在线求解一个Fail2ban问题
<i class="pstatus"> 本帖最后由 Jike 于 2024-11-16 11:25 编辑 </i><br /><br />
Proxmox VE中快速设置Fail2ban<br />
<br /><div class="blockcode"><div id="code_MLh"><ol><li>安装Fail2ban<br /><li>在Proxmox VE主机上作为root执行以下命令：<br /><li><br /><li>apt upd删ate<br /><li>apt install fail2ban<br /><li>配置基础设置<br /><li>建议使用/etc/fail2ban/jail.local文件，其设置优先于jail.conf。使用以下命令复制模板：<br /><li><br /><li>cp /etc/fail2ban/jail.conf /etc/fail2b删an/jail.local<br /><li>使用systemd后端设置Jail<br /><li>在/etc/fail2ban/jail.local文件末尾添加：<br /><li><br /><li><br /><li>enabled = true<br /><li>port = https,http,8006<br /><li>filter = proxmox<br /><li>backend = systemd<br /><li>maxretry = 3<br /><li>findtime = 2d<br /><li>bantime = 1h<br /><li>配置过滤器<br /><li>创建文件/etc/fail2ban/filter.d/proxmox.conf并添加：<br /><li><br /><li><br /><li>failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.*<br /><li>ignoreregex =<br /><li>journalmatch = _SYSTEMD_UNIT=pvedaemon.service<br /><li>启用配置<br /><li>使用以下命令重启服务：<br /><li><br /><li>systemctl restart fail2ban<br /><li></ol></div><em onclick="copycode($('code_MLh'));">复制代码</em></div><br />
<br />
<br />
然后root@cpee:/etc/fail2ban# sudo fail2ban-client status <br />
2024-11-16 11:21:52,361 fail2ban : ERROR Failed to access socket path: /var/run/fail2删ban/fail2ban.sock. Is fail2ban running?<br />
<br />
这是什么问题啊 兄弟们求解 （不加删发不了帖）<br />
not found any log file for sshd #加sudo，妥妥的ctrl-c ctrl-v..<br />
写配置文件不要写那么花，写精简点，只包括基本的，包括local和filter都一样<br />
<br />
<br />
你配置文件没贴全<br />
我昨天也遇到了。是因为我指定了日志目录。结果systemctl status rsyslog这个服务没装。。。 <div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16034986&ptid=1364324" target="_blank"><font color="#999999">icon 发表于 2024-11-16 11:31</font></a></font><br />
#加sudo，妥妥的ctrl-c ctrl-v..<br />
写配置文件不要写那么花，写精简点，只包括基本的，包括local和filter都一 ...</blockquote></div><br />
还是错误啊 大佬 <br />
<br />
root@cpdd:/etc# sudo systemctl status fail2ban<br />
× fail2ban.service - Fail2Ban Service<br />
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; preset: enabled)<br />
Active: failed (Result: exit-code) since Sat 2024-11-16 11:43:39 CST; 7s ago<br />
Duration: 88ms<br />
Docs: man:fail2ban(1)<br />
Process: 199955 ExecStart=/usr/bin/fail2ban-server -xf start (code=exited, status=255/EXCEPTION)<br />
Main PID: 199955 (code=exited, status=255/EXCEPTION)<br />
CPU: 85ms<br />
<br />
Nov 16 11:43:39 systemd: Started fail2ban.service - Fail2Ban Service.<br />
Nov 16 11:43:39 fail2ban-server: 2024-11-16 11:43:39,341 fail2ban.configreader : WARNING 'all><br />
Nov 16 11:43:39 fail2ban-server: 2024-11-16 11:43:39,352 fail2ban : ERROR Fail><br />
Nov 16 11:43:39 fail2ban-server: 2024-11-16 11:43:39,355 fail2ban : ERROR Asyn><br />
Nov 16 11:43:39 systemd: fail2ban.service: Main process exited, code=exited, status=255/EXCEPTION<br />
Nov 16 11:43:39 systemd: fail2ban.service: Failed with result 'exit-code'. <div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16035011&ptid=1364324" target="_blank"><font color="#999999">Jike 发表于 2024-11-16 11:44</font></a></font><br />
还是错误啊 大佬 <br />
<br />
root@cpdd:/etc# sudo systemctl status fail2ban</blockquote></div><br />
<br />
<br />
你把屏幕滚到右边屏，看看完整的错误信息。 <div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16034994&ptid=1364324" target="_blank"><font color="#999999">afkool 发表于 2024-11-16 11:34</font></a></font><br />
你配置文件没贴全<br />
我昨天也遇到了。是因为我指定了日志目录。结果systemctl status rsyslog这个服务没装。 ...</blockquote></div><br />
e - Fail2Ban Service.<br />
6:38:19,257 fail2ban.configreader : WARNING 'allowipv6' not defined in 'Definition'. Using default one: 'auto'<br />
6:38:19,268 fail2ban : ERROR Failed during configuration: Have not found any log file for sshd ja><br />
6:38:19,273 fail2ban : ERROR Async configuration of server failed<br />
<br />
我是刚安装什么都没修改 就报错了<br />
没办法启动 <div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16035448&ptid=1364324" target="_blank"><font color="#999999">Jike 发表于 2024-11-16 14:39</font></a></font><br />
e - Fail2Ban Service.<br />
6:38:19,257 fail2ban.configreader : WARNING 'allowipv6' not defined ...</blockquote></div><br />
local里面加上<br />
<br />
<br />
enabled = false <div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16034994&ptid=1364324" target="_blank"><font color="#999999">afkool 发表于 2024-11-16 11:34</font></a></font><br />
你配置文件没贴全<br />
我昨天也遇到了。是因为我指定了日志目录。结果systemctl status rsyslog这个服务没装。 ...</blockquote></div><br />
<br />
enabled = true<br />
port = https,http,8006,22<br />
filter = proxmox<br />
logpath = /var/log/daemon.log<br />
maxretry = 3<br />
bantime = 2592000<br />
<br />
<br />
<br />
enabled = true<br />
port = 22<br />
logpath = /var/log/auth.log<br />
backend = systemd<br />
maxretry = 3<br />
bantime = 2592000<br />
findtime = 36000<br />
banaction = iptables-allports<br />
大佬能贴一下你的吗 <div class="blockcode"><div id="code_zjd"><ol><li>6:38:19,268 fail2ban : ERROR Failed during configuration: Have not found any log file for sshd ja></ol></div><em onclick="copycode($('code_zjd'));">复制代码</em></div><br />
日志丢失<br />
systemctl status rsyslog<br />
看下装这个没有。没装的话装一下。<div class="quote"><blockquote><font size="2"><a href="https://hostloc.com/forum.php?mod=redirect&goto=findpost&pid=16035878&ptid=1364324" target="_blank"><font color="#999999">afkool 发表于 2024-11-16 17:53</font></a></font><br />
日志丢失<br />
systemctl status rsyslog<br />
看下装这个没有。没装的话装一下。</blockquote></div><br />
装了 我去 发现不cp这一步就好了<br />
<br />
cp /etc。/fail2。ban/ja。il.conf /etc/fa。il。2ban/jail.loc。al<br />
<br />
https://pve.proxm。ox.com/wiki/Fail2ban 这适用d。ebian12啊
页:
[1]