Estou tentando executar o fail2ban no CentOS7 (sem o SELinux) e ele usa o firewalld. Meu objetivo é defini-lo para banir a senha do Asterisk.
A configuração padrão foi yum install fail2ban
Em termos de configuração, SOMENTE adicionei jail.local ao seguinte:
[DEFAULT]
backend = systemd
banaction = firewallcmd-ipset
destemail = [email protected]
sender = [email protected]
[asterisk]
enabled = true
#filter = asterisk
#logpath = /var/log/asterisk/messages
maxretry = 5
bantime = 86400
Agora, quando eu reinicio o serviço fail2ban, recebo entradas como fail2ban.log:
2015-04-26 13:35:18,149 fail2ban.server [2820]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.1
2015-04-26 13:35:18,151 fail2ban.database [2820]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2015-04-26 13:35:18,158 fail2ban.jail [2820]: INFO Creating new jail 'asterisk'
2015-04-26 13:35:18,182 fail2ban.jail [2820]: INFO Jail 'asterisk' uses systemd
2015-04-26 13:35:18,213 fail2ban.jail [2820]: INFO Initiated 'systemd' backend
2015-04-26 13:35:18,220 fail2ban.filter [2820]: INFO Set maxRetry = 5
2015-04-26 13:35:18,222 fail2ban.actions [2820]: INFO Set banTime = 86400
2015-04-26 13:35:18,223 fail2ban.filter [2820]: INFO Set findtime = 600
2015-04-26 13:35:18,309 fail2ban.filtersystemd [2820]: NOTICE Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
2015-04-26 13:35:18,331 fail2ban.jail [2820]: INFO Jail 'asterisk' started
2015-04-26 13:35:18,488 fail2ban [2820]: CRITICAL Unhandled exception in Fail2Ban:
Traceback (most recent call last):
File "/usr/lib/python2.7/site-packages/fail2ban/server/jailthread.py", line 64, in run_with_except_hook
run(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/fail2ban/server/filtersystemd.py", line 244, in run
*self.formatJournalEntry(logentry))
File "/usr/lib/python2.7/site-packages/fail2ban/server/filtersystemd.py", line 172, in formatJournalEntry
'SYSLOG_PID', logentry['_PID']))
KeyError: '_PID'
2015-04-26 13:35:19,211 fail2ban.actions [2820]: NOTICE [asterisk] Ban 212.129.1.26
2015-04-26 13:35:19,534 fail2ban.actions [2820]: NOTICE [asterisk] Ban 212.83.187.182
Eu não entendo o que está faltando. Essas duas ações de "proibição" no log não estão acontecendo (ainda vejo tentativas desses IPs em logs do Asterisk)