esta é a primeira vez que não encontrei uma solução aqui.
então, esperamos que possa ser resolvido.
Eu instalei um novo sistema mínimo do ubuntu (14.04) com o ssh nele.
Logo depois que eu instalei o fail2ban.
meu ssh está rodando na porta 47629
meu jail.conf:
ignoreip = 127.0.0.1 10.14.11.165
bantime = 9999
findtime = 150
maxretry = 3
backend = auto
usedns = warn
destemail = [email protected]
sendername = [email protected]
mta = mail
chain = INPUT
action = %(action_mwl)s
[ssh-iptables]
enabled = true
port = 47629
filter = sshd
action = iptables[name=SSH, port=47629, protocol=tcp]
sendmail-whois[name=SSH, [email protected], [email protected]]
logpath = /var/log/auth.log
maxretry = 4
meu auth.log se parece com isso
Jan 15 08:16:38 hostweb sshd[5841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.14.11.57 user=root
Jan 15 08:16:40 hostweb sshd[5841]: Failed password for root from 10.14.11.57 port 50091 ssh2
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session closed for user root
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 15 08:17:02 hostweb CRON[5843]: pam_unix(cron:session): session closed for user root
Jan 15 08:17:37 hostweb sshd[5841]: message repeated 5 times: [ Failed password for root from 10.14.11.57 port 50091 ssh2]
Jan 15 08:17:37 hostweb sshd[5841]: Disconnecting: Too many authentication failures for root [preauth]
Jan 15 08:17:37 hostweb sshd[5841]: PAM 5 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.14.11.57 user=root
Jan 15 08:17:37 hostweb sshd[5841]: PAM service(sshd) ignoring max retries; 6 > 3
mesmo quando eu configuro o maxretry = 1, ele nunca funciona
eu configurei em / etc / ssh / sshd_config
MaxAuthTries 8
esperamos que o fail2ban pegue o bloco primeiro, sem sucesso
dicas de como resolver isso?
Eu segui este guia do DigitalOcean e pelo que você postou, você precisa copiar o arquivo jail.conf para jail.local para que ele funcione.
Do guia:
There is a file with defaults called jail.conf.
Since this file can be modified by package upgrades, we should not edit this file in-place, but rather copy it so that we can make our changes safely.
We need to copy this to a file called jail.local for fail2ban to find it:
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Tags ssh pam fail2ban ubuntu ubuntu-14.04