Fail2ban místo blokace přesměrování

16. 4. 2016 09:55:55

Dobrý den,

Snažím se v fail2ban udělat action který by místo blokace presměroval na jiný port.

Můj jail.local vypadá takto:

# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8

# External command that will take an tagged arguments to ignore, e.g. <ip>,
# and return true if the IP is to be ignored. False otherwise.
#
# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" is the number of seconds that a host is banned.
bantime  = 86400

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 600
maxretry = 3

# "backend" specifies the backend used to get files modification.
# Available options are "pyinotify", "gamin", "polling" and "auto".
# This option can be overridden in each jail as well.
#
# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
#            If pyinotify is not installed, Fail2ban will use auto.
# gamin:     requires Gamin (a file alteration monitor) to be installed.
#            If Gamin is not installed, Fail2ban will use auto.
# polling:   uses a polling algorithm which does not require external libraries.
# auto:      will try to use the following backends, in order:
#            pyinotify, gamin, polling.
backend = polling

# "usedns" specifies if jails should trust hostnames in logs,
#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs
#
# yes:   if a hostname is encountered, a reverse DNS lookup will be performed.
# warn:  if a hostname is encountered, a reverse DNS lookup will be performed,
#        but it will be logged as a warning.
# no:    if a hostname is encountered, will not be used for banning,
#        but it will be logged as info.
usedns = warn

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# Name of the sender for mta actions
sendername = Fail2Ban

# Email address of the sender
sender = fail2ban@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
banaction = iptables-multiport
banaction_redirect = redirect

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

# Specify chain where jumps would need to be added in iptables-* actions
chain = INPUT

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s
action_redirect = %(banaction_redirect)s

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s
              %(mta)s-whois

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s
               %(mta)s-whois-lines

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section ) or per specific section
action = %(action_)s

#
# JAILS
#

enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3

enabled = true
filter = wordpress
logpath = /var/log/auth.log
port = http,https
action = %(action_redirect)s

a action redirect.conf vypadá takto:

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
# Copied from iptables.conf and modified by Yaroslav Halchenko 
#  to fulfill the needs of bugreporter dbts#350746.
#
#

before = iptables-blocktype.conf

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = iptables -t nat -A PREROUTING -i eth0 -p tcp -s <ip> --dport <port> -j REDIRECT --to-port 8081
            /usr/local/fail2sql/fail2sql <name> <protocol> <port> <ip>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban = iptables -t nat -D PREROUTING -i eth0 -p tcp -s <ip> --dport <port> -j REDIRECT --to-port 8081

# Default name of the chain
#
name = default

# Option:  port
# Notes.:  specifies port to monitor
# Values:    Default:
#
port = http,https

# Option:  protocol
# Notes.:  internally used by config reader for interpolations.
# Values:   Default: tcp
#
protocol = tcp

# Option:  chain
# Notes    specifies the iptables chain to which the fail2ban rules should be
#          added
# Values:  STRING  Default: INPUT
chain = INPUT

Buhužel když zadám 3x špatně heslo action se neprovede. Co dělám špatně? Budu rád za každou radu, Děkuji.

16. 4. 2016 09:55:55