DEDIBOX-NEWS.COM

DKreeK · 2008-04-25 00:31:53

Salut à tous,

J'ai installé fail2ban et j'essai de le faire fonctionner. J'ai paramétré les fichiers /etc/fail2ban/fail2ban.conf et /etc/fail2ban/jail.conf.local

J'ai un petit problème avec SSH. J'ai fait plusieurs tentative de login erroné, dans le fichier /var/log/fail2ban.log j'ai bien les infos suivantes :

Code:

2008-04-25 00:06:48,187 fail2ban.actions: WARNING [ssh] Ban {MYIP}

Si je liste les infos de mon firewall :

Code:

(root - 0) iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
fail2ban-ssh  tcp  --  anywhere             anywhere            tcp dpt:ssh
fail2ban-ssh  tcp  --  anywhere             anywhere            tcp dpt:22
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     0    --  anywhere             anywhere
ACCEPT     icmp --  88.191.254.0/24      anywhere
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:4242
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:ftp-data:ftp
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  88.191.254.0/24      anywhere            tcp dpt:snmp state NEW,ESTABLISHED
ACCEPT     udp  --  88.191.254.0/24      anywhere            udp dpt:snmp state NEW,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 1/sec burst 5
ACCEPT     udp  --  anywhere             anywhere            limit: avg 1/sec burst 5

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     0    --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     0    --  anywhere             anywhere
ACCEPT     icmp --  anywhere             88.191.254.0/24
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:4242
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:domain
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ntp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:ftp-data:ftp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             88.191.254.0/24     tcp spt:snmp state ESTABLISHED
ACCEPT     udp  --  anywhere             88.191.254.0/24     udp spt:snmp state ESTABLISHED

Chain SPOOFED (0 references)
target     prot opt source               destination
DROP       0    --  loopback/8           anywhere
DROP       0    --  169.240.0.0/12       anywhere
DROP       0    --  172.16.0.0/12        anywhere
DROP       0    --  192.168.0.0/16       anywhere
DROP       0    --  10.0.0.0/8           anywhere

Chain fail2ban-ssh (2 references)
target     prot opt source               destination
DROP       0    --  {MYIP}   anywhere
RETURN     0    --  anywhere             anywhere

A première vue je devrait etre bloqué et bien non, je peut continuer à m'identifier...

J'ai essayer de tester la regexp pour voir mais cella ne fonctionne pas non plus :

Code:

(root - 0) fail2ban-regex /etc/fail2ban/filter.d/sshd.conf /var/log/auth.log


Sorry, no match

Je ne sais plus quoi faire là.
Merci d'avance pour vos réponses.

DEDIBOX-NEWS.COM

#1 2008-04-25 00:31:53

Fail2ban et SSH, détecté mais pas bloqué !!!!

Code:

Code:

Code:

Pied de page des forums