sshguard
sshguard 是一个用于保护 SSH 以及其他服务免受暴力破解攻击的守护进程,类似于 fail2ban。
sshguard 与后者的不同之处在于,它是使用 C 编写的,使用起来更轻量、简单,功能更少,但同时也能出色地执行核心功能。
sshguard 不会受到大多数(或任何)日志分析漏洞的影响,而这些漏洞曾导致同类型工具出现问题。
安装[编辑 | 编辑源代码]
设置[编辑 | 编辑源代码]
sshguard 通过监控 /var/log/auth.log
,syslog-ng 或 systemd 日志来获得失败的登录尝试。对于每次失败的尝试,违规的主机都会在有限时间内被禁止,无法进行通信。对于违规主机,被禁止的默认时间长度从 120 秒开始,之后每次登录失败都会增加 1.5 倍。sshguard 可以被配置为永久禁止一个失败尝试次数过多的主机。
临时和永久禁止都是通过在 iptables 的 "sshguard" 链中添加条目完成的,该条目会删除来自违规主机的所有数据包。随后该封禁会被记录到 syslog 并保存到 /var/log/auth.log
,如果使用 systemd 日志,则会保存到 systemd 日志中。
您必须配置下列防火墙之一来让 sshguard 的屏蔽发挥作用。
firewalld[编辑 | 编辑源代码]
sshguard 可以与 firewalld 一同工作。确保您已安装、配置并启用 firewalld。为了让 sshguard 写入设置区域,请执行以下命令:
# firewall-cmd --permanent --zone=public --add-rich-rule="rule source ipset=sshguard4 drop"
如果您使用 ipv6,您可以执行相同的命令,但需要把 sshguard4 替换为 sshguard6。完成后,执行以下命令:
# firewall-cmd --reload
您可以通过以下命令确认上述内容:
# firewall-cmd --info-ipset=sshguard4
最后,在 /etc/sshguard.conf 中,找到 BACKEND 行并变更如下:
BACKEND="/usr/lib/sshguard/sshg-fw-firewalld"
UFW[编辑 | 编辑源代码]
如果安装并启用了 UFW,则必须赋予它将 DROP 控制传递给 sshguard 的能力。可以通过在 /etc/ufw/before.rules
中包含以下行来实现。这些行应该被插入到回环设备部分之后。
/etc/ufw/before.rules
# 允许全部回环 -A ufw-before-input -i lo -j ACCEPT -A ufw-before-output -o lo -j ACCEPT # 将 sshd 的控制权交给 sshguard :sshguard - [0:0] -A ufw-before-input -p tcp --dport 22 -j sshguard
在进行上述变更后需要重新启动 ufw。
iptables[编辑 | 编辑源代码]
必要的设置是在 iptables 上创建一个名为 sshguard
的链。sshguard 将会在这个链上自动插入规则以丢弃来自坏主机的数据包:
# iptables -N sshguard
接下来添加一条从 INPUT
链跳转到 sshguard
链的规则。这条规则必须被添加在任何其他处理 sshguard 保护端口的规则之前。使用下列行来保护 FTP 和 SSH,或查看 [1] 了解更多实例。
# iptables -A INPUT -m multiport -p tcp --destination-ports 21,22 -j sshguard
若要保存这些规则:
# iptables-save > /etc/iptables/iptables.rules
/etc/iptables/ip6tables.rules
.nftables[编辑 | 编辑源代码]
编辑 /etc/sshguard.conf
并将 BACKEND
的值更改如下:
/etc/sshguard.conf
BACKEND="/usr/lib/sshguard/sshg-fw-nft-sets"
When you start/enable the sshguard.service
, two new tables named sshguard
in the ip
and ip6
address families are added which filter incoming traffic through sshguard's list of IP addresses. The chains in the sshguard
table have a priority of -10 and will be processed before other rules of lower priority. See sshguard-setup(7) and nftables for more information.
用法[编辑 | 编辑源代码]
systemd[编辑 | 编辑源代码]
syslog-ng[编辑 | 编辑源代码]
如果您安装了 syslog-ng包,您可以直接从命令行启动 sshguard。
/usr/sbin/sshguard -l /var/log/auth.log -b /var/db/sshguard/blacklist.db
配置文件[编辑 | 编辑源代码]
Configuration is done in /etc/sshguard.conf
which is required for sshguard to start. A commented example is located at /usr/share/doc/sshguard/sshguard.conf.sample
or can also be found on Bitbucket sshguard.conf.sample.
Blacklisting threshold[编辑 | 编辑源代码]
By default in the Arch-provided configuration file, offenders become permanently banned once they reach a "danger" level of 120 (or 12 failed logins; see attack dangerousness for more details). This behavior can be modified by prepending a danger level to the blacklist file.
BLACKLIST_FILE=200:/var/db/sshguard/blacklist.db
The 200:
in this example tells sshguard to permanently ban a host after achieving a danger level of 200.
Finally restart sshguard.service
Moderate banning example[编辑 | 编辑源代码]
A slightly more aggressive banning rule than the default one is proposed here to illustrate various options:
- It monitors sshd and vsftpd via logs from the systemd/日志
- It blocks attackers after 2 attempts (each having a cost of 10, explaining the
20
value of theTHRESHOLD
parameter) for 180 seconds with subsequent block time longer by a factor of 1.5. Note that this 1.5 multiplicative delay is internal and not controlled in the settings - Attackers are permanently blacklisted after 10 attempts (10 attempts having each a cost of 10, explaining the
100
value in theBLACKLIST_FILE
parameter) - It blocks not only the attacker's IP but all the IPv4 subnet 24 (CIDR notation)
/etc/sshguard.conf
# Full path to backend executable (required, no default) BACKEND="/usr/lib/sshguard/sshg-fw-iptables" # Log reader command (optional, no default) LOGREADER="LANG=C.UTF-8 /usr/bin/journalctl -afb -p info -n1 -t sshd -t vsftpd -o cat" # How many problematic attempts trigger a block THRESHOLD=20 # Blocks last at least 180 seconds BLOCK_TIME=180 # The attackers are remembered for up to 3600 seconds DETECTION_TIME=3600 # Blacklist threshold and file name BLACKLIST_FILE=100:/var/db/sshguard/blacklist.db # IPv6 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 128) IPV6_SUBNET=64 # IPv4 subnet size to block. Defaults to a single address, CIDR notation. (optional, default to 32) IPV4_SUBNET=24
Aggressive banning[编辑 | 编辑源代码]
For some users under constant attack, a more aggressive banning policy can be adopted. If you are confident that accidental failed logins are unlikely, you can instruct SSHGuard to permanently ban hosts after a single failed login. Modify the parameters in the configuration file in the following way:
THRESHOLD=10 BLACKLIST_FILE=10:/var/db/sshguard/blacklist.db
最后重新启动 sshguard.service
。
另外,为了防止在单个连接期间进行多次身份验证尝试,您需要在 /etc/ssh/sshd_config
中定义如下:
MaxAuthTries 1
重新启动 sshd.service
来使此更改生效。
提示与技巧[编辑 | 编辑源代码]
解除封禁[编辑 | 编辑源代码]
如果您封禁了自己,你可以等待自动解封,或者使用 iptables 或 nftables 来解除封禁。
要永久解除您的封禁,您还需要从 /var/db/sshguard/blacklist.db
移除您的 IP 地址。
iptables[编辑 | 编辑源代码]
首先检查您的 IP 是否被 sshguard 阻止:
# iptables --list sshguard --line-numbers --numeric
然后使用下列命令来解禁,使用前一个命令中标识的行号:
# iptables --delete sshguard line-number
nftables[编辑 | 编辑源代码]
从 attackers
中移除您的 IP 地址:
# nft delete element family sshguard attackers { ip_address }
其中 family
可以为 ip
或 ip6
。
日志记录[编辑 | 编辑源代码]
要查看传递给 sshguard 的内容,请检查 /usr/lib/systemd/scripts/sshguard-journalctl
中的脚本和 systemd 服务 sshguard.service
。一个在终端中查看日志的等效命令:
# journalctl -afb -p info SYSLOG_FACILITY=4 SYSLOG_FACILITY=10