fail2ban封IP之Http

环境介绍：http是一个tomcat 的js程序 ,设置的路径为/opt/tomcat5/logs/localhost_access_log.txt
OS:centos 5.3 fail2ban版本:fail2ban-0.8.2-3.el5.rf.noarch.rpm
官方网站：http://www.fail2ban.org/wiki/index.php/Main_Page

背景：及时发现别人的恶意请求并禁止

步骤：

1.安装fail2ban
这里我走了弯路,下源码包安装报错,大家可以这个网址下载:http://packages.sw.be/fail2ban/

#rpm -ivh fail2ban-0.8.23.el5.rf.noarch.rpm 

2.配置fail2ban的自定义过滤规则
分析/opt/tomcat5/logs/localhost_access_log.txt 日志的恶意请求如下 ：

192.168.32.41 - - [10/Sep/2010:18:11:27  0800] "GET 12345678.txt HTTP/1.1" 404 1063  
192.168.32.41 - - [10/Sep/2010:18:11:27  0800] "GET 12345678.txt HTTP/1.1" 404 1063  
192.168.32.41 - - [10/Sep/2010:18:11:29  0800] "GET 12345678.txt HTTP/1.1" 404 1063  
192.168.32.41 - - [10/Sep/2010:18:11:29  0800] "GET 12345678.txt HTTP/1.1" 404 1063  
192.168.32.41 - - [10/Sep/2010:18:11:29  0800] "GET 12345678.txt HTTP/1.1" 404 1063  
192.168.32.41 - - [10/Sep/2010:18:11:29  0800] "GET 12345678.txt HTTP/1.1" 404 1063  

从攻击行为特征来看, 这是短时间连续导致服务器发送HTTP 404文件未找到错误码, 下面是用于发现上述攻击的fail2ban filter规则,
在/etc/fail2ban/filter.d/目录下建立tomcat.conf文件保存下面的内容:

[Definition]  
failregex = <HOST> -.*- .*HTTP/1.* 404 .*$  
ignoreregex = 

3.测试fail2ban的过滤规则

# fail2ban-regex /opt/tomcat5/logs/localhost_access_log.txt /etc/fail2ban/filter.d/tomcat.conf 

结果如下：

Running tests 
=============  
 
Use regex file : /etc/fail2ban/filter.d/tomcat.conf  
Use log file   : /opt/tomcat5/logs/localhost_access_log.txt  
 
 
Results 
=======  
 
Failregex  
|- Regular expressions:  
|  [1]  -.*- .*HTTP/1.* 404 .*$  
|  
`- Number of matches:  
   [1] 13 match(es)  
 
Ignoreregex  
|- Regular expressions:  
|  
`- Number of matches:  
 
Summary 
=======  
 
Addresses found:  
[1]  
    192.168.32.41 (Fri Sep 10 18:10:59 2010)  
    192.168.32.41 (Fri Sep 10 18:11:27 2010)  
    192.168.32.41 (Fri Sep 10 18:11:27 2010)  
    192.168.32.41 (Fri Sep 10 18:11:29 2010)  
    192.168.32.41 (Fri Sep 10 18:11:29 2010)  
    192.168.32.41 (Fri Sep 10 18:11:29 2010)  
    192.168.32.41 (Fri Sep 10 18:11:29 2010)  
    192.168.32.41 (Fri Sep 10 18:11:30 2010)  
    192.168.32.41 (Fri Sep 10 18:11:30 2010)  
    192.168.32.41 (Fri Sep 10 18:27:44 2010)  
    192.168.32.41 (Fri Sep 10 18:27:47 2010)  
    192.168.32.41 (Fri Sep 10 18:27:50 2010)  
    192.168.32.41 (Fri Sep 10 18:27:53 2010)  
 
Date template hits:  
0 hit(s): Month Day Hour:Minute:Second  
0 hit(s): Weekday Month Day Hour:Minute:Second Year  
0 hit(s): Weekday Month Day Hour:Minute:Second  
0 hit(s): Year/Month/Day Hour:Minute:Second  
130 hit(s): Day/Month/Year:Hour:Minute:Second  
0 hit(s): Year-Month-Day Hour:Minute:Second  
0 hit(s): Day-Month-Year Hour:Minute:Second[.Millisecond]  
0 hit(s): TAI64N  
0 hit(s): Epoch  
 
Success, the total number of match is 13  
 
However, look at the above section ''Running tests'' which could contain important  
information. 

凌众科技专业提供服务器租用、服务器托管、企业邮局、虚拟主机等服务，公司网站：http://www.lingzhong.cn 为了给广大客户了解更多的技术信息，本技术文章收集来源于网络,凌众科技尊重文章作者的版权，如果有涉及你的版权有必要删除你的文章，请和我们联系。以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!