- Szerkesztve
Sziasztok. Olyan gondom lenne,hogy van egy logom. Abból akarom kiszűrni a csalókat egy szerveren.
Fail2ban - jail + filter - iptables.
/etc/fail2ban/jail.d/cod2.conf
[cod2]
enabled = true
port = 28960
protocol = udp
filter = cod2
logpath = /home/cod2server/log/console/cod2server-console.log
maxretry = 3
findtime = 600
bantime = 3600
action = iptables-multiport[name=cod2, port="28960", protocol=udp, chain=INPUT]
Erre lázad a regexben:
/etc/fail2ban/filter.d/cod2.conf
[Definition]
failregex = Rcon from <HOST>:.*
ignoreregex =
Lázadás:
sudo fail2ban-regex /log/console/cod2server-console.log /etc/fail2ban/filter.d/cod2.conf
Running tests
=============
Use failregex filter file : cod2, basedir: /etc/fail2ban
Use log file : /home/cod2server/log/console/cod2server-console.log
Use encoding : UTF-8
Traceback (most recent call last):
File "/usr/bin/fail2ban-regex", line 34, in <module>
exec_command_line()
File "/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.py", line 836, in exec_command_line
if not fail2banRegex.start(args):
File "/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.py", line 776, in start
self.process(test_lines)
File "/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.py", line 584, in process
line_datetimestripped, ret, is_ignored = self.testRegex(line)
File "/usr/lib/python3/dist-packages/fail2ban/client/fail2banregex.py", line 456, in testRegex
found = self._filter.processLine(line, date)
File "/usr/lib/python3/dist-packages/fail2ban/server/filter.py", line 613, in processLine
timeMatch = self.dateDetector.matchTime(line)
File "/usr/lib/python3/dist-packages/fail2ban/server/datedetector.py", line 368, in matchTime
(line[distance] == self.__lastPos[2] and not self.__lastPos[2].isalnum())
IndexError: string index out of range