Fakt nechápu, proč autoři fail2banu udělali takovou hloupost, když nechali v konfiguračních souborech v defaultu aktivní REJECT, kdy server, který vám zablokoval přístup, vám ještě hloupě vyzradí, že se na něj nedostanete, přičemž mu defakto pomáháte dělat jeho práci. Setkáte se s mnoha diskusemi napříč internetem, kde nadávají všichni provozovatelé serverů, s vystaveným SSH ven do světa. Nicméně dovedu si představit use case, u kterého autoři zamýšleli, že jim stačí jen REJECT. Každopádně kdo máte SSH i na nestandardním portu vystavený do internetu moc dobře víte, že jedině DROP je to řešení pro vás. A pro ty z vás tu je tento rychlonávod.
v /etc/fail2ban/action.d/iptables-common.conf zakomentujte blocktype = REJECT a pod něj vložte blocktype = DROP
#blocktype = REJECT --reject-with icmp-port-unreachable
blocktype = DROP
#Pak už jen
systemctl restart fail2ban
systemctl status fail2banV tu chvíli po zadání iptables -L -vn uvidíte
Místo:
Chain f2b-sshd (1 references)
pkts bytes target prot opt in out source destination
19 1508 REJECT all -- * * 14.63.185.80 0.0.0.0/0 reject-with icmp-port-unreachable
17 1252 REJECT all -- * * 164.52.89.94 0.0.0.0/0 reject-with icmp-port-unreachable
1 60 REJECT all -- * * 81.182.254.124 0.0.0.0/0 reject-with icmp-port-unreachable
16 1224 REJECT all -- * * 106.12.179.119 0.0.0.0/0 reject-with icmp-port-unreachable
18 1312 REJECT all -- * * 36.91.119.221 0.0.0.0/0 reject-with icmp-port-unreachable
15 1064 REJECT all -- * * 43.154.120.54 0.0.0.0/0 reject-with icmp-port-unreachable
16 1232 REJECT all -- * * 118.97.167.77 0.0.0.0/0 reject-with icmp-port-unreachable
2 120 REJECT all -- * * 43.135.166.247 0.0.0.0/0 reject-with icmp-port-unreachable
17 1292 REJECT all -- * * 218.111.170.212 0.0.0.0/0 reject-with icmp-port-unreachable
17 1248 REJECT all -- * * 82.156.249.184 0.0.0.0/0 reject-with icmp-port-unreachable
16 1232 REJECT all -- * * 180.101.202.30 0.0.0.0/0 reject-with icmp-port-unreachable
19 1372 REJECT all -- * * 159.65.3.24 0.0.0.0/0 reject-with icmp-port-unreachable
19 1352 REJECT all -- * * 162.241.94.40 0.0.0.0/0 reject-with icmp-port-unreachable
18 1312 REJECT all -- * * 149.129.41.70 0.0.0.0/0 reject-with icmp-port-unreachable
13 916 REJECT all -- * * 82.156.19.49 0.0.0.0/0 reject-with icmp-port-unreachable
6 360 REJECT all -- * * 107.170.131.23 0.0.0.0/0 reject-with icmp-port-unreachable
36 2432 REJECT all -- * * 194.62.43.199 0.0.0.0/0 reject-with icmp-port-unreachable
22 1592 REJECT all -- * * 201.226.239.98 0.0.0.0/0 reject-with icmp-port-unreachable
25 1772 REJECT all -- * * 118.69.225.138 0.0.0.0/0 reject-with icmp-port-unreachable
34 2320 REJECT all -- * * 5.255.98.101 0.0.0.0/0 reject-with icmp-port-unreachable
31 2180 REJECT all -- * * 68.183.216.38 0.0.0.0/0 reject-with icmp-port-unreachable
15 900 REJECT all -- * * 121.1.248.95 0.0.0.0/0 reject-with icmp-port-unreachable
25 1780 REJECT all -- * * 37.139.5.94 0.0.0.0/0 reject-with icmp-port-unreachable
22 1552 REJECT all -- * * 43.254.156.42 0.0.0.0/0 reject-with icmp-port-unreachable
30 1800 REJECT all -- * * 163.53.247.47 0.0.0.0/0 reject-with icmp-port-unreachable
27 1784 REJECT all -- * * 110.35.173.103 0.0.0.0/0 reject-with icmp-port-unreachable
29 2012 REJECT all -- * * 72.167.55.58 0.0.0.0/0 reject-with icmp-port-unreachable
29 1952 REJECT all -- * * 198.199.94.78 0.0.0.0/0 reject-with icmp-port-unreachable
25 1732 REJECT all -- * * 152.32.129.20 0.0.0.0/0 reject-with icmp-port-unreachable
21 1500 REJECT all -- * * 218.56.160.82 0.0.0.0/0 reject-with icmp-port-unreachable
31 2132 REJECT all -- * * 130.185.76.24 0.0.0.0/0 reject-with icmp-port-unreachable
1 60 REJECT all -- * * 190.15.222.52 0.0.0.0/0 reject-with icmp-port-unreachable
5 300 REJECT all -- * * 190.129.60.125 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 119.65.149.106 0.0.0.0/0 reject-with icmp-port-unreachable
Reject se změní na DROP 🙂
Chain f2b-sshd (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 82.156.249.184 0.0.0.0/0
0 0 DROP all -- * * 82.156.19.49 0.0.0.0/0
0 0 DROP all -- * * 81.182.254.124 0.0.0.0/0
0 0 DROP all -- * * 72.167.55.58 0.0.0.0/0
0 0 DROP all -- * * 68.183.216.38 0.0.0.0/0
0 0 DROP all -- * * 5.255.98.101 0.0.0.0/0
0 0 DROP all -- * * 43.254.156.42 0.0.0.0/0
0 0 DROP all -- * * 43.154.120.54 0.0.0.0/0
0 0 DROP all -- * * 43.135.166.247 0.0.0.0/0
0 0 DROP all -- * * 37.139.5.94 0.0.0.0/0
0 0 DROP all -- * * 36.91.119.221 0.0.0.0/0
0 0 DROP all -- * * 218.56.160.82 0.0.0.0/0
0 0 DROP all -- * * 218.111.170.212 0.0.0.0/0
0 0 DROP all -- * * 201.226.239.98 0.0.0.0/0
0 0 DROP all -- * * 198.199.94.78 0.0.0.0/0
0 0 DROP all -- * * 194.62.43.199 0.0.0.0/0
0 0 DROP all -- * * 190.15.222.52 0.0.0.0/0
0 0 DROP all -- * * 190.129.60.125 0.0.0.0/0
0 0 DROP all -- * * 180.101.202.30 0.0.0.0/0
0 0 DROP all -- * * 164.52.89.94 0.0.0.0/0
0 0 DROP all -- * * 163.53.247.47 0.0.0.0/0
0 0 DROP all -- * * 162.241.94.40 0.0.0.0/0
0 0 DROP all -- * * 159.65.3.24 0.0.0.0/0
0 0 DROP all -- * * 152.32.129.20 0.0.0.0/0
0 0 DROP all -- * * 149.129.41.70 0.0.0.0/0
0 0 DROP all -- * * 14.63.185.80 0.0.0.0/0
0 0 DROP all -- * * 130.185.76.24 0.0.0.0/0
0 0 DROP all -- * * 121.1.248.95 0.0.0.0/0
0 0 DROP all -- * * 119.65.149.106 0.0.0.0/0
0 0 DROP all -- * * 118.97.167.77 0.0.0.0/0
0 0 DROP all -- * * 118.69.225.138 0.0.0.0/0
0 0 DROP all -- * * 110.35.173.103 0.0.0.0/0
0 0 DROP all -- * * 107.170.131.23 0.0.0.0/0
0 0 DROP all -- * * 106.12.179.119 0.0.0.0/0