Configuration fail2ban

Configuration fail2ban - Sécurité - Systèmes & Réseaux Pro

Marsh Posté le 28-10-2013 à 11:42:19    

J'ai un Fail2ban configuré comme ca :

Code :
  1. [ssh-iptables]
  2. enabled  = true
  3. filter   = sshd
  4. action   = iptables[name=SSH, port=ssh, protocol=tcp]
  5.            sendmail-whois[name=SSH, dest=mechkurt@mon-domaine.com, sender=fail2ban@mon-serveur.com]
  6. logpath  = /var/log/secure
  7. maxretry = 5


 
Le service est bien actif mais on dirait qu'il ne ba,it rien du tout, cf. l'extrait de ma log secure ci-dessous :
 

Code :
  1. Oct 27 03:59:11 ns###### sshd[7660]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  2. Oct 27 03:59:11 ns###### sshd[7660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  3. Oct 27 03:59:13 ns###### sshd[7660]: Failed password for root from 95.86.130.22 port 48983 ssh2
  4. Oct 27 03:59:13 ns###### sshd[7661]: Received disconnect from 95.86.130.22: 11: Bye Bye
  5. Oct 27 03:59:13 ns###### sshd[7663]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  6. Oct 27 03:59:13 ns###### sshd[7663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  7. Oct 27 03:59:16 ns###### sshd[7663]: Failed password for root from 95.86.130.22 port 49345 ssh2
  8. Oct 27 03:59:16 ns###### sshd[7664]: Received disconnect from 95.86.130.22: 11: Bye Bye
  9. Oct 27 03:59:16 ns###### sshd[7669]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  10. Oct 27 03:59:16 ns###### sshd[7669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  11. Oct 27 03:59:19 ns###### sshd[7669]: Failed password for root from 95.86.130.22 port 49688 ssh2
  12. Oct 27 03:59:19 ns###### sshd[7670]: Received disconnect from 95.86.130.22: 11: Bye Bye
  13. Oct 27 03:59:20 ns###### sshd[7672]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  14. Oct 27 03:59:20 ns###### sshd[7672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  15. Oct 27 03:59:22 ns###### sshd[7672]: Failed password for root from 95.86.130.22 port 50108 ssh2
  16. Oct 27 03:59:22 ns###### sshd[7673]: Received disconnect from 95.86.130.22: 11: Bye Bye
  17. Oct 27 03:59:23 ns###### sshd[7675]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  18. Oct 27 03:59:23 ns###### sshd[7675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  19. Oct 27 03:59:25 ns###### sshd[7675]: Failed password for root from 95.86.130.22 port 50458 ssh2
  20. Oct 27 03:59:25 ns###### sshd[7676]: Received disconnect from 95.86.130.22: 11: Bye Bye
  21. Oct 27 03:59:25 ns###### sshd[7678]: reverse mapping checking getaddrinfo for host-95-86-130-22.smart.az [95.86.130.22] failed - POSSIBLE BREAK-IN ATTEMPT!
  22. Oct 27 03:59:25 ns###### sshd[7678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.86.130.22  user=root
  23. Oct 27 03:59:27 ns###### sshd[7678]: Failed password for root from 95.86.130.22 port 50737 ssh2
  24. Oct 27 03:59:27 ns###### sshd[7679]: Received disconnect from 95.86.130.22: 11: Bye Bye
  25. Oct 27 05:42:36 ns###### sshd[15205]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.95.22.246  user=root
  26. Oct 27 05:42:38 ns###### sshd[15205]: Failed password for root from 192.95.22.246 port 53463 ssh2
  27. Oct 27 05:42:38 ns###### sshd[15206]: Received disconnect from 192.95.22.246: 3: com.jcraft.jsch.JSchException: Auth fail
  28. Oct 27 06:06:42 ns###### sshd[17101]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  29. Oct 27 06:06:42 ns###### sshd[17101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  30. Oct 27 06:06:44 ns###### sshd[17101]: Failed password for root from 173.208.80.54 port 57903 ssh2
  31. Oct 27 06:06:44 ns###### sshd[17102]: Received disconnect from 173.208.80.54: 11: Bye Bye
  32. Oct 27 06:06:45 ns###### sshd[17105]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  33. Oct 27 06:06:45 ns###### sshd[17105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  34. Oct 27 06:06:47 ns###### sshd[17105]: Failed password for root from 173.208.80.54 port 58168 ssh2
  35. Oct 27 06:06:47 ns###### sshd[17106]: Received disconnect from 173.208.80.54: 11: Bye Bye
  36. Oct 27 06:06:47 ns###### sshd[17108]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  37. Oct 27 06:06:47 ns###### sshd[17108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  38. Oct 27 06:06:50 ns###### sshd[17108]: Failed password for root from 173.208.80.54 port 58323 ssh2
  39. Oct 27 06:06:50 ns###### sshd[17109]: Received disconnect from 173.208.80.54: 11: Bye Bye
  40. Oct 27 06:06:51 ns###### sshd[17111]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  41. Oct 27 06:06:51 ns###### sshd[17111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  42. Oct 27 06:06:53 ns###### sshd[17111]: Failed password for root from 173.208.80.54 port 58508 ssh2
  43. Oct 27 06:06:54 ns###### sshd[17112]: Received disconnect from 173.208.80.54: 11: Bye Bye
  44. Oct 27 06:06:54 ns###### sshd[17114]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  45. Oct 27 06:06:54 ns###### sshd[17114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  46. Oct 27 06:06:56 ns###### sshd[17114]: Failed password for root from 173.208.80.54 port 58673 ssh2
  47. Oct 27 06:06:57 ns###### sshd[17115]: Received disconnect from 173.208.80.54: 11: Bye Bye
  48. Oct 27 06:06:57 ns###### sshd[17117]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  49. Oct 27 06:06:57 ns###### sshd[17117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  50. Oct 27 06:06:59 ns###### sshd[17117]: Failed password for root from 173.208.80.54 port 58823 ssh2
  51. Oct 27 06:06:59 ns###### sshd[17118]: Received disconnect from 173.208.80.54: 11: Bye Bye
  52. Oct 27 06:07:00 ns###### sshd[17120]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  53. Oct 27 06:07:00 ns###### sshd[17120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  54. Oct 27 06:07:02 ns###### sshd[17120]: Failed password for root from 173.208.80.54 port 58970 ssh2
  55. Oct 27 06:07:02 ns###### sshd[17121]: Received disconnect from 173.208.80.54: 11: Bye Bye
  56. Oct 27 06:07:03 ns###### sshd[17166]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  57. Oct 27 06:07:03 ns###### sshd[17166]: Invalid user reachadmin from 173.208.80.54
  58. Oct 27 06:07:03 ns###### sshd[17167]: input_userauth_request: invalid user reachadmin
  59. Oct 27 06:07:03 ns###### sshd[17166]: pam_unix(sshd:auth): check pass; user unknown
  60. Oct 27 06:07:03 ns###### sshd[17166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54
  61. Oct 27 06:07:03 ns###### sshd[17166]: pam_succeed_if(sshd:auth): error retrieving information about user reachadmin
  62. Oct 27 06:07:06 ns###### sshd[17166]: Failed password for invalid user reachadmin from 173.208.80.54 port 59121 ssh2
  63. Oct 27 06:07:06 ns###### sshd[17167]: Received disconnect from 173.208.80.54: 11: Bye Bye
  64. Oct 27 06:07:07 ns###### sshd[17169]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  65. Oct 27 06:07:07 ns###### sshd[17169]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  66. Oct 27 06:07:09 ns###### sshd[17169]: Failed password for root from 173.208.80.54 port 59288 ssh2
  67. Oct 27 06:07:09 ns###### sshd[17170]: Received disconnect from 173.208.80.54: 11: Bye Bye
  68. Oct 27 06:07:10 ns###### sshd[17172]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  69. Oct 27 06:07:10 ns###### sshd[17172]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  70. Oct 27 06:07:12 ns###### sshd[17172]: Failed password for root from 173.208.80.54 port 59436 ssh2
  71. Oct 27 06:07:12 ns###### sshd[17173]: Received disconnect from 173.208.80.54: 11: Bye Bye
  72. Oct 27 06:07:13 ns###### sshd[17175]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  73. Oct 27 06:07:13 ns###### sshd[17175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  74. Oct 27 06:07:15 ns###### sshd[17175]: Failed password for root from 173.208.80.54 port 59601 ssh2
  75. Oct 27 06:07:15 ns###### sshd[17176]: Received disconnect from 173.208.80.54: 11: Bye Bye
  76. Oct 27 06:07:16 ns###### sshd[17178]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  77. Oct 27 06:07:16 ns###### sshd[17178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  78. Oct 27 06:07:18 ns###### sshd[17178]: Failed password for root from 173.208.80.54 port 59728 ssh2
  79. Oct 27 06:07:18 ns###### sshd[17179]: Received disconnect from 173.208.80.54: 11: Bye Bye
  80. Oct 27 06:07:19 ns###### sshd[17181]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  81. Oct 27 06:07:19 ns###### sshd[17181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  82. Oct 27 06:07:21 ns###### sshd[17181]: Failed password for root from 173.208.80.54 port 59878 ssh2
  83. Oct 27 06:07:21 ns###### sshd[17182]: Received disconnect from 173.208.80.54: 11: Bye Bye
  84. Oct 27 06:07:22 ns###### sshd[17184]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  85. Oct 27 06:07:22 ns###### sshd[17184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  86. Oct 27 06:07:24 ns###### sshd[17184]: Failed password for root from 173.208.80.54 port 60034 ssh2
  87. Oct 27 06:07:24 ns###### sshd[17185]: Received disconnect from 173.208.80.54: 11: Bye Bye
  88. Oct 27 06:07:25 ns###### sshd[17187]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  89. Oct 27 06:07:25 ns###### sshd[17187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  90. Oct 27 06:07:27 ns###### sshd[17187]: Failed password for root from 173.208.80.54 port 60209 ssh2
  91. Oct 27 06:07:27 ns###### sshd[17188]: Received disconnect from 173.208.80.54: 11: Bye Bye
  92. Oct 27 06:07:28 ns###### sshd[17190]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  93. Oct 27 06:07:28 ns###### sshd[17190]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  94. Oct 27 06:07:30 ns###### sshd[17190]: Failed password for root from 173.208.80.54 port 60353 ssh2
  95. Oct 27 06:07:30 ns###### sshd[17191]: Received disconnect from 173.208.80.54: 11: Bye Bye
  96. Oct 27 06:07:31 ns###### sshd[17193]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!
  97. Oct 27 06:07:31 ns###### sshd[17193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.208.80.54  user=root
  98. Oct 27 06:07:33 ns###### sshd[17193]: Failed password for root from 173.208.80.54 port 60513 ssh2
  99. Oct 27 06:07:33 ns###### sshd[17194]: Received disconnect from 173.208.80.54: 11: Bye Bye
  100. Oct 27 06:07:34 ns###### sshd[17196]: reverse mapping checking getaddrinfo for 173.208.80.54.op-net.com [173.208.80.54] failed - POSSIBLE BREAK-IN ATTEMPT!


 
A coté de quoi suis-je passer ?


---------------
D3
Reply

Marsh Posté le 28-10-2013 à 11:42:19   

Reply

Marsh Posté le 03-11-2013 à 22:53:08    

à côté de la fourniture de la conf complete non altérée de f2b ?

Reply

Sujets relatifs:

Leave a Replay

Make sure you enter the(*)required information where indicate.HTML code is not allowed