Fail2Ban : अनाधिकृत प्रवेश निरोधक प्रणाली2024/06/20

# पंक्ति 87 : अपने स्थानीय आईपी को अनदेखा करें
#ignoreself = true

# पंक्ति 92 : अनदेखा किए गए नेटवर्क को जोड़ना संभव है
#ignoreip = 127.0.0.1/8 ::1

# पंक्ति 101 : होस्ट पर प्रतिबंध लगाने वाले सेकंड की संख्या
# - 1m ⇒ 1 minutes
# - 1h ⇒ 1 houer
# - 1d ⇒ 1 day
# - 1mo ⇒ 1 month
# - 1y ⇒ 1 year
bantime  = 10m

# पंक्ति 105 : यदि किसी होस्ट ने अंतिम "findtime" के दौरान "maxretry" उत्पन्न किया है तो उसे प्रतिबंधित कर दिया जाता है
findtime  = 10m

# पंक्ति 108 : "maxretry" किसी होस्ट के प्रतिबंधित होने से पहले विफलताओं की संख्या है
maxretry = 5

# पंक्ति 178 : यदि ईमेल अधिसूचना सक्षम की गई है तो गंतव्य ईमेल पता
destemail = root@localhost

# पंक्ति 181 : ईमेल अधिसूचना सक्षम करने पर प्रेषक का पता
sender = root@<fq-hostname>

# पंक्ति 268 : डिफ़ॉल्ट क्रिया
# - %(action_)s ⇒ केवल प्रतिबंध
# - %(action_mw)s ⇒ बैंड और ईमेल अधिसूचना (Whois जानकारी शामिल है)
# - %(action_mwl)s ⇒ बैंड और ईमेल अधिसूचना (Whois जानकारी और लॉग शामिल हैं)
action = %(action_)s

# नया बनाएँ
# डिफ़ॉल्ट मानों को ओवरराइड करना संभव है
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime  = 1d
findtime  = 5m
maxretry = 5
destemail = root@localhost
sender = root@dlp.srv.world

Status
|- Number of jail:      1
`- Jail list:   sshd

total 12
drwxr-xr-x 2 root root 4096 Jun 20 08:39 ./
drwxr-xr-x 6 root root 4096 Jun 20 09:45 ../
-rw-r--r-- 1 root root   22 Mar 11  2022 defaults-debian.conf

[sshd]
enabled = true

# सेवा द्वारा डिफ़ॉल्ट मानों को ओवरराइड करना संभव है
bantime  = 600
findtime  = 3m
maxretry = 5
action = %(action_mw)s

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     5
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   10.0.0.203

table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
                meta l4proto tcp tcp dport 22 counter packets 11 bytes 1412 jump f2b-sshd
        }

        chain f2b-sshd {
                ip saddr 10.0.0.203 counter packets 11 bytes 1412 reject
                counter packets 0 bytes 0 return
        }
}

"/var/mail/root": 1 messages 1 new 1 unread
>N   1 Fail2Ban           Thu Jun 20 12:31  91/3298  [Fail2Ban] sshd: banned 1
? 1
Return-Path: <root@dlp.srv.world>
X-Original-To: root@localhost
Delivered-To: root@localhost
Received: by dlp.srv.world (Postfix, from userid 0)
        id 2439622FB; Thu, 20 Jun 2024 12:31:42 +0900 (JST)
Subject: [Fail2Ban] sshd: banned 10.0.0.203 from dlp.srv.world
Date: Thu, 20 Jun 2024 12:31:41 +0900
From: Fail2Ban <root@dlp.srv.world>
To: root@localhost
Message-Id: <20240620033142.2439622FB@dlp.srv.world>

Hi,

The IP 10.0.0.203 has just been banned by Fail2Ban after
5 attempts against sshd.


Here is more information about 10.0.0.203 :
.....
.....

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     10
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     2
   `- Banned IP list:   10.0.0.203

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     10
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     2
   `- Banned IP list:

Status for the jail: sshd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     10
|  `- File list:        /var/log/auth.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     4
   `- Banned IP list:   10.0.0.192/28

[sshd]
[dropbear]
[selinux-ssh]
[apache-auth]
[apache-badbots]
[apache-noscript]
[apache-overflows]
[apache-nohome]
[apache-botsearch]
[apache-fakegooglebot]
[apache-modsecurity]
.....
.....

[apache-auth]
enabled = true
bantime  = 600
findtime  = 3m
maxretry = 5
action = %(action_mw)s

[vsftpd]
enabled = true
action = %(action_mw)s

[postfix-sasl]
enabled = true
action = %(action_mw)s

Status
|- Number of jail:      4
`- Jail list:   apache-auth, postfix-sasl, sshd, vsftpd

Status for the jail: apache-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     5
|  `- File list:        /var/log/apache2/error.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   10.0.0.5

Status for the jail: vsftpd
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     5
|  `- File list:        /var/log/vsftpd.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   10.0.0.203