Здраствуйте уважаемые знатоки. Я новичок в linux.
Настраиваю свой первый в жизни VPS, и решил установить этот злощастный fail2ban который отказывается работать.
По мануалам из интернета настроил все как надо в файле /etc/fail2ban/jail.conf
[sshd]
enabled = true
port = 3476
logpath = %(sshd_log)s
backend = %(sshd_backend)s
bantime = 86400
findtime = 600
maxretry = 3
Правда везде пишут "ищите секцию [ssh]" но у меня такой вообще нет, есть только [sshd]
Да и вообще пишут, что эта утилита уже готова в принцыпе и может работать из коробки, типа можно не настраивать.
Короче рестартую я этот fail2ban и перезахожу в SSH. Я использую путина (putty), ввожу свой логин, потом специально ввожу неправильный пароль 5 раз, 10 раз, нечего непроисходит. Потом ввожу пароль правильный и спокойно захожу. Некто меня так и незабанил.
Потом смотрю логи..
Вот что в логах fail2ban ( /var/log/fail2ban.log )
. . .
. . .
. . .
2018-06-15 13:44:41,695 fail2ban.jail [7433]: INFO Jail 'sshd' stopped
2018-06-15 13:44:41,697 fail2ban.server [7433]: INFO Exiting Fail2ban
2018-06-15 13:44:41,927 fail2ban.server [7569]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.6
2018-06-15 13:44:41,928 fail2ban.database [7569]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2018-06-15 13:44:41,930 fail2ban.jail [7569]: INFO Creating new jail 'sshd'
2018-06-15 13:44:41,944 fail2ban.jail [7569]: INFO Jail 'sshd' uses pyinotify {}
2018-06-15 13:44:41,960 fail2ban.jail [7569]: INFO Initiated 'pyinotify' backend
2018-06-15 13:44:41,962 fail2ban.filter [7569]: INFO Added logfile = /var/log/auth.log
2018-06-15 13:44:41,963 fail2ban.actions [7569]: INFO Set banTime = 86400
2018-06-15 13:44:41,964 fail2ban.filter [7569]: INFO Set maxRetry = 3
2018-06-15 13:44:41,964 fail2ban.filter [7569]: INFO Set findtime = 600
2018-06-15 13:44:41,965 fail2ban.filter [7569]: INFO Set jail log file encoding to UTF-8
2018-06-15 13:44:41,965 fail2ban.filter [7569]: INFO Set maxlines = 10
2018-06-15 13:44:42,057 fail2ban.server [7569]: INFO Jail sshd is not a JournalFilter instance
2018-06-15 13:44:42,067 fail2ban.jail [7569]: INFO Jail 'sshd' started
Вот что в логах auth ( /var/log/auth.log )
Jun 15 15:37:30 Hahahaha systemd-logind[372]: Removed session 275.
Jun 15 15:38:21 Hahahaha sshd[7460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.121.23.238 user=onotole
Jun 15 15:38:23 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:26 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:32 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:38 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:44 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:49 Hahahaha sshd[7460]: Failed password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:50 Hahahaha sshd[7460]: Accepted password for onotole from 178.121.23.238 port 52253 ssh2
Jun 15 15:38:50 Hahahaha sshd[7460]: pam_unix(sshd:session): session opened for user onotole by (uid=0)
Jun 15 15:38:50 Hahahaha systemd: pam_unix(systemd-user:session): session opened for user onotole by (uid=0)
Jun 15 15:38:50 Hahahaha systemd-logind[372]: New session 278 of user onotole.
Jun 15 15:39:01 Hahahaha CRON[7480]: pam_unix(cron:session): session opened for user root by (uid=0)
Jun 15 15:39:01 Hahahaha CRON[7480]: pam_unix(cron:session): session closed for user root
Jun 15 15:39:03 Hahahaha sudo: pam_unix(sudo:auth): authentication failure; logname=onotole uid=1000 euid=0 tty=/dev/pts/0 ruser=onotole rhost= user=onotole
Jun 15 15:39:10 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/home/onotole ; USER=root ; COMMAND=/bin/nano /etc/fail2ban/jail.conf
Jun 15 15:39:10 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:40:15 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:40:38 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/bin/nano auth.log
Jun 15 15:40:38 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:41:16 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:41:32 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/bin/nano faillog
Jun 15 15:41:32 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:41:36 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:41:46 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/bin/nano fail2ban.log
Jun 15 15:41:46 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:42:08 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:42:30 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/bin/nano /etc/fail2ban/jail.conf
Jun 15 15:42:30 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:44:29 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:44:40 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/usr/sbin/service fail2ban restart
Jun 15 15:44:40 Hahahaha sudo: pam_unix(sudo:session): session opened for user root by onotole(uid=0)
Jun 15 15:44:42 Hahahaha sudo: pam_unix(sudo:session): session closed for user root
Jun 15 15:44:48 Hahahaha sudo: onotole : TTY=pts/0 ; PWD=/var/log ; USER=root ; COMMAND=/usr/sbin/service fail2ban status
Помогите разобратся, как заставить работать паразита?
