自定义fail2ban过滤phpMyadmin bruteforce尝试

在我试图用fail2ban阻止失败的phpMyAdminlogin失败时，我创build了一个脚本来logging失败的尝试到一个文件： /var/log/phpmyadmin_auth.log

自定义日志

/var/log/phpmyadmin_auth.log文件的格式是：

 phpMyadmin login failed with username: root; ip: 192.168.1.50; url: http://somedomain.com/phpmyadmin/index.php phpMyadmin login failed with username: ; ip: 192.168.1.50; url: http://192.168.1.48/phpmyadmin/index.php 

自定义filter

• 如何确保完整性和安全性强制签署未经修改的RPM包？
• 在新安装的CentOS 5.3机器上禁用服务？
• CA是否需要全职pipe理员？
• /etc/pam.d/login和/etc/pam.d/system-auth之间的区别？
• Windows上的硬盘一次写入模式

 [Definition] # Count all bans in the logfile failregex = phpMyadmin login failed with username: .*; ip: <HOST>; 

phpMyAdmin监狱

 [phpmyadmin] enabled = true port = http,https filter = phpmyadmin action = sendmail-whois[name=HTTP] logpath = /var/log/phpmyadmin_auth.log maxretry = 6 

fail2ban日志包含：

 2012-10-04 10:52:22,756 fail2ban.server : INFO Stopping all jails 2012-10-04 10:52:23,091 fail2ban.jail : INFO Jail 'ssh-iptables' stopped 2012-10-04 10:52:23,866 fail2ban.jail : INFO Jail 'fail2ban' stopped 2012-10-04 10:52:23,994 fail2ban.jail : INFO Jail 'ssh' stopped 2012-10-04 10:52:23,994 fail2ban.server : INFO Exiting Fail2ban 2012-10-04 10:52:24,253 fail2ban.server : INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.6 2012-10-04 10:52:24,253 fail2ban.jail : INFO Creating new jail 'ssh' 2012-10-04 10:52:24,253 fail2ban.jail : INFO Jail 'ssh' uses poller 2012-10-04 10:52:24,260 fail2ban.filter : INFO Added logfile = /var/log/auth.log 2012-10-04 10:52:24,260 fail2ban.filter : INFO Set maxRetry = 6 2012-10-04 10:52:24,261 fail2ban.filter : INFO Set findtime = 600 2012-10-04 10:52:24,261 fail2ban.actions: INFO Set banTime = 600 2012-10-04 10:52:24,279 fail2ban.jail : INFO Creating new jail 'ssh-iptables' 2012-10-04 10:52:24,279 fail2ban.jail : INFO Jail 'ssh-iptables' uses poller 2012-10-04 10:52:24,279 fail2ban.filter : INFO Added logfile = /var/log/auth.log 2012-10-04 10:52:24,280 fail2ban.filter : INFO Set maxRetry = 5 2012-10-04 10:52:24,280 fail2ban.filter : INFO Set findtime = 600 2012-10-04 10:52:24,280 fail2ban.actions: INFO Set banTime = 600 2012-10-04 10:52:24,287 fail2ban.jail : INFO Creating new jail 'fail2ban' 2012-10-04 10:52:24,287 fail2ban.jail : INFO Jail 'fail2ban' uses poller 2012-10-04 10:52:24,287 fail2ban.filter : INFO Added logfile = /var/log/fail2ban.log 2012-10-04 10:52:24,287 fail2ban.filter : INFO Set maxRetry = 3 2012-10-04 10:52:24,288 fail2ban.filter : INFO Set findtime = 604800 2012-10-04 10:52:24,288 fail2ban.actions: INFO Set banTime = 604800 2012-10-04 10:52:24,292 fail2ban.jail : INFO Jail 'ssh' started 2012-10-04 10:52:24,293 fail2ban.jail : INFO Jail 'ssh-iptables' started 2012-10-04 10:52:24,297 fail2ban.jail : INFO Jail 'fail2ban' started 

当我发出：

 sudo service fail2ban restart 

fail2ban给我发邮件说ssh已经重启，但是我没有收到关于我的phpmyadmin监狱的邮件。 重复失败login到phpMyAdmin不会导致发送电子邮件。

我错过了一些关键的设置？ 我的filter的正则expression式是否错误？

更新：添加从默认安装的更改

从一个干净的fail2ban安装开始：

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

将电子邮件地址更改为我自己的操作：

 action = %(action_mwl)s 

将以下内容添加到jail.local

 [phpmyadmin] enabled = true port = http,https filter = phpmyadmin action = sendmail-whois[name=HTTP] logpath = /var/log/phpmyadmin_auth.log maxretry = 4 

将以下内容添加到/etc/fail2ban/filter.d/phpmyadmin.conf

 # phpmyadmin configuration file # # Author: Michael Robinson # [Definition] # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>\S+) # Values: TEXT # # Count all bans in the logfile failregex = phpMyadmin login failed with username: .*; ip: <HOST>; # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # # Ignore our own bans, to keep our counts exact. # In your config, name your jail 'fail2ban', or change this line! ignoreregex = 

重新启动fail2ban

 sudo service fail2ban restart 

PS：我喜欢鸡蛋

 LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{userID}n %{userStatus}n" pma_combined CustomLog /var/log/apache2/phpmyadmin_access.log pma_combined 

 [Definition] denied = mysql-denied|allow-denied|root-denied|empty-denied failregex = ^<HOST> -.*(?:%(denied)s)$ ignoreregex = 

 [phpmyadmin] enabled = true port = http,https filter = phpmyadmin logpath = /var/log/apache2/phpmyadmin_access.log 

 service apache2 reload service fail2ban reload