Проблема с Proftpd и Fail2Ban

[Sergeyural]

Проблема заключается в следующем: как-то недавно заглянул в логи, и там увидел кучу обращений к своему ftp с разных IP по несколько раз в секунду. Некоторых из этих товарищей я нашел здесь. Потом я нашел прогу, поставил, а она все равно не блокирует. настройки все выполнил, в нужных местах фальш на тру переправил. Логи proftpd пишет сюда:

Код:

ExtendedLog /var/log/proftpd/proftpd.log TransferLog /var/log/xferlog SystemLog /var/log/syslog.log

в конфиге proftpd указан /var/log/syslog.log\

в файле /usr/bin/fail2ban-server исправил python на python2.5 и поставил новый.

в логах fail2ban написано вот что:

Код:

2009-08-15 13:49:43,783 fail2ban.jail : INFO Using poller 2009-08-15 13:49:43,797 fail2ban.filter : INFO Created Filter 2009-08-15 13:49:43,798 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:49:43,800 fail2ban.filter : INFO Added logfile = /var/log/auth.log 2009-08-15 13:49:43,809 fail2ban.filter : INFO Set maxRetry = 6 2009-08-15 13:49:43,812 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:49:43,813 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:49:43,948 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:49:43,950 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:49:43,952 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:49:43,954 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:49:43,955 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name> 2009-08-15 13:49:43,960 fail2ban.jail : INFO Using poller 2009-08-15 13:49:43,961 fail2ban.filter : INFO Created Filter 2009-08-15 13:49:43,961 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:49:43,963 fail2ban.filter : INFO Added logfile = /var/log/apache2/error.log 2009-08-15 13:49:43,965 fail2ban.filter : INFO Set maxRetry = 6 2009-08-15 13:49:43,968 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:49:43,970 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:49:43,982 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:49:43,983 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:49:43,985 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:49:43,987 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:49:43,988 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name> 2009-08-15 13:49:43,993 fail2ban.jail : INFO Using poller 2009-08-15 13:49:43,994 fail2ban.filter : INFO Created Filter 2009-08-15 13:49:43,994 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:49:43,996 fail2ban.filter : INFO Added logfile = /var/log/proftpd/proftpd.log 2009-08-15 13:49:43,999 fail2ban.filter : INFO Set maxRetry = 3 2009-08-15 13:49:44,001 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:49:44,003 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:49:44,021 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:49:44,023 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:49:44,024 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:49:44,026 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:49:44,028 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name> 2009-08-15 13:50:57,843 fail2ban.jail : INFO Using poller 2009-08-15 13:50:57,857 fail2ban.filter : INFO Created Filter 2009-08-15 13:50:57,858 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:50:57,860 fail2ban.filter : INFO Added logfile = /var/log/auth.log 2009-08-15 13:50:57,869 fail2ban.filter : INFO Set maxRetry = 6 2009-08-15 13:50:57,871 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:50:57,873 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:50:58,007 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:50:58,009 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:50:58,010 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:50:58,012 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:50:58,014 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name> 2009-08-15 13:50:58,018 fail2ban.jail : INFO Using poller 2009-08-15 13:50:58,019 fail2ban.filter : INFO Created Filter 2009-08-15 13:50:58,019 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:50:58,021 fail2ban.filter : INFO Added logfile = /var/log/apache2/error.log 2009-08-15 13:50:58,024 fail2ban.filter : INFO Set maxRetry = 6 2009-08-15 13:50:58,026 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:50:58,029 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:50:58,040 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:50:58,041 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:50:58,043 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:50:58,045 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:50:58,046 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name> 2009-08-15 13:50:58,052 fail2ban.jail : INFO Using poller 2009-08-15 13:50:58,052 fail2ban.filter : INFO Created Filter 2009-08-15 13:50:58,053 fail2ban.filter : INFO Created FilterPoll 2009-08-15 13:50:58,054 fail2ban.filter : INFO Added logfile = /var/log/syslog.log 2009-08-15 13:50:58,057 fail2ban.filter : INFO Set maxRetry = 3 2009-08-15 13:50:58,060 fail2ban.filter : INFO Set findtime = 600 2009-08-15 13:50:58,061 fail2ban.actions: INFO Set banTime = 600 2009-08-15 13:50:58,079 fail2ban.actions.action: INFO Set actionBan = iptables -I fail2ban-<name> 1 -s <ip> -j DROP 2009-08-15 13:50:58,081 fail2ban.actions.action: INFO Set actionStop = iptables -D INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> iptables -F fail2ban-<name> iptables -X fail2ban-<name> 2009-08-15 13:50:58,082 fail2ban.actions.action: INFO Set actionStart = iptables -N fail2ban-<name> iptables -A fail2ban-<name> -j RETURN iptables -I INPUT -p <protocol> -m multiport --dports <port> -j fail2ban-<name> 2009-08-15 13:50:58,084 fail2ban.actions.action: INFO Set actionUnban = iptables -D fail2ban-<name> -s <ip> -j DROP 2009-08-15 13:50:58,086 fail2ban.actions.action: INFO Set actionCheck = iptables -n -L INPUT | grep -q fail2ban-<name>

еще python-gamin поставил

все это что я нашел на других форумах, но все равно ничего не работает.

[IMB]

Я у себя эту проблему решил средствами iptables. После введения лог сервера стал, если можно так выразиться, "девственно" чистым.

[Sergeyural]

Я у себя эту проблему решил средствами iptables. После введения лог сервера стал, если можно так выразиться, "девственно" чистым.

что-то я не совсем понял каким образом?

[IMB]

Выставил лимит на количество подключений.

[Sergeyural]

Выставил лимит на количество подключений.

Вы говорите про это?
http://www.itfo.ru/?p=234

[IMB]

В общем да. Я использовал это :

user@localhost

man 8 iptables ..................................................... limit This module matches at a limited rate using a token bucket filter. A rule using this extension will match until this limit is reached (unless the ‘!’ flag is used). It can be used in combination with the LOG target to give limited logging, for example. [!] --limit rate[/second|/minute|/hour|/day] Maximum average matching rate: specified as a number, with an optional ‘/second’, ‘/minute’, ‘/hour’, or ‘/day’ suffix; the default is 3/hour. --limit-burst number Maximum initial number of packets to match: this number gets recharged by one every time the limit specified above is not reached, up to this number; the default is 5. ..........................................................