phpMyAdmin과 (와)의 과도한 로그인 시도 를 차단 fail2ban하기 위해 실패한 시도를 파일에 기록하는 스크립트를 만들었습니다./var/log/phpmyadmin_auth.log
맞춤 로그
/var/log/phpmyadmin_auth.log파일 형식 은 다음과 같습니다.
phpMyadmin login failed with username: root; ip: 192.168.1.50; url: http://somedomain.com/phpmyadmin/index.php
phpMyadmin login failed with username: ; ip: 192.168.1.50; url: http://192.168.1.48/phpmyadmin/index.php
맞춤 필터
[Definition]
# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;
phpMyAdmin 감옥
[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
action = sendmail-whois[name=HTTP]
logpath = /var/log/phpmyadmin_auth.log
maxretry = 6
fail2ban로그에는 다음 이 포함됩니다.
2012-10-04 10:52:22,756 fail2ban.server : INFO Stopping all jails
2012-10-04 10:52:23,091 fail2ban.jail : INFO Jail 'ssh-iptables' stopped
2012-10-04 10:52:23,866 fail2ban.jail : INFO Jail 'fail2ban' stopped
2012-10-04 10:52:23,994 fail2ban.jail : INFO Jail 'ssh' stopped
2012-10-04 10:52:23,994 fail2ban.server : INFO Exiting Fail2ban
2012-10-04 10:52:24,253 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6
2012-10-04 10:52:24,253 fail2ban.jail : INFO Creating new jail 'ssh'
2012-10-04 10:52:24,253 fail2ban.jail : INFO Jail 'ssh' uses poller
2012-10-04 10:52:24,260 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2012-10-04 10:52:24,260 fail2ban.filter : INFO Set maxRetry = 6
2012-10-04 10:52:24,261 fail2ban.filter : INFO Set findtime = 600
2012-10-04 10:52:24,261 fail2ban.actions: INFO Set banTime = 600
2012-10-04 10:52:24,279 fail2ban.jail : INFO Creating new jail 'ssh-iptables'
2012-10-04 10:52:24,279 fail2ban.jail : INFO Jail 'ssh-iptables' uses poller
2012-10-04 10:52:24,279 fail2ban.filter : INFO Added logfile = /var/log/auth.log
2012-10-04 10:52:24,280 fail2ban.filter : INFO Set maxRetry = 5
2012-10-04 10:52:24,280 fail2ban.filter : INFO Set findtime = 600
2012-10-04 10:52:24,280 fail2ban.actions: INFO Set banTime = 600
2012-10-04 10:52:24,287 fail2ban.jail : INFO Creating new jail 'fail2ban'
2012-10-04 10:52:24,287 fail2ban.jail : INFO Jail 'fail2ban' uses poller
2012-10-04 10:52:24,287 fail2ban.filter : INFO Added logfile = /var/log/fail2ban.log
2012-10-04 10:52:24,287 fail2ban.filter : INFO Set maxRetry = 3
2012-10-04 10:52:24,288 fail2ban.filter : INFO Set findtime = 604800
2012-10-04 10:52:24,288 fail2ban.actions: INFO Set banTime = 604800
2012-10-04 10:52:24,292 fail2ban.jail : INFO Jail 'ssh' started
2012-10-04 10:52:24,293 fail2ban.jail : INFO Jail 'ssh-iptables' started
2012-10-04 10:52:24,297 fail2ban.jail : INFO Jail 'fail2ban' started
발행 할 때 :
sudo service fail2ban restart
fail2ban이메일 ssh이 다시 시작 되었다고 했지만 phpmyadmin감옥 에 관한 이메일을받지 못했습니다 . 로그인이 반복 phpMyAdmin되지 않아 이메일이 전송되지 않습니다.
중요한 설정을 놓친 적이 있습니까? 필터의 정규식이 잘못 되었습니까?
업데이트 : 기본 설치에서 변경된 사항 추가
새로 fail2ban설치로 시작 :
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
이메일 주소를 내 것으로 변경하고 다음 작업을 수행하십시오.
action = %(action_mwl)s
다음에 추가 jail.local
[phpmyadmin]
enabled = true
port = http,https
filter = phpmyadmin
action = sendmail-whois[name=HTTP]
logpath = /var/log/phpmyadmin_auth.log
maxretry = 4
에 다음을 추가하십시오 /etc/fail2ban/filter.d/phpmyadmin.conf
# phpmyadmin configuration file
#
# Author: Michael Robinson
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
# Count all bans in the logfile
failregex = phpMyadmin login failed with username: .*; ip: <HOST>;
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
# Ignore our own bans, to keep our counts exact.
# In your config, name your jail 'fail2ban', or change this line!
ignoreregex =
재시작 fail2ban
sudo service fail2ban restart
PS : 난 계란이 좋아
1
구성에서 새 감옥을 집어 들지 않는 것 같습니다. 변경 한 파일을 정확하게 지정하십시오.
—
mgorven
@mgorven 변경 한 사항에 대한 포괄적 인 개요로 질문을 업데이트했습니다
—
Michael Robinson
이 실제 로그인은 phpmyadmin 인스턴스에 대한 시도 입니까, 아니면 단순히 스캐너 가 phpmyadmin을 찾고 있습니까?
—
Scott Pack
나는 그들이 후자라고 믿는다
—
Michael Robinson