Holas he instalado fail2ban en un server ubuntu y me bloquea bien las ips que acceden por ssh pero la jail de phpmyadmin no me funciona , me dice :
* Restarting authentication failure monitor fail2ban [fail]
el codigo del filtro de la jail phpmyadmin , lo copié y pegué de un tutorial , ya que al parecer no viene ninguno por defecto en la carpeta filter.d .
[Definition]
failregex = ^[[]client <HOST>[]] File does not exist: *myadmin* *\s*$
^[[]client <HOST>[]] File does not exist: *MyAdmin* *\s*$
^[[]client <HOST>[]] File does not exist: *mysqlmanager* *\s*$
^[[]client <HOST>[]] File does not exist: *setup.php* *\s*$
^[[]client <HOST>[]] File does not exist: *mysql* *\s*$
^[[]client <HOST>[]] File does not exist: *phpmanager* *\s*$
^[[]client <HOST>[]] File does not exist: *phpadmin* *\s*$
^[[]client <HOST>[]] File does not exist: *sqlmanager* *\s*$
^[[]client <HOST>[]] File does not exist: *sqlweb* *\s*$
^[[]client <HOST>[]] File does not exist: *webdb* *\s*
ignoreregex =
tambien probé con este y nada mismo error :
# Fail2Ban configuration file
#
# Bans bots scanning for non-existing phpMyAdmin installations on your webhost.
#
# Author: Gina Haeussge
#
[Definition]
docroot = /var/www
badadmin = PMA|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|mypma|admin|xampp|mysqldb|mydb|db|pmadb|phpmyadmin1|phpmyadmin2
# Option: failregex
# Notes.: Regexp to match often probed and not available phpmyadmin paths.
# Values: TEXT
#
failregex = [[]client []] File does not exist: %(docroot)s/(?:%(badadmin)s)
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
soy muy novato en esto y toy atascao
gracias
Primero tienes que poner la jaula, en jail.conf:
[apache-myadmin]
enabled = true
filter = apache-myadmin
port = http,https
logpath = /var/log/apache2/error.log
action = iptables-multiport[name=apache-myadmin, port="http,https", protocol=tcp]
maxretry = 2
Y luego el filtro en la carpeta filter.d
[Definition]
failregex = [[]client <HOST>[]] File does not exist: /\S*phpmyadmin*
[[]client <HOST>[]] File does not exist: /\S*phpMyAdmin*
[[]client <HOST>[]] File does not exist: /\S*PMA*
[[]client <HOST>[]] File does not exist: /\S*pma*
[[]client <HOST>[]] File does not exist: /\S*admin*
[[]client <HOST>[]] File does not exist: /\S*dbadmin*
[[]client <HOST>[]] File does not exist: /\S*sql*
[[]client <HOST>[]] File does not exist: /\S*mysql*
[[]client <HOST>[]] File does not exist: /\S*myadmin*
[[]client <HOST>[]] File does not exist: /\S*MyAdmin*
[[]client <HOST>[]] File does not exist: /\S*phpmyadmin2*
[[]client <HOST>[]] File does not exist: /\S*phpMyAdmin2*
[[]client <HOST>[]] File does not exist: /\S*phpMyAdmin-2*
[[]client <HOST>[]] File does not exist: /\S*php-my-admin*
[[]client <HOST>[]] File does not exist: /\S*sqlmanager*
[[]client <HOST>[]] File does not exist: /\S*mysqlmanager*
[[]client <HOST>[]] File does not exist: /\S*PMA2005*
[[]client <HOST>[]] File does not exist: /\S*pma2005*
[[]client <HOST>[]] File does not exist: /\S*phpmanager*
[[]client <HOST>[]] File does not exist: /\S*php-myadmin*
[[]client <HOST>[]] File does not exist: /\S*phpmy-admin*
[[]client <HOST>[]] File does not exist: /\S*webadmin*
[[]client <HOST>[]] File does not exist: /\S*sqlweb*
[[]client <HOST>[]] File does not exist: /\S*websql*
[[]client <HOST>[]] File does not exist: /\S*webdb*
[[]client <HOST>[]] File does not exist: /\S*mysqladmin*
[[]client <HOST>[]] File does not exist: /\S*mysql-admin*
ignoreregex =
gracias por contestar .
El jail.conf lo tengo cambiado por jail.local ,
To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
Así que las jaulas las pongo en jail.local
Copié jail.conf y lo renombré por jail.local , espero que no sea este el fallo .
las carpetas que aparecen en /etc/fail2ban/ :
action.d fail2ban.conf filter.d jail.conf jail.local
El código que me has puesto me vuelve a dar FAIL al hacer
service fail2ban restart
y
/etc/init.d/fail2ban status :
* Status of authentication failure monitor * fail2ban is not running
Nadie me da alguna indicación o vaga idea de que por qué no se me activa ese filtro ? :( :(
Buuuuuuuuuuuaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.
Por cierto , este filtro es esencial para protegerse ?
O phpmyadmin es algo complicado de romper si tienes una buena contraseña ?
~# fail2ban-client status
Status
|- Number of jail: 3
`- Jail list: apache, apache-myadmin, ssh
~# /etc/init.d/fail2ban status
* Status of authentication failure monitor * fail2ban is running
# fail2ban-client status apache-myadmin
Status for the jail: apache-myadmin
|- filter
| |- File list: /var/log/apache2/error.log
| |- Currently failed: 0
| `- Total failed: 0
`- action
|- Currently banned: 0
| `- IP list:
`- Total banned: 0
ya no me da error al activar el filtro de phpmyadmin , era un error tipográfico XD y bien gordo (.con en lugar de .conf jajajajajajajajaja ).
pero veo k no me banea las ip k intentan logearse por phpmyadmin.
en cambio ssh va de maravilla :
Status for the jail: ssh
|- filter
| |- File list: /var/log/auth.log
| |- Currently failed: 1
| `- Total failed: 36
`- action
|- Currently banned: 8
| `- IP list: 115.239.228.35 115.239.228.7 115.239.228.4 115.239.228.14 115.239.228.11 115.239.228.12 115.239.228.6 115.230.126.151
`- Total banned: 9