Como faço para banir automaticamente o pacote curto UDP com o Fail2Ban?

Question

Como faço para banir automaticamente o pacote curto UDP com o Fail2Ban?

#1 resposta do (8 votos)

4

Este arquivo de log /var/log/kern.log contém alguns endereços IP, que eu gostaria que o sistema banisse / bloqueasse automaticamente.

Basicamente, um pacote é do protocolo UDP e é um pacote curto, então eu gostaria que o host desse pacote fosse banido pelo IPTables via Fail2Ban.

03-serv:~# cat /var/log/kern.log | grep ' UDP: short packet: From '
Dec 19 16:05:12 03-serv kernel: UDP: short packet: From 74.60.6.213:1900 311/299 to x.x.x.x:27015
Dec 19 16:05:57 03-serv kernel: UDP: short packet: From 1.215.252.130:1900 11297/286 to x.x.x.x:27015
Dec 19 16:08:17 03-serv kernel: UDP: short packet: From 184.0.249.136:1900 363/299 to x.x.x.x:27015
Dec 19 16:09:54 03-serv kernel: UDP: short packet: From 1.214.66.49:1900 11297/310 to x.x.x.x:27015
Dec 19 16:11:28 03-serv kernel: UDP: short packet: From 1.214.214.2:1900 11297/320 to x.x.x.x:27015
Dec 19 18:00:45 03-serv kernel: UDP: short packet: From 74.60.171.197:1900 295/279 to x.x.x.x:27015
Dec 19 18:00:59 03-serv kernel: UDP: short packet: From 112.155.240.24:1900 11297/300 to x.x.x.x:27015
Dec 20 16:02:07 03-serv kernel: UDP: short packet: From 1.220.200.162:1900 11297/312 to x.x.x.x:27015
Dec 20 16:02:30 03-serv kernel: UDP: short packet: From 1.215.123.171:1900 11297/302 to x.x.x.x:27015

Aqui está minha cadeia final do Fail2Ban em jail.conf :

[ddos]
enabled   = true
port      = 27015
protocol  = udp
filter    = ddos
logpath   = /var/log/kern.log
maxretry  = 3
bantime   = 6000

E aqui está minha configuração UDP curta e curta em /etc/fail2ban/filter.d/ddos.conf :

[Definition]

# Option:  failregex
# Notes.:  Auto block short UDP.
# Values:  TEXT
#
failregex = ^.*kernel: UDP: short packet: From <HOST>:.*$

ignoreregex =

iptables fail2ban

por mikael karlsson 20.12.2014 / 17:06

1 resposta

Tags iptables fail2ban

Quando o cron estiver concluído Como obter uma notificação por email e efetuar login em um arquivo (ambos) Possível configurar o postgrey em apenas endereços .com de lista?

score 8 · Accepted Answer

O failregex precisa corresponder à saída completa e pode assumir a forma de uma expressão regular completa, algo assim:

'^.*kernel: UDP: short packet: From <HOST>:.*$'

Você pode testar suas expressões regulares usando ( documentação ):

fail2ban-regex -v /var/log/kern.log /etc/fail2ban/filter.d/ddos.conf

Testado e verificado abaixo:

cwatson@loki:~$ cat ./kern.log
Dec 19 16:05:12 03-serv kernel: UDP: short packet: From 74.60.6.213:1900 311/299 to x.x.x.x:27015
Dec 19 16:05:57 03-serv kernel: UDP: short packet: From 1.215.252.130:1900 11297/286 to x.x.x.x:27015
Dec 19 16:08:17 03-serv kernel: UDP: short packet: From 184.0.249.136:1900 363/299 to x.x.x.x:27015
Dec 19 16:09:54 03-serv kernel: UDP: short packet: From 1.214.66.49:1900 11297/310 to x.x.x.x:27015
Dec 19 16:11:28 03-serv kernel: UDP: short packet: From 1.214.214.2:1900 11297/320 to x.x.x.x:27015
Dec 19 18:00:45 03-serv kernel: UDP: short packet: From 74.60.171.197:1900 295/279 to x.x.x.x:27015
Dec 19 18:00:59 03-serv kernel: UDP: short packet: From 112.155.240.24:1900 11297/300 to x.x.x.x:27015
Dec 20 16:02:07 03-serv kernel: UDP: short packet: From 1.220.200.162:1900 11297/312 to x.x.x.x:27015
Dec 20 16:02:30 03-serv kernel: UDP: short packet: From 1.215.123.171:1900 11297/302 to x.x.x.x:27015

cwatson@loki:~$ fail2ban-regex -v ./kern.log "^.*kernel: UDP: short packet: From <HOST>:.*$"

Running tests
=============

Use   failregex line : ^.*kernel: UDP: short packet: From <HOST>:.*$
Use         log file : ./kern.log


Results
=======

Failregex: 9 total
|-  #) [# of hits] regular expression
|   1) [9] ^.*kernel: UDP: short packet: From <HOST>:.*$
|      74.60.6.213  Fri Dec 19 16:05:12 2014
|      1.215.252.130  Fri Dec 19 16:05:57 2014
|      184.0.249.136  Fri Dec 19 16:08:17 2014
|      1.214.66.49  Fri Dec 19 16:09:54 2014
|      1.214.214.2  Fri Dec 19 16:11:28 2014
|      74.60.171.197  Fri Dec 19 18:00:45 2014
|      112.155.240.24  Fri Dec 19 18:00:59 2014
|      1.220.200.162  Sat Dec 20 16:02:07 2014
|      1.215.123.171  Sat Dec 20 16:02:30 2014
'-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [9] MONTH Day Hour:Minute:Second
|  [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second
|  [0] Year/Month/Day Hour:Minute:Second
|  [0] Day/Month/Year Hour:Minute:Second
|  [0] Day/Month/Year2 Hour:Minute:Second
|  [0] Day/MONTH/Year:Hour:Minute:Second
|  [0] Month/Day/Year:Hour:Minute:Second
|  [0] Year-Month-Day Hour:Minute:Second[,subsecond]
|  [0] Year-Month-Day Hour:Minute:Second
|  [0] Year.Month.Day Hour:Minute:Second
|  [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
|  [0] Day-Month-Year Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second[.Millisecond]
|  [0] TAI64N
|  [0] Epoch
|  [0] ISO 8601
|  [0] Hour:Minute:Second
|  [0] <Month/Day/Year@Hour:Minute:Second>
|  [0] YearMonthDay Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second
'-

Lines: 9 lines, 0 ignored, 9 matched, 0 missed