fail2ban.filter：failregex添加正则

程序员娟娟

已于 2023-11-05 18:47:24 修改

阅读量591

点赞数 2

分类专栏： fail2ban 文章标签： java 服务器安全 python

于 2023-11-05 18:43:39 首次发布

本文链接：https://blog.csdn.net/djj1015591892/article/details/134092483

版权

fail2ban 专栏收录该内容

3 篇文章 0 订阅

订阅专栏

一、问题描述

我们服务器的 auth.log 最近出现很多下面类似的内容：

Oct 28 09:35:11 hostname sshd[20316]: Address 206.189.145.254 maps to buycost.io, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

我想用fail2ban进行处理，该如何操作呢？

下面是我的操作步骤，供大家参考。

二、操作步骤

1、写正则

日志：

Oct 28 09:35:11 hostname sshd[20316]: Address 206.189.145.254 maps to buycost.io, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!

正则：

^%(__prefix_line)sAddress <HOST> maps to \S+, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!\s*$

解释：

正则	日志
^	开头
^%(__prefix_line)s	Oct 28 09:35:11 hostname sshd[20316]:
Address	Address
<HOST>	206.189.145.254
maps to	maps to
\S+,	buycost.io,
but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!\s*	but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
$	结尾