Am un raspberry Pi 4, pe care-l folosesc ca server pentru acasa.
Sunt diverse servicii pe acesta. Node-Red, icecast2, liquidsoap, ssh, ftp, dlna, samba, un server apache2 si tot felul de minuni inofensive.
De o vreme observ ca parca nu se conecteaza Putty asa de rapid ca de obicei, parca intarzie. Si de aici a inceput cautarea.
Spre surprinderea mea, am observat prin loguri incercari de conectare prin ssh la server cu userul root si parola gresita. Daca-mi aduc bine aminte nici nu am userul root creat.
Surpriza a fost si mai mare cand am observat ca nu doar un singur IP incearca asa ceva, ci mai multe. Foarte multe.
In prima faza am zis, ce pot sa fure din acest server? Muzica pe care o ascult odata la cateva zile din folderele liquidsoap? Si nu prea m-am impacientat, dar urmarind cateva zile ce se intampla, am hotarat ca trebuie sa fac ceva, ca deja e prea de tot ce se vede in loguri.
Asa ca am instalat fail2ban:
Code: Select all
sudo apt update
sudo apt upgrade
sudo apt install fail2ban
Din folderul /etc/fail2ban am copiat fisierul jail.conf in /etc/fail2ban/jail.local
Code: Select all
cd /etc/fail2ban
sudo cp jail.conf jail.local
dupa care l-am editat putin,
Code: Select all
sudo nano /etc/fail2ban/jail.local
iar acum arata in acest fel:
Code: Select all
[sshd]
enabled = true
filter = sshd
port = 22
logpath = /var/log/auth.log
banaction = iptables-multiport
bantime = 86400
maxretry = 1
maxconn = 3
#logpath = %(sshd_log)s
backend = %(sshd_backend)s
ignoreip = 127.0.0.1 192.168.0.*
[http-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath = /var/log/apache2/access.log
maxretry = 300
findtime = 60
bantime = 86400
[https-get-dos]
enabled = true
port = http,https
filter = http-get-dos
logpath = /var/log/apache2/access.log
maxretry = 300
findtime = 60
bantime = 86400
[apache]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/access.log
maxretry = 6
findtime = 3600
bantime = 86400
ignoreip = 127.0.0.1 192.168.0.*
[apache-owerflow]
enabled = true
port = http,https
filter = apache-owerflow
logpath = /var/log/apache2/error.log
maxretry = 3
findtime = 3600
bantime = 86400
[apache-noscript]
enabled = true
port = http,https
filter = apache-noscript
logpath = /var/log/apache2/error.log
maxretry = 3
findtime = 3600
bantime = 86400
[apache-badbots]
enabled = true
port = http,https
filter = apache-badbots
logpath = /var/log/apache2/error.log
maxretry = 2
findtime = 3600
bantime = 86400
Nu stiu daca sunt cele mai bune setari, daca aveti ceva de adaugat chiar va rog s-o faceti,
dupa care am dat enable la serviciul fai2ban:
Code: Select all
sudo systemctl enable fail2ban
Pornim fai2ban
Code: Select all
sudo systemctl start fail2ban
dupa care verificam daca functioneaza:
Code: Select all
sudo systemctl status fail2ban
aceasta comanda la mine da asa ceva in consola:
Code: Select all
root@raspberrypi:/etc/fail2ban# sudo systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor pr>
Active: active (running) since Wed 2023-10-11 14:16:18 EEST; 26min ago
Docs: man:fail2ban(1)
Process: 167455 ExecStartPre=/bin/mkdir -p /run/fail2ban (code=exited, st>
Main PID: 167456 (fail2ban-server)
Tasks: 15 (limit: 8754)
CPU: 6.530s
CGroup: /system.slice/fail2ban.service
└─167456 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
Oct 11 14:16:18 raspberrypi systemd[1]: Starting Fail2Ban Service...
Oct 11 14:16:18 raspberrypi systemd[1]: Started Fail2Ban Service.
Oct 11 14:16:18 raspberrypi fail2ban-server[167456]: 2023-10-11 14:16:18,771 >
Oct 11 14:16:18 raspberrypi fail2ban-server[167456]: 2023-10-11 14:16:18,771 >
Oct 11 14:16:18 raspberrypi fail2ban-server[167456]: 2023-10-11 14:16:18,771 >
Oct 11 14:16:19 raspberrypi fail2ban-server[167456]: Server ready
lines 1-17/17 (END)
Si putem sa verificam si statusul fail2ban
Code: Select all
sudo fail2ban-client status
La mine dupa aceasta comanda apare astfel:
Code: Select all
root@raspberrypi:/etc/fail2ban# sudo fail2ban-client status
Status
|- Number of jail: 6
`- Jail list: apache, apache-badbots, apache-noscript, http-get-dos, https-get-dos, sshd
root@raspberrypi:/etc/fail2ban#
Observam ca avem configurate 6 feluri de filtre, pe moment ma intereseaza cel ssh, asa ca dam comanda
Code: Select all
sudo fail2ban status sshd
Si aici avem o surpriza desul de mare:
Code: Select all
root@raspberrypi:/etc/fail2ban# sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 73
|- Total banned: 73
`- Banned IP list: 1.14.190.24 103.2.233.237 104.243.46.66 106.12.171.121 106.75.211.48 111.92.191.20 116.41.52.110 119.198.10.89 121.4.83.32 124.223.41.41 124.226.216.189 125.229.27.156 129.226.214.79 13.72.86.172 139.59.7.115 141.98.11.11 141.98.11.90 143.110.247.138 146.190.38.28 154.72.194.207 157.245.110.233 161.35.57.242 170.106.83.144 171.251.18.244 178.128.101.55 178.128.91.222 178.62.69.141 180.101.88.221 180.101.88.247 180.251.52.61 182.43.217.125 187.189.8.17 189.112.196.1 196.219.234.3 198.46.215.219 201.159.95.242 202.139.196.124 213.215.140.6 218.92.0.108 218.92.0.112 218.92.0.113 218.92.0.118 218.92.0.22 218.92.0.24 218.92.0.25 218.92.0.27 218.92.0.29 218.92.0.31 218.92.0.34 218.92.0.56 218.92.0.76 222.91.124.34 31.41.244.61 31.41.244.62 37.32.4.64 43.131.57.46 43.134.224.12 43.153.114.147 43.156.101.56 43.159.32.200 43.159.49.103 46.245.69.52 61.177.172.136 61.177.172.140 61.177.172.160 61.177.172.185 61.222.241.108 69.10.54.154 78.187.21.105 81.17.22.117 85.208.253.165 85.209.11.227 93.222.25.63
Sincer, nu pot intelege ce vor acestia de incearca continuu sa sparga parola de root la ssh.
Daca ma gandesc bine, am observat cu totul intamplator activitate ciudata pe micutul server.
Serverul apache2 are doar un ceas pe pagina principala:
Si mai am ceva, doua termometre la care vreau sa mai lucrez, dar nu am avut timp in ultimele doua saptamani
si acesta
In prima faza, am crezut ca e ceva personal, dar nu are de ce sa fie.
Cred ca se scaneaza totul in toate directiile posibile. Cine stie ce activitate este in fundal si noi habar nu avem.
Ce am uitat sa trec in acest material, configurarea filtrelor. In mod normal ar trebui in folderul /etc/fail2ban/filter.d sa aveti filtre gata configurate, dar de exemplu pentru http-get-ddos nu am avut, astfel incat am creat fisierul /etc/fail2ban/filter.d/http-det-dos.conf care arata asa:
Code: Select all
[Definition]
failregex = ^<HOST> -.*"(GET|POST).*HTTP.*" 40\d .*$
ignoreregex =
Bineinteles faceti si pentru https, si pentru toate serviciile pentru care nu aveti aceste filtre.
Cred ca ar fi bine, ca cei care au experienta mai mare, (eu sunt un amator incepator!
) si care cred ca ne pot ajuta in aceasta directie, sa-si spuna parerile. Securizarea serverelor nu prea a fost dezbatuta pe acest forum.
O zi frumoasa tuturor!
