Parece que usei um arquivo sshd.conf do mais recente 0.10 Fail2ban, que não é 100% compatível . Esta é a versão correta para 0,95.
Eu vejo esses erros com um arquivo sshd.conf recente. Existe uma razão para o mdre-normal ser definido como nada?
2017-07-10 10:51:42,218 fail2ban.filter [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,231 fail2ban.filter [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,245 fail2ban.filter [10436]: WARNING Mutliline regex set for jail '%s' but maxlines not greater than 1
2017-07-10 10:51:42,255 fail2ban.filter [10436]: ERROR No 'host' group in '<mdre-<mode>>'
2017-07-10 10:51:42,255 fail2ban.transmitter [10436]: WARNING Command ['set', 'sshd', 'addfailregex', '<mdre-<mode>>'] has failed. Received RegexException("No 'host' group in '<mdre-<mode>>'",)
2017-07-10 10:51:42,260 fail2ban.jail [10436]: INFO Creating new jail 'sshd-ddos'
erros de unban:
2017-07-10 10:50:11,097 fail2ban.action [3653]: ERROR firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- stdout: b'success\n'
2017-07-10 10:50:11,097 fail2ban.action [3653]: ERROR firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- stderr: b''
2017-07-10 10:50:11,097 fail2ban.action [3653]: ERROR firewall-cmd --remove-source=185.56.82.23 --zone=drop && firewall-cmd --remove-source=185.56.82.23 --zone=drop --permanent -- killed with SIGTERM (return code: -15)
2017-07-10 10:50:11,098 fail2ban.actions [3653]: ERROR Failed to execute unban jail 'recidive' action 'custom-firewalld' info '{'ip': '185.56.82.23', 'failures': 5, 'time': 1499270396.6778345, 'matches': '2016-12-28 14:30:25,831 fail2ban.actions [1884]
: NOTICE [sshd] Ban 185.56.82.232016-12-28 15:37:59,825 fail2ban.actions [1884]: NOTICE [sshd] Ban 185.56.82.232016-12-28 16:45:28,589 fail2ban.actions [1884]: NOTICE [sshd] Ban 185.56.82.232016-12-28 17:52:37,468 fail2ban.actions [1884]: NOTIC
E [sshd] Ban 185.56.82.232016-12-28 18:59:56,325 fail2ban.actions [1884]: NOTICE [sshd] Ban 185.56.82.23'}': Error unbanning 185.56.82.23
cat sshd.conf Eu vejo que mdre-normal = está em branco.
# Fail2Ban obsolete multiline example resp. test filter (previously sshd.conf)
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[DEFAULT]
_daemon = sshd
[Definition]
cmnfailre = ^%(__prefix_line_sl)s[aA]uthentication (?:failure|error|failed) for .* from <HOST>( via \S+)?\s*%(__suff)s$
^%(__prefix_line_sl)sUser not known to the underlying authentication module for .* from <HOST>\s*%(__suff)s$
^%(__prefix_line_sl)sFailed \S+ for (?P<cond_inv>invalid user )?(?P<user>(?P<cond_user>\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)) from <HOST>%(__on_port_opt)s(?: ssh\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)
^%(__prefix_line_sl)sROOT LOGIN REFUSED.* FROM <HOST>\s*%(__suff)s$
^%(__prefix_line_sl)s[iI](?:llegal|nvalid) user .*? from <HOST>%(__on_port_opt)s\s*$
^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*%(__suff)s$
^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*%(__suff)s$
^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because not in any group\s*%(__suff)s$
^%(__prefix_line_sl)srefused connect from \S+ \(<HOST>\)\s*%(__suff)s$
^%(__prefix_line_sl)sReceived disconnect from <HOST>%(__on_port_opt)s:\s*3: .*: Auth fail%(__suff)s$
^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*%(__suff)s$
^%(__prefix_line_sl)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*%(__suff)s$
^%(__prefix_line_sl)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*%(__suff)s$
^%(__prefix_line_sl)s(error: )?maximum authentication attempts exceeded for .* from <HOST>%(__on_port_opt)s(?: ssh\d*)? \[preauth\]$
^%(__prefix_line_ml1)sUser .+ not allowed because account is locked%(__prefix_line_ml2)sReceived disconnect from <HOST>: 11: .+%(__suff)s$
^%(__prefix_line_ml1)sDisconnecting: Too many authentication failures(?: for .+?)?%(__suff)s%(__prefix_line_ml2)sConnection closed by <HOST>%(__suff)s$
^%(__prefix_line_ml1)sConnection from <HOST>%(__on_port_opt)s%(__prefix_line_ml2)sDisconnecting: Too many authentication failures(?: for .+?)?%(__suff)s$
mdre-normal =
mdre-ddos = ^%(__prefix_line_sl)sDid not receive identification string from <HOST>%(__suff)s$
^%(__prefix_line_sl)sConnection reset by <HOST>%(__on_port_opt)s%(__suff)s
^%(__prefix_line_ml1)sSSH: Server;Ltype: (?:Authname|Version|Kex);Remote: <HOST>-\d+;[A-Z]\w+:.*%(__prefix_line_ml2)sRead from socket failed: Connection reset by peer%(__suff)s$
mdre-extra = ^%(__prefix_line_sl)sReceived disconnect from <HOST>%(__on_port_opt)s:\s*14: No supported authentication methods available%(__suff)s$
^%(__prefix_line_sl)sUnable to negotiate with <HOST>%(__on_port_opt)s: no matching (?:cipher|key exchange method) found.
^%(__prefix_line_ml1)sConnection from <HOST>%(__on_port_opt)s%(__prefix_line_ml2)sUnable to negotiate a (?:cipher|key exchange method)%(__suff)s$
mdre-aggressive = %(mdre-ddos)s
%(mdre-extra)s
failregex = %(cmnfailre)s
<mdre-<mode>>
# Parameter "mode": normal (default), ddos, extra or aggressive (combines all)
# Usage example (for jail.local):
# [sshd]
# mode = extra
# # or another jail (rewrite filter parameters of jail):
# [sshd-aggressive]
# filter = sshd[mode=aggressive]
#
mode = normal
ignoreregex =
# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
datepattern = {^LN-BEG}
# DEV Notes:
#
# "Failed \S+ for .*? from <HOST>..." failregex uses non-greedy catch-all because
# it is coming before use of <HOST> which is not hard-anchored at the end as well,
# and later catch-all's could contain user-provided input, which need to be greedily
# matched away first.
#
# Author: Cyril Jaquier, Yaroslav Halchenko, Petr Voralek, Daniel Black
cat custom-firewalld.conf com base nessa sugestão .
[INCLUDES]
before =
[Definition]
actionstart =
actionstop =
actioncheck =
actionban = firewall-cmd --add-source=<ip> --zone=drop && firewall-cmd --add-source=<ip> --zone=drop --permanent
actionunban = firewall-cmd --remove-source=<ip> --zone=drop && firewall-cmd --remove-source=<ip> --zone=drop --permanent
[Init]
Parece que usei um arquivo sshd.conf do mais recente 0.10 Fail2ban, que não é 100% compatível . Esta é a versão correta para 0,95.