% 최근버전 fail2ban 에선 해결된것으로 보이니 테스트 후 필터링이 안될경우에만 적용하시기 바랍니다.
1. fail2ban proftpd filter
fain2ban 과 proftpd의 filter (/etc/fail2ban/filter.d/proftpd.conf)를 사용할때 proftpd.conf의 failregex 설정인
정규표현식이 제대로 동작하지 않을수 있습니다. proftpd설정에서 logformat을 변경했거나 ExtendedLog설정했을 경우
또는 알수없는 (--;)이유로 로그파일을 걸러내지 못할수 있습니다. 설정내용은 아래를 참고하세요.
기존설정 (/etc/fail2ban/filter.d/proftpd.conf)
failregex = (S+[<HOST>])[: -]+ USER S+: no such user found from S+ [S+] to S+:S+$
(S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
(S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
(S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
(S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
(S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
(S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
추가 설정 (파란색 부분이 추가된 부분)
failregex = (S+[<HOST>])[: -]+ USER S+: no such user found from S+ [S+] to S+:S+$
(S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
(S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
(S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
USER S+: no such user found from S* [<HOST>] to S+s*$
^<HOST> .* nobody .*PASS .* 530
(S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
(S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
(S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
USER S+: no such user found from S* [<HOST>] to S+s*$
^<HOST> .* nobody .*PASS .* 530
맨처음 표현식 (S+[<HOST>])[: -]+ USER S+: no such user found from S+ [S+] to S+:S+$
으로 "no such user found from..." 로그를 잡아내야 하는데 그렇지 못해 정규표현식을 추가했습니다.
마지막 표현식 ^<HOST> .* nobody .*PASS .* 530 은 로그인실패(패스워드가 틀림)의 로그인데 필요에 따라 추가 또는
제거 해서 사용하시면 되겠습니다.
fail2ban은 regex 테스트툴인 fail2ban-regex를 제공합니다. 2.proftpd 샘플로그 부분의 로그를 /tmp/ftp.log등으로 저장후
fail2ban-regex /tmp/ftp.log /etc/fail2ban/filter.d/proftpd.conf 명령으로 필터링 되는지 확인해볼수 있습니다.
아래 출력은 필터링 되는지 여부와 몇번에 걸쳐 매치가 되는지 보여주는 내용입니다.
[root@free4u:/]#/usr/bin/fail2ban-regex /tmp/ftp.log /etc/fail2ban/filter.d/proftpd.conf
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /tmp/ftp.log
Results
=======
Failregex
|- Regular expressions:
| [1] (S+[<HOST>])[: -]+ USER S+: no such user found from S+ [S+] to S+:S+$
| [2] (S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
| [3] (S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
| [4] (S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
| [5] USER S+: no such user found from S* [<HOST>] to S+s*$
| [6] ^<HOST> .* nobody .*PASS .* 530
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)
[5] 3 match(es)
[6] 1 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
[2]
[3]
[4]
[5]
61.132.87.159 (Fri Dec 12 02:30:21 2008)
61.132.87.159 (Fri Dec 12 02:30:21 2008)
61.132.87.159 (Fri Dec 12 02:30:21 2008)
[6]
61.132.87.159 (Fri Dec 12 16:53:38 2008)
Date template hits:
87 hit(s): Month Day Hour:Minute:Second
0 hit(s): Weekday Month Day Hour:Minute:Second Year
0 hit(s): Weekday Month Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
13 hit(s): Day/Month/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-Month-Year Hour:Minute:Second[.Millisecond]
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
Success, the total number of match is 4
However, look at the above section 'Running tests' which could contain important
information.
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /tmp/ftp.log
Results
=======
Failregex
|- Regular expressions:
| [1] (S+[<HOST>])[: -]+ USER S+: no such user found from S+ [S+] to S+:S+$
| [2] (S+[<HOST>])[: -]+ USER S+ (Login failed): Incorrect password.$
| [3] (S+[<HOST>])[: -]+ SECURITY VIOLATION: S+ login attempted.$
| [4] (S+[<HOST>])[: -]+ Maximum login attempts (d+) exceeded$
| [5] USER S+: no such user found from S* [<HOST>] to S+s*$
| [6] ^<HOST> .* nobody .*PASS .* 530
|
`- Number of matches:
[1] 0 match(es)
[2] 0 match(es)
[3] 0 match(es)
[4] 0 match(es)
[5] 3 match(es)
[6] 1 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
[2]
[3]
[4]
[5]
61.132.87.159 (Fri Dec 12 02:30:21 2008)
61.132.87.159 (Fri Dec 12 02:30:21 2008)
61.132.87.159 (Fri Dec 12 02:30:21 2008)
[6]
61.132.87.159 (Fri Dec 12 16:53:38 2008)
Date template hits:
87 hit(s): Month Day Hour:Minute:Second
0 hit(s): Weekday Month Day Hour:Minute:Second Year
0 hit(s): Weekday Month Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
13 hit(s): Day/Month/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-Month-Year Hour:Minute:Second[.Millisecond]
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
Success, the total number of match is 4
However, look at the above section 'Running tests' which could contain important
information.
역시나 1번 룰에서는 걸리지 않고 새로 추가한 5번과 6번에서 걸리는군요!
2.proftpd 샘플로그
아래는 proftpd의 샘플로그입니다. 파일로 저장해서 regex 테스트 용도로 쓰기에 적합하게 로그를 뽑아봤습니다.
Dec 12 02:30:21 free4u proftpd[13690]: free4u.wo.tc
([61.132.87.159]) - USER newuser: no such user found from 61.132.87.159
[61.132.87.159] to 220.116.183.152:21
Dec 12 02:30:21 free4u proftpd[13690]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:21 free4u xinetd[1429]: START: ftp pid=13694 from=61.132.87.159
Dec 12 02:30:21 free4u proftpd[13694]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - USER admin: no such user found from 61.132.87.159 [61.132.87.159] to 220.116.183.152:21
Dec 12 02:30:21 free4u proftpd[13694]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:21 free4u xinetd[1429]: START: ftp pid=13698 from=61.132.87.159
Dec 12 02:30:21 free4u proftpd[13698]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - USER www: no such user found from 61.132.87.159 [61.132.87.159] to 220.116.183.152:21
Dec 12 02:30:21 free4u proftpd[13698]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:24 free4u xinetd[1429]: START: ftp pid=13702 from=61.132.87.159
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - SECURITY VIOLATION: root login attempted.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - SECURITY VIOLATION: root login attempted.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
61.132.87.159 UNKNOWN nobody [12/Dec/2008:16:53:38 +0900] "PASS (hidden)" 530
Dec 12 02:30:21 free4u proftpd[13690]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:21 free4u xinetd[1429]: START: ftp pid=13694 from=61.132.87.159
Dec 12 02:30:21 free4u proftpd[13694]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - USER admin: no such user found from 61.132.87.159 [61.132.87.159] to 220.116.183.152:21
Dec 12 02:30:21 free4u proftpd[13694]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:21 free4u xinetd[1429]: START: ftp pid=13698 from=61.132.87.159
Dec 12 02:30:21 free4u proftpd[13698]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - USER www: no such user found from 61.132.87.159 [61.132.87.159] to 220.116.183.152:21
Dec 12 02:30:21 free4u proftpd[13698]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:24 free4u xinetd[1429]: START: ftp pid=13702 from=61.132.87.159
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - SECURITY VIOLATION: root login attempted.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - SECURITY VIOLATION: root login attempted.
Dec 12 02:30:24 free4u proftpd[13702]: free4u.wo.tc (61.132.87.159[61.132.87.159]) - FTP session closed.
61.132.87.159 UNKNOWN nobody [12/Dec/2008:16:53:38 +0900] "PASS (hidden)" 530
3. fail2ban 설정 확인 유틸리티(fail2ban-check)
fail2ban의 모든 설정을 한번에 테스트할수 있게 만든 쉘스크립트 입니다.
jail.conf에서 enabled = true로 된 설정을 모두 테스트해 결과를 출력해줍니다.
제작자: Gregg Lain
홈페이지 : http://mochabomb.com/
다운로드 링크 : http://mochabomb.com/software/fail2ban-check.txt
fail2ban-check의 실행결과 출력 화면입니다.
----------------------- fail2ban setup check ------------------------------------
fail2ban 0:off 1:off 2:off 3:on 4:on 5:on 6:off
Fail2ban (pid 29071 29074 29075 29079) is running...
Status
|- Number of jail: 2
`- Jail list: proftpd-iptables, ssh-iptables
________________________________________________________________________________
/usr/bin/fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/sshd.conf
Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/secure
| [5] ^s*(?:S+ )?(?:@vserver_S+ )?(?:(?:[d+])?:s+[[(]?sshd(?:(S+))?
[])]?:?|[[(]?sshd(?:(S+))?[])]?:?(?:[d+])?:)?s*User S+ from <HOST>
not allowed because not listed in AllowUsers$
Test result:
________________________________________________________________________________
/usr/bin/fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf
Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure
Success, the total number of match is 169
Success, the total number of match is 169
Test result: Success
fail2ban 0:off 1:off 2:off 3:on 4:on 5:on 6:off
Fail2ban (pid 29071 29074 29075 29079) is running...
Status
|- Number of jail: 2
`- Jail list: proftpd-iptables, ssh-iptables
________________________________________________________________________________
/usr/bin/fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/sshd.conf
Use regex file : /etc/fail2ban/filter.d/sshd.conf
Use log file : /var/log/secure
| [5] ^s*(?:S+ )?(?:@vserver_S+ )?(?:(?:[d+])?:s+[[(]?sshd(?:(S+))?
[])]?:?|[[(]?sshd(?:(S+))?[])]?:?(?:[d+])?:)?s*User S+ from <HOST>
not allowed because not listed in AllowUsers$
Test result:
________________________________________________________________________________
/usr/bin/fail2ban-regex /var/log/secure /etc/fail2ban/filter.d/proftpd.conf
Use regex file : /etc/fail2ban/filter.d/proftpd.conf
Use log file : /var/log/secure
Success, the total number of match is 169
Success, the total number of match is 169
Test result: Success
sshd의 경우 로그가 없기때문에 출력 내용역시 없습니다.
4. 참고 링크
http://www.fail2ban.org/
http://www.fail2ban.org/wiki/index.php/Fail2ban:Community_Portal
http://ubuntuforums.org/showthread.php?t=479438
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=461412
5. 기타 사항
fain2ban을 rpm으로 설치 또는 srpm에서 빌드후 설치했을경우 간혹 /etc/init.d/fail2ban 스크립트로 시작하지 못하는경우가
있습니다. 이럴경우 /var/run/fail2ban 디렉토리를 만들고 데몬을 다시 시작해보세요. 별도의 에러메세지도 안남겨서
원인을 찾기가 매우(?) 힘들었습니다. 
http://www.fail2ban.org/wiki/index.php/Fail2ban_talk:Community_Portal#fail2ban.actions.action_ERROR_on_startup.2Frestart
'Security' 카테고리의 다른 글
| ZeroBoardXE 1.1.5 (09.01.22) XSS Vulnerability (1) | 2009.02.11 |
|---|---|
| GNUBoard V4.31.03 (08.12.29) Local/Remote File Include Vulnerability (0) | 2009.01.23 |
| zeroboardXE CSRF (Cross-site request forgery) 보안 취약점 (0) | 2008.09.02 |
| 최근 웹사이트 공격 유형 #2 (3) | 2008.07.29 |
| Multiple DNS server vulnerable to cache poisoning (0) | 2008.07.13 |