$ sudo yum install fail2ban No match for argument: fail2ban Error: Unable to find a match: fail2ban $ sudo dnf -y install epel-release $ sudo yum install fail2ban # cd /etc/fail2ban # vi jail.local # systemctl enable fail2ban # systemctl start fail2ban # fail2ban-client status sshd
VPSで接続状況を見たら、ssh接続ポートにESTABLISHEDが複数居た
# netstat -an | more Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State $ netstat -an | more Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:MySSH 0.0.0.0:* LISTEN tcp 0 0 aaa.bbb.ccc.ddd:443 47.128.120.53:43214 TIME_WAIT tcp 0 0 aaa.bbb.ccc.ddd:443 47.128.26.8:35302 TIME_WAIT tcp 0 0 aaa.bbb.ccc.ddd:443 74.7.227.183:47322 ESTABLISHED tcp 0 2042 aaa.bbb.ccc.ddd:443 54.197.82.195:14502 FIN_WAIT1 tcp 0 0 aaa.bbb.ccc.ddd:MySSH 130.12.181.102:29358 ESTABLISHED tcp 0 0 aaa.bbb.ccc.ddd:MySSH 130.12.181.103:56798 ESTABLISHED tcp 0 0 aaa.bbb.ccc.ddd:MySSH 130.12.181.107:11958 ESTABLISHED tcp 0 0 aaa.bbb.ccc.ddd:MySSH 77.83.39.217:46258 ESTABLISHED tcp 0 0 aaa.bbb.ccc.ddd:MySSH 77.83.39.235:36338 ESTABLISHED tcp 0 21 aaa.bbb.ccc.ddd:MySSH eee.ff.ggg.hhh:19614 ESTABLISHED tcp 0 52 aaa.bbb.ccc.ddd:MySSH iii.jjj.kkk.mmm:54735 ESTABLISHED
whoコマンドには自分以外表示されないし、sshは公開鍵認証だけ有効にしていて、パスワード認証禁止してるから、そこまで心配しなくともいいのだが
journalctlで確認しろとの指示
# journalctl -u sshd -n 100 Jun 17 21:56:32 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484889]: Connection closed by invalid user chenboqiang 130.> Jun 17 21:56:35 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484893]: Invalid user wenjfu from 77.83.39.237 port 37570 Jun 17 21:56:36 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484893]: Connection closed by invalid user wenjfu 77.83.39.> Jun 17 21:56:37 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484898]: Invalid user sadmin from 20.153.204.5 port 52298 Jun 17 21:56:37 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484898]: Received disconnect from 20.153.204.5 port 52298:1> Jun 17 21:56:37 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484898]: Disconnected from invalid user sadmin 20.153.204.5> Jun 17 21:56:45 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484900]: Invalid user danyang from 77.83.39.154 port 11142 Jun 17 21:56:47 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484900]: Connection closed by invalid user danyang 77.83.39> Jun 17 21:56:48 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484904]: Invalid user assadmin from 77.83.39.217 port 25944 Jun 17 21:56:49 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484906]: Invalid user wwwgit from 45.144.212.75 port 35692 Jun 17 21:56:50 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484904]: Connection closed by invalid user assadmin 77.83.3> Jun 17 21:56:51 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484906]: Connection closed by invalid user wwwgit 45.144.21> Jun 17 21:56:58 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484908]: Invalid user zhangzijing from 130.12.181.105 port > Jun 17 21:56:58 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484909]: Invalid user unisound from 77.83.39.147 port 17032 Jun 17 21:56:59 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484909]: Connection closed by invalid user unisound 77.83.3> Jun 17 21:57:00 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484908]: Connection closed by invalid user zhangzijing 130.> Jun 17 21:57:15 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484916]: Invalid user barsha from 130.12.181.104 port 15758 Jun 17 21:57:16 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484953]: Invalid user tester from 77.83.39.235 port 14616 Jun 17 21:57:16 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484917]: Connection closed by authenticating user root 77.8> Jun 17 21:57:17 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484916]: Connection closed by invalid user barsha 130.12.18> Jun 17 21:57:17 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484953]: Connection closed by invalid user tester 77.83.39.> Jun 17 21:57:19 xxx-yyy-zzzzz.aa.bbbbbb.cc.dd sshd-session[1484955]: Invalid user dianzhong from 130.12.181.101 port 40>
keepaliveも確認しろと指示
# ss -tno | grep MySSH ESTAB 0 0 aaa.bbb.ccc.ddd:MySSH 45.144.212.75:38658 timer:(keepalive,119min,0) ESTAB 0 52 aaa.bbb.ccc.ddd:MySSH eee.fff.ggg.hhh:50854 timer:(on,269ms,0) ESTAB 0 0 aaa.bbb.ccc.ddd:MySSH 77.83.39.226:58822 timer:(keepalive,119min,0)
119分とか怖すぎだよ
fail2banをインストールして、/etc/fail2ban/jail.local を作ってサービス起動まで進める
# cat jail.local [DEFAULT] bantime = 24h findtime = 10m maxretry = 3 backend = systemd [sshd] enabled = true port = MySSH filter = sshd journalmatch = _SYSTEMD_UNIT=sshd.service
10分以内に3回失敗したら、24時間 BAN という設定
ステータスを確認したら、すぐ Banned IP list が埋まっていく。直近の journalctl を遡ってくれたのかもしれない。
# fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 19 | |- Total failed: 134 | `- Journal matches: _SYSTEMD_UNIT=sshd.service `- Actions |- Currently banned: 15 |- Total banned: 15 `- Banned IP list: 45.144.212.75 77.83.39.217 77.83.39.227 77.83.39.235 77.83.39.154 77.83.39.237 77.83.39.147 77.8 3.39.95 77.83.39.226 77.83.39.240 130.12.181.99 130.12.181.97 130.12.181.107 130.12.181.109 130.12.181.102
ツール名に fail で、設定ファイル名が jail なの、イケてる
