屑俺日記

☆ fali2ban

apt-get で squeeze に入れてみた。
/etc/init.d/fail2ban start/stop。
以下、デフォルトで。

# iptables -v -t filter -nL
Chain INPUT (policy ACCEPT 305 packets, 38906 bytes)
 pkts bytes target     prot opt in  out    source    destination
 171 19793 fail2ban-ssh  tcp  --  *   *    0.0.0.0/0  0.0.0.0/0 \
multiport dports 22 
; (ry
Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in  out    source    destination
  151 17449 RETURN     all  --  *     *    0.0.0.0/0 0.0.0.0/0

出鱈目なsshの接続で4回認証に失敗すると、 fail2ban-ssh チェインに接続元が 追記され、10分間持続する。

Chain fail2ban-ssh (1 references)
 pkts bytes target     prot opt in  out    source        destination
    4   784 DROP       all  --  *     *    xxx.xxx.xxx.x 0.0.0.0/0
  243 27137 RETURN     all  --  *     *    0.0.0.0/0     0.0.0.0/0

このようなログが /var/log/fail2ban.log に残る。

$DATE 11:38:40,977 fail2ban.server : INFO   Changed logging target to \
 /var/log/fail2ban.log for Fail2ban v0.8.4-SVN
$DATE 11:38:40,978 fail2ban.jail   : INFO   Creating new jail 'ssh'
$DATE 11:38:40,978 fail2ban.jail   : INFO   Jail 'ssh' uses poller
$DATE 11:38:40,993 fail2ban.filter : INFO   Added logfile =\
 /var/log/auth.log
$DATE 11:38:40,993 fail2ban.filter : INFO   Set maxRetry = 6
$DATE 11:38:40,994 fail2ban.filter : INFO   Set findtime = 600
$DATE 11:38:40,994 fail2ban.actions: INFO   Set banTime = 600
$DATE 11:38:41,057 fail2ban.jail   : INFO   Jail 'ssh' started
$DATE 11:40:14,188 fail2ban.actions: WARNING [ssh] Ban xxx.xxx.xxx.x
$DATE 11:46:39,655 fail2ban.actions: WARNING [ssh] Unban xxx.xxx.xxx.x
$DATE 11:46:39,686 fail2ban.jail   : INFO   Jail 'ssh' stopped
$DATE 11:46:39,687 fail2ban.server : INFO   Exiting Fail2ban