Iptables n'affiche pas les ip bannis tel que ssh & ssh-ddos

Support Debian
#1

Salut,

Voilà, j’ai une ip local (192.168.1.13) qui est banni, et j’aimerai bien pouvoir (cela va de soit …) la dé-bannir.

iptables -t filter -D fail2ban-ssh (N° de la chaine)

Or cela ne m’est guère possible, et pour cause … elle n’apparaît pô avec iptables. :12 Enfin ssh & ssh-ddos, par exemple.

root@serveur-local:~# iptables -S | grep fail2ban -N fail2ban-PHP-fopen -N fail2ban-apache-anti-scripts -N fail2ban-apache-dosevasive -N fail2ban-apache-w00tw00t -N fail2ban-courierauth -N fail2ban-couriersmtp -N fail2ban-pam-generic -N fail2ban-sasl -A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-sasl -A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-PHP-fopen -A INPUT -p tcp -j fail2ban-pam-generic -A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-courierauth -A INPUT -j fail2ban-apache-dosevasive -A INPUT -p tcp -m multiport --dports 25,465 -j fail2ban-couriersmtp -A INPUT -p tcp -m tcp --dport 80 -j fail2ban-apache-anti-scripts -A INPUT -p tcp -m tcp --dport 80 -j fail2ban-apache-w00tw00t -A fail2ban-PHP-fopen -j RETURN -A fail2ban-apache-anti-scripts -j RETURN -A fail2ban-apache-dosevasive -j RETURN -A fail2ban-apache-w00tw00t -j RETURN -A fail2ban-courierauth -j RETURN -A fail2ban-couriersmtp -j RETURN -A fail2ban-pam-generic -j RETURN -A fail2ban-sasl -j RETURN root@serveur-local:~#

[code]root@serveur-local:~# iptables -t filter -L -n > Lire-IP-bannis.txt && cat Lire-IP-bannis.txt
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-sasl tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,143,220,993,110,995
fail2ban-PHP-fopen tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-pam-generic tcp – 0.0.0.0/0 0.0.0.0/0
fail2ban-courierauth tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,143,220,993,110,995
fail2ban-apache-dosevasive all – 0.0.0.0/0 0.0.0.0/0
fail2ban-couriersmtp tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465
fail2ban-apache-anti-scripts tcp – 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
fail2ban-apache-w00tw00t tcp – 0.0.0.0/0 0.0.0.0/0 tcp dpt:80

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-PHP-fopen (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-anti-scripts (1 references)
target prot opt source destination
DROP all – 192.168.1.13 0.0.0.0/0
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-dosevasive (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-w00tw00t (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-courierauth (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-couriersmtp (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-pam-generic (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-sasl (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0
root@serveur-local:~#[/code]

Et pourtant l’ip local est belle et bien là! Entre autres …

[code]root@serveur-local:~# fail2ban-client status ssh
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 0

| - Total failed: 17- action
|- Currently banned: 6
| - IP list: 125.64.43.106 61.47.47.55 192.168.1.13 58.51.91.54 211.202.2.109 202.103.226.187- Total banned: 6
root@serveur-local:~#[/code]

root@serveur-local:~# iptables -S | grep ' 22 ' root@serveur-local:~#

Une idée please …

#2

Tu as vérifié dans la configuration de fail2ban quelle était l’action associée à ssh ?

#3

Ma foi, ce n’est que la configuration par défaut.

[code]root@serveur-local:~# cat /etc/fail2ban/jail.conf
…

[DEFAULT]

“ignoreip” can be an IP address, a CIDR mask or a DNS host

ignoreip = 127.0.0.1 192.168.1.14 192.168.13 2.x.x.x

…

[ssh]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log*
action = mail-whois[name=ssh, dest=user@gmail.com]
bantime = 31536000
findtime = 31536000
maxretry = 1

…[/code]

[code]root@serveur-local:~# cat /etc/fail2ban/filter.d/sshd.conf

Fail2Ban configuration file

Author: Cyril Jaquier

$Revision$

[INCLUDES]

Read common prefixes. If any customizations available – read them from

common.local

before = common.conf

[Definition]

_daemon = sshd

Option: failregex

Notes.: regex to match the password failures messages in the logfile. The

host must be matched by a group named “host”. The tag “” can

be used for standard IP/hostname matching and is only an alias for

(?:::f{4,6}:)?(?P[\w-.^_]+)

Values: TEXT

failregex = ^%(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from \s*$
^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from \s*$
^%(__prefix_line)sFailed (?:password|publickey) for .* from (?: port \d*)?(?: ssh\d*)?$
^%(__prefix_line)sROOT LOGIN REFUSED.* FROM \s*$
^%(__prefix_line)siI user .* from \s*$
^%(__prefix_line)sUser .+ from not allowed because not listed in AllowUsers$
^%(__prefix_line)sauthentication failure; logname=\S* uid=\S* euid=\S* tty=\S* ruser=\S* rhost=(?:\s+user=.)?\s$
^%(__prefix_line)srefused connect from \S+ ()\s*$
^%(__prefix_line)sAddress .* POSSIBLE BREAK-IN ATTEMPT!\s$
^%(__prefix_line)sUser .+ from not allowed because none of user’s groups are listed in AllowGroups\s*$

Option: ignoreregex

Notes.: regex to ignore. If this regex matches, the line is ignored.

Values: TEXT

ignoreregex =
root@serveur-local:~#[/code]

#4

Par défaut ? Le mien ne ressemble pas à ça.
Apparemment l’action définie dans ton jail.conf pour ssh est juste l’envoi d’un mail, donc pas de règle iptables.

Accessoirement, ton option ignoreip est à revoir.

#5

J’ignore si il y avait un lien de cause à effet … j’avais installé fail2ban et python-gamin en version Wheezy directement et ceci en chroot (live-cd)

Toujours est il que j’ai remové/purger ceux-ci, et ré-installé en version stable.

root@serveur-local:~# banip -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A fail2ban-ssh -j RETURN root@serveur-local:~#

[code]root@serveur-local:~# ubanip
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-apache-multiport tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-ssh tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 22
fail2ban-apache tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-couriersmtp tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465
fail2ban-courierauth tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,143,220,993,110,995
fail2ban-sasl tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,143,220,993,110,995
fail2ban-pam-generic tcp – 0.0.0.0/0 0.0.0.0/0
fail2ban-apache-overflows tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443
fail2ban-ssh-ddos tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 22
fail2ban-apache-noscript tcp – 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-apache (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-multiport (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-noscript (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-apache-overflows (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-courierauth (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-couriersmtp (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-pam-generic (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-sasl (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0

Chain fail2ban-ssh-ddos (1 references)
target prot opt source destination
RETURN all – 0.0.0.0/0 0.0.0.0/0
root@serveur-local:~#
[/code]

Par défaut.

[code][ssh]

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 1
[/code]

Je vais à présent implanter mes failregex puis re-passerai en version Wheezy …

C’est à dire, de part l’écriture ?

#6 
Il manque visiblement un octet à la 3e adresse (192.168.13).
Quant à la 4e adresse (2.x.x.x) je pense que ça se passe de commentaire : ce n'est ni une adresse ni un préfixe ni un nom de domaine valide.

Il manque visiblement un octet à la 3e adresse (192.168.13).
Quant à la 4e adresse (2.x.x.x) je pense que ça se passe de commentaire : ce n’est ni une adresse ni un préfixe ni un nom de domaine valide.

#7

C’était tellement gros que je n’y ai pas prêter attention.

Rhôooo … normal, c’est mon IP dynamique, tronqué par x.

#8

Situation rétablit.

[quote]root@serveur-local:~# banip
-N fail2ban-PHP-fopen
-N fail2ban-apache-anti-scripts
-N fail2ban-apache-dosevasive
-N fail2ban-apache-w00tw00t
-N fail2ban-courierauth
-N fail2ban-couriersmtp
-N fail2ban-pam-generic
-N fail2ban-sasl
-N fail2ban-ssh
-N fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh-ddos
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-PHP-fopen
-A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-sasl
-A INPUT -j fail2ban-apache-dosevasive
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 25,465 -j fail2ban-couriersmtp
-A INPUT -p tcp -j fail2ban-pam-generic
-A INPUT -p tcp -m multiport --dports 25,465,143,220,993,110,995 -j fail2ban-courierauth
-A INPUT -p tcp -m tcp --dport 80 -j fail2ban-apache-anti-scripts
-A INPUT -p tcp -m tcp --dport 80 -j fail2ban-apache-w00tw00t
-A fail2ban-PHP-fopen -j RETURN
-A fail2ban-apache-anti-scripts -j RETURN
-A fail2ban-apache-dosevasive -j RETURN
-A fail2ban-apache-w00tw00t -j RETURN
-A fail2ban-courierauth -j RETURN
-A fail2ban-couriersmtp -j RETURN
-A fail2ban-pam-generic -j RETURN
-A fail2ban-sasl -j RETURN
-A fail2ban-ssh -s 64.169.30.26/32 -j DROP
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh-ddos -j RETURN
root@serveur-local:~#
[/quote]

Explique très certainement mon ban local auparavant … quel bourde! :083