1

fail2ban-regex を実行する場合

fail2ban-regex /var/log/named/security1.log /etc/fail2ban/filter.d/named-refused.conf

次の出力が得られます

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/named-refused.conf
Use log file   : /var/log/named/security1.log

Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]
Matched time template Day-MONTH-Year Hour:Minute:Second[.Millisecond]


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Summary
=======

Sorry, no match

これは、security1.log ファイルの出力の一部です。

08-Feb-2016 11:38:15.324 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.325 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied
08-Feb-2016 11:38:15.326 client 192.168.0.1#4444 (cpsc.gov): query (cache) 'cpsc.gov/ANY/IN' denied

失敗正規表現は次のとおりです

failregex = %(__line_prefix)sclient <HOST>#\S+: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$

私のsecurity1.logの出力とnamed-refused.confファイルのfailregex構文には違いがあり、何も見つからないと思います。

前もって感謝します、

男

4

1 に答える 1

1

あなたが説明して得たのと同じ方法で、私の Debian 8.2 fail2ban を通してあなたのログを実行しました。

Results
=======

Failregex: 14 total
|-  #) [# of hits] regular expression
|   1) [14] ^(?:\s\S+ (?:(?:\[\d+\])?:\s+\(?named(?:\(\S+\))?\)?:?|\(?named(?:\(\S+\))?\)?:?(?:\[\d+\])?:)\s+)?(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [14] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
`-

Lines: 14 lines, 0 ignored, 14 matched, 0 missed

興味があれば、私のディストリビューションの /etc/fail2ban/filter.d/named-refused.conf ファイルは次のとおりです。

[Definition]                                                                                                                                                                    

# Daemon name                                                                                                                                                                   
_daemon=named                                                                                                                                                                   

# Shortcuts for easier comprehension of the failregex                                                                                                                           

__pid_re=(?:\[\d+\])                                                                                                                                                            
__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?                                                                                                                                     
__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)                                                                                            

#       hostname       daemon_id         spaces                                                                                                                                 
# this can be optional (for instance if we match named native log files)                                                                                                        
__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?                                                                                                                               

failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$                           
            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$                                                     
            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$                 

# DEV Notes:                                                                                                                                                                    
# Trying to generalize the                                                                                                                                                      
#          structure which is general to capture general patterns in log                                                                                                        
#          lines to cover different configurations/distributions                                                                                                                
#..........                                                                                                                                                                     
# (\.\d+)? is a really ugly catch of the microseconds not captured in the date detector                                                                                         
  #                                                                                                                                                                               
# Author: Yaroslav Halchenko

「日付検出器でキャプチャされていないマイクロ秒の本当に醜いキャッチ」についての著者のコメントに注意してください（もちろん、自分のバージョンに対するサニティチェックの後）試して、動作するかどうかを確認してください。ところで、あなたのディストリビューションは何ですか?

于 2016-02-08T14:11:32.083 に答える