Fail2ban Nedir
Fail2Ban server/sunucularımızı İzinsiz erişim ( Saldırgan/Hacker ) gibi tehditlerden korumak için kullandığımız şahane araçtır.
Kurulum
apt-get install fail2ban
Default olarak gelen yapılandırma yeterlidir. Ama Serverinize özel sipesifik yapılandırmalarınız varsa yapıldırmayı özelleştirmek gerekebilir.
Fail2Ban Report
Kullanmak isterseniz şöyle bir web arayüz var
https://github.com/a-lang/F2B-Report
Ban bilgilerini eposta olarak almak.
Ben sadece belirli zamanlarda mail olarak bilgilendirilmeyi istedim.
Bunu için crontab ve bir script kullanacağız.
Öncelikle log dosyalarının tutulacağı dizini oluşturalım.
mkdir -p /media/backups/logs/
Betiğimizi kaydedelim.
nano /opt/scripts/f2ban_log.sh
chmod +x /opt/scripts/f2ban_log.sh
Script içeriği
E-posta adresinizi set etmeyi unutmayınız.
Script içerik bu şekildedir.
#!/bin/bash
# Weekly Fail2Ban Report
# Be sure to sudo chmod +x script_name.sh to make it executable
FAIL2BAN_PATH="/var/log/fail2ban*"
LOGFILE="/media/backups/logs/$(date +%m%d%Y)_Fail2Ban_Report.log"
MAILTOADDRESS="someones-email@email.com"
SUBJECT="$HOSTNAME Weekly Fail2Ban Report"
echo $(date +%m/%d/%Y) > $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo 'Most frequently banned IP addresses' >> $LOGFILE
echo ' Count IP Address' >> $LOGFILE
echo '_______________________________________' >> $LOGFILE
# show only the most problomatic IP Addresses
zgrep -h "Ban " $FAIL2BAN_PATH* | awk '{print $NF}' | sort | uniq -c | sort -n | tail | sort -nr >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo '' >> $LOGFILE
echo 'All banned IP addresses with service type' >> $LOGFILE
echo '' >> $LOGFILE
echo '_______________________________________' >> $LOGFILE
# Show what service the IP was banned from and how many times for all log files including rotated
# Sorts from high to low (using sort -nr) to sort low to high replace -nr with -n
# To not use WILDCARD (*), you much change from {print $11,$9} to {print $10,$8}
# SAMPLE OUTPUT
# 1 XXX.71.214.66 [ssh-iptables]
# 1 XXX.62.36.219 [sendmail]
# 2 XX.165.195.40 [vsftpd]
grep "Ban " $FAIL2BAN_PATH* | awk -F[ :] '{print $11,$9}' | sort | uniq -c | sort -nr >> $LOGFILE
# EMail File after completion (wait 10 seconds to finish writing log first)
sleep 10
mail -s "$SUBJECT" "$MAILTOADDRESS" < $LOGFILE
Son olarak her saat başında eposta göndermesi için Cron görevini ekleyelim.
crontab -e
00 * * * * /opt/scripts/f2ban_log.sh
Örnek bir Rapor.
Most frequently banned IP addresses
Count IP Address
_______________________________________
17 103.89.90.110
15 103.99.1.142
12 58.218.198.173
9 61.177.172.86
7 61.177.172.97
6 58.218.198.151
5 89.248.173.179
4 61.177.172.31
4 61.177.172.20
4 218.65.30.25
All banned IP addresses with service type
_______________________________________
17 103.89.90.110 [ssh]
15 103.99.1.142 [ssh]
12 58.218.198.173 [ssh]
9 61.177.172.86 [ssh]
7 61.177.172.97 [ssh]
6 58.218.198.151 [ssh]
5 89.248.173.179 [ssh]
4 61.177.172.31 [ssh]
4 61.177.172.20 [ssh]
4 218.65.30.25 [ssh]
4 173.82.212.236 [ssh]
3 94.19.208.75 [ssh]
3 5.188.10.156 [ssh]
3 103.210.135.136 [ssh]
3 103.207.39.30 [ssh]
2 83.166.242.171 [ssh]
2 80.211.236.46 [ssh]
2 70.90.114.49 [ssh]
2 218.156.85.17 [ssh]
2 178.62.34.165 [ssh]
2 137.74.237.192 [ssh]
2 111.7.177.239 [ssh]
2 109.248.9.9 [ssh]
1 94.177.235.60 [ssh]
1 92.46.36.240 [ssh]
1 91.121.226.96 [ssh]
1 80.211.251.127 [ssh]
1 68.64.160.198 [ssh]
1 62.210.192.216 [ssh]
1 61.70.66.174 [ssh]
1 61.222.250.252 [ssh]
1 61.216.44.160 [ssh]
1 61.188.189.7 [ssh]
1 60.190.104.228 [ssh]
1 59.45.170.163 [ssh]
1 59.147.38.86 [ssh]
1 58.123.212.180 [ssh]
1 5.196.162.100 [ssh]
1 51.254.249.138 [ssh]
1 51.15.255.0 [ssh]
1 49.159.105.164 [ssh]
1 42.7.26.91 [ssh]
1 41.59.225.121 [ssh]
1 41.41.75.173 [ssh]
1 41.33.188.147 [ssh]
1 223.111.200.186 [ssh]
1 221.13.67.73 [ssh]
1 217.61.96.201 [ssh]
1 212.237.45.247 [ssh]
1 212.237.41.167 [ssh]
1 206.189.68.148 [ssh]
1 199.195.254.118 [ssh]
1 188.32.87.35 [ssh]
1 185.8.49.52 [ssh]
1 185.244.25.211 [ssh]
1 185.200.117.27 [ssh]
1 176.220.131.113 [ssh]
1 167.114.13.150 [ssh]
1 159.65.103.37 [ssh]
Faydalı olması dileğiyle.
Görüş ve eleştirilerinizi bekleriz.
Kaynak: https://www.mopar4life.com/fail2ban-weekly-report-script/
Yorum Gönder