail2ban.filter : DEBUG  Created FilterPoll
 ,592 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'addlogpath', '/var/log/mail.log']
 ,592 fail2ban.filter : INFO   Added logfile = /var/log/mail.log
 ,593 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'maxretry', '5']
 ,593 fail2ban.filter : INFO   Set maxRetry = 5
 ,594 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'addignoreip', '127.0.0.1']
 ,594 fail2ban.filter : DEBUG  Add 127.0.0.1 to ignore list
 ,595 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'addignoreip', 'xxx.xxx.xxx.xxx']
 ,595 fail2ban.filter : DEBUG  Add xxx.xxx.xxx.xxx to ignore list
 ,595 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'findtime', '600']
 ,595 fail2ban.filter : INFO   Set findtime = 600
 ,596 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'bantime', '600']
 ,596 fail2ban.actions: INFO   Set banTime = 600
 ,597 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'addfailregex', ': warning: [-._\\w]+\\[<HOST>\\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIG$
 ,599 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'addaction', 'iptables-multiport']
 ,599 fail2ban.actions.action: DEBUG  Created Action
 ,600 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'actionban', 'iptables-multiport', 'iptables -I fail2ban-<name> 1 -s <ip> -j DROP']
 ,600 fail2ban.actions.action: DEBUG  Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 ,601 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'actionstop', 'iptables-multiport', 'iptables -D INPUT -p <protocol> -m multiport $
 ,601 fail2ban.actions.action: DEBUG  Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>
 ,602 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'actionstart', 'iptables-multiport', 'iptables -N fail2ban-<name>\niptables -A fai$
 ,602 fail2ban.actions.action: DEBUG  Set actionStart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
 ,602 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'actionunban', 'iptables-multiport', 'iptables -D fail2ban-<name> -s <ip> -j DROP']
 ,603 fail2ban.actions.action: DEBUG  Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP
 ,603 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'actioncheck', 'iptables-multiport', 'iptables -n -L INPUT | grep -q fail2ban-<nam$
 ,603 fail2ban.actions.action: DEBUG  Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>
 ,604 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'setcinfo', 'iptables-multiport', 'protocol', 'tcp']
 ,605 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'setcinfo', 'iptables-multiport', 'name', 'sasl']
 ,605 fail2ban.comm   : DEBUG  Command: ['set', 'sasl', 'setcinfo', 'iptables-multiport', 'port', 'smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s$
 ,606 fail2ban.comm   : DEBUG  Command: ['start', 'vsftpd']
 ,606 fail2ban.jail   : INFO   Jail 'vsftpd' started
 ,606 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
 ,607 fail2ban.actions.action: DEBUG  iptables -N fail2ban-vsftpd
 ,606 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
 ,607 fail2ban.actions.action: DEBUG  iptables -N fail2ban-vsftpd
iptables -A fail2ban-vsftpd -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j fail2ban-vsftpd
 ,608 fail2ban.comm   : DEBUG  Command: ['start', 'ssh-ddos']
 ,611 fail2ban.filter.datedetector: DEBUG  Sorting the template list
 ,615 fail2ban.jail   : INFO   Jail 'ssh-ddos' started
 ,616 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
 ,617 fail2ban.actions.action: DEBUG  iptables -N fail2ban-ssh-ddos
iptables -A fail2ban-ssh-ddos -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh-ddos
 ,633 fail2ban.actions.action: DEBUG  iptables -N fail2ban-ssh-ddos
iptables -A fail2ban-ssh-ddos -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh-ddos returned successfully
 ,635 fail2ban.actions.action: DEBUG  iptables -N fail2ban-vsftpd
iptables -A fail2ban-vsftpd -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ftp,ftp-data,ftps,ftps-data -j fail2ban-vsftpd returned successfully
 ,644 fail2ban.comm   : DEBUG  Command: ['start', 'ssh']
 ,645 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
 ,645 fail2ban.actions.action: DEBUG  iptables -N fail2ban-ssh
iptables -A fail2ban-ssh -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh
 ,645 fail2ban.jail   : INFO   Jail 'ssh' started
 ,658 fail2ban.actions.action: DEBUG  iptables -N fail2ban-ssh
iptables -A fail2ban-ssh -j RETURN
iptables -I INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh returned successfully
 ,670 fail2ban.comm   : DEBUG  Command: ['start', 'postfix']
 ,673 fail2ban.jail   : INFO   Jail 'postfix' started
 ,674 fail2ban.comm   : DEBUG  Command: ['start', 'sasl']
 ,674 fail2ban.filter : DEBUG  /var/log/mail.log has been modified
 ,676 fail2ban.actions.action: DEBUG  iptables -N fail2ban-postfix
iptables -A fail2ban-postfix -j RETURN
iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-postfix
 ,679 fail2ban.jail   : INFO   Jail 'sasl' started
 ,679 fail2ban.filter : DEBUG  /var/log/mail.log has been modified
 ,680 fail2ban.actions.action: DEBUG  iptables -N fail2ban-sasl
iptables -A fail2ban-sasl -j RETURN
iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s -j fail2ban-sasl
 ,711 fail2ban.actions.action: DEBUG  iptables -N fail2ban-postfix
iptables -A fail2ban-postfix -j RETURN
iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-postfix returned successfully
iptables -A fail2ban-postfix -j RETURN
iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-postfix returned successfully
 ,728 fail2ban.actions.action: DEBUG  iptables -N fail2ban-sasl
iptables -A fail2ban-sasl -j RETURN
iptables -I INPUT -p tcp -m multiport --dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s -j fail2ban-sasl returned successfully
 13:03:45,632 fail2ban.filter.datedetector: DEBUG  Sorting the template list
 13:03:46,124 fail2ban.filter.datedetector: DEBUG  Sorting the template list
 13:03:46,548 fail2ban.filter.datedetector: DEBUG  Sorting the template list
 13:03:46,558 fail2ban.filter.datedetector: DEBUG  Sorting the template list

dann zeit geändert aber nichs verbessert:

Code:

p043:/# tail -f /var/log/fail2ban.log
2011-02-05 13:03:46,548 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 13:03:46,558 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 13:09:01,629 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
2011-02-05 13:09:01,630 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 13:09:02,122 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
2011-02-05 13:09:02,123 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:01,630 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
2011-02-05 14:10:01,631 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:02,122 fail2ban.filter : DEBUG  /var/log/auth.log has been modified
2011-02-05 14:10:02,123 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:19,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:19,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:23,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:23,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:24,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:24,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:26,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:26,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:29,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:29,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:32,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:32,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:34,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:34,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:39,625 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:39,626 fail2ban.filter.datedetector: DEBUG  Sorting the template list
2011-02-05 14:10:45,629 fail2ban.filter : DEBUG  /var/log/vsftpd.log has been modified
2011-02-05 14:10:45,630 fail2ban.filter.datedetector: DEBUG  Sorting the template list

Code:

Sat Feb  5 14:10:18 2011 [pid 28466] CONNECT: Client "xxx.xxx.xxx.xxx"
Sat Feb  5 14:10:18 2011 [pid 28466] FTP response: Client "xxx.xxx.xxx.xxx", "220 (vsFTPd 2.0.7)"
Sat Feb  5 14:10:18 2011 [pid 28466] FTP command: Client "xxx.xxx.xxx.xxx", "USER b??hm"
Sat Feb  5 14:10:18 2011 [pid 28466] [b??hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:18 2011 [pid 28466] FTP command: Client "xxx.xxx.xxx.xxx", "USER b?hm"
Sat Feb  5 14:10:18 2011 [pid 28466] [b?hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:23 2011 [pid 28468] CONNECT: Client "xxx.xxx.xxx.xxx"
Sat Feb  5 14:10:23 2011 [pid 28468] FTP response: Client "xxx.xxx.xxx.xxx", "220 (vsFTPd 2.0.7)"
Sat Feb  5 14:10:23 2011 [pid 28468] FTP command: Client "xxx.xxx.xxx.xxx", "USER b??hm"
Sat Feb  5 14:10:23 2011 [pid 28468] [b??hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:23 2011 [pid 28468] FTP command: Client "xxx.xxx.xxx.xxx", "USER b?hm"
Sat Feb  5 14:10:23 2011 [pid 28468] [b?hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:23 2011 [pid 28470] CONNECT: Client "xxx.xxx.xxx.xxx"
Sat Feb  5 14:10:23 2011 [pid 28470] FTP response: Client "xxx.xxx.xxx.xxx", "220 (vsFTPd 2.0.7)"
Sat Feb  5 14:10:24 2011 [pid 28470] FTP command: Client "xxx.xxx.xxx.xxx", "USER b??hm"
Sat Feb  5 14:10:24 2011 [pid 28470] [b??hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:24 2011 [pid 28470] FTP command: Client "xxx.xxx.xxx.xxx", "USER b?hm"
Sat Feb  5 14:10:24 2011 [pid 28470] [b?hm] FTP response: Client "xxx.xxx.xxx.xxx", "530 Permission denied."
Sat Feb  5 14:10:26 2011 [pid 28472] CONNECT: Client "xxx.xxx.xxx.xxx"
Sat Feb  5 14:10:26 2011 [pid 28472] FTP response: Client "xxx.xxx.xxx.xxx", "220 (vsFTPd 2.0.7)"
Sat Feb  5 14:10:26 2011 [pid 28472] FTP command: Client "xxx.xxx.xxx.xxx", "USER anonymous"

...

fail2ban Problem

AllOnline

New Member

dev

Registered User

AllOnline

New Member

dev

Registered User

hafgan

New Member

AllOnline

New Member

AllOnline

New Member