0

fail2ban フィルターに少し問題があり、禁止期間を 1 年に設定したにもかかわらず、何らかの理由で 10 分後に禁止が解除されます。兄弟を助けてくれませんか。

フィルターの jail.local 宣言:

[nginx-proxy]
enabled  = true
#port    = http,https
action   = iptables-multiport[name=NoProxy, port="http,https"]
filter   = nginx-proxy
logpath  = /etc/nginx/logs/*access*.log
bantime  = 31536000 # 1 year
maxretry = 0

[nginx-shellshock]
enabled  = true
#port    = http,https
action   = iptables-multiport[name=ShellShock, port="http,https"]
filter   = nginx-shellshock
logpath  = /etc/nginx/logs/*access*.log
bantime  = 31536000 # 1 year
maxretry = 0

nginx-proxy.conf

[Definition]
failregex = ^<HOST> .* "GET http.*
ignoreregex =

nginx-shellshock.conf

[Definition]
failregex = ^<HOST>.*\(\s*\)\s*\{[^"]*\}\s*\;[^"]+.*

ignoreregex =

これが私のfail2ban.logファイルです

2015-10-27 06:21:48,953 fail2ban.jail           [8319]: INFO    Jail 'nginx-auth' started
2015-10-27 06:21:48,981 fail2ban.jail           [8319]: INFO    Jail 'nginx-badbots' started
2015-10-27 06:21:49,022 fail2ban.jail           [8319]: INFO    Jail 'nginx-proxy' started
2015-10-27 06:21:49,062 fail2ban.jail           [8319]: INFO    Jail 'nginx-shellshock' started
2015-10-27 13:17:40,737 fail2ban.filter         [8319]: INFO    [nginx-shellshock] Found 108.171.178.73
2015-10-27 13:17:41,667 fail2ban.actions        [8319]: NOTICE  [nginx-shellshock] Ban 108.171.178.73
2015-10-27 13:17:41,747 fail2ban.filter         [8319]: INFO    [nginx-shellshock] Found 108.171.178.73
2015-10-27 13:17:41,747 fail2ban.filter         [8319]: INFO    [nginx-shellshock] Found 108.171.178.73
2015-10-27 13:17:41,880 fail2ban.actions        [8319]: NOTICE  [nginx-shellshock] 108.171.178.73 already banned
2015-10-27 13:27:42,572 fail2ban.actions        [8319]: NOTICE  [nginx-shellshock] Unban 108.171.178.73

fail2ban サービスの再起動時に、shellshock bantime が none に設定されているというエラーも表示されます。

2015-10-28 00:29:31,351 fail2ban.transmitter    [11600]: WARNING Command ['set', 'nginx-shellshock', 'bantime', 'None'] has failed. Received ValueError("invalid literal for int() with base 10: 'None'",)

どんな助けにも感謝します、ありがとう。

4

1 に答える 1

1

問題全体はコメントタグを使用して私の周りに捧げられました。これは明らかにfail2ban構成で行全体にコメントしています。ハッシュタグをセミコロンに変更するか、別の行に配置してください。

于 2015-10-28T09:59:50.940 に答える