Fail2ban

Fail2Ban 過濾器錯誤

  • September 26, 2019

我正在嘗試添加兩個 fail2ban 過濾器,一個用於 post flood 和 phpmyadmin brute force,但我收到以下錯誤。

日誌:

fail2ban.filter : ERROR  No 'host' group in '[[]client []] File does not exist: /var/www/(?:PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2)'

fail2ban.filter : ERROR  No 'host' group in '^ -.*”POST.*'

監獄.conf:

[apache-phpmyadmin]
enabled  = true
port     = http,https
filter   = apache-phpmyadmin
logpath  = /var/log/apache*/*error.log
maxretry = 3

[apache-postflood]
enabled = true
port = http,https
filter = apache-postflood
logpath = /var/log/apache*/*flood.log
findtime = 10
maxretry = 10

apache-phpmyadmin.conf 過濾器:

[Definition] 
docroot = /var/www
badadmin = PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2
failregex = [[]client []] File does not exist: %(docroot)s/(?:%(badadmin)s)
ignoreregex =

apache-postflood.conf 過濾器:

[Definition]
failregex = ^ -.*”POST.*
ignoreregex =

failregex缺少<HOST>必須在 IP 地址將出現在日誌條目中的位置插入的特殊字元串。這是必需的,以便 fail2ban 知道它應該對哪個 IP 地址進行操作。

引用自:https://serverfault.com/questions/690820