Tester et debuger des filtres Fail2ban
Une commande sympa pour tester facilement des filtres fail2ban
fail2ban-regex
Usage: /usr/bin/fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX] Fail2Ban v0.8.3-SVN reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules. This tools can test regular expressions for "fail2ban". Options: -h, --help display this help message -V, --version print the version Log: string a string representing a log line filename path to a log file (/var/log/auth.log) Regex: string a string representing a 'failregex' filename path to a filter file (filter.d/sshd.conf) IgnoreRegex: string a string representing an 'ignoreregex' filename path to a filter file (filter.d/sshd.conf)
un petit test avec le cas de robots à la recherche de failles à exploiter sur votre serveur web.
la commande à exécuter sera:
fail2ban-regex /var/log/apache2/default-error.log.1 /etc/fail2ban/filter.d/apache-nodnsuse.conf
Et si tout se passe bien elle nous renverra:
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/apache-nodnsuse.conf
Use log file : /var/log/apache2/default-error.log
Results
=======
Failregex
|- Regular expressions:
| [1] [[]client []] File does not exist: /var/empty/.*
|
`- Number of matches:
[1] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Sorry, no match
Look at the above section 'Running tests' which could contain important
information.
xxxxx@xxxxx:~$ fail2ban-regex /var/log/apache2/default-error.log.1 /etc/fail2ban/filter.d/apache-nodnsuse.conf
/usr/share/fail2ban/server/filter.py:431: DeprecationWarning: the md5 module is deprecated; use hashlib instead
import md5
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/apache-nodnsuse.conf
Use log file : /var/log/apache2/default-error.log.1
Results
=======
Failregex
|- Regular expressions:
| [1] [[]client []] File does not exist: /var/empty/.*
|
`- Number of matches:
[1] 20 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
72.55.156.243 (Sun Jun 06 14:18:32 2010)
72.55.156.243 (Sun Jun 06 14:18:32 2010)
72.55.156.243 (Sun Jun 06 14:18:33 2010)
72.55.156.243 (Sun Jun 06 14:18:33 2010)
72.55.156.243 (Sun Jun 06 14:32:00 2010)
72.55.156.243 (Sun Jun 06 14:32:00 2010)
72.55.156.243 (Sun Jun 06 14:32:01 2010)
72.55.156.243 (Sun Jun 06 14:32:01 2010)
72.55.156.243 (Sun Jun 06 14:32:01 2010)
72.55.156.243 (Sun Jun 06 14:32:01 2010)
72.55.156.243 (Sun Jun 06 15:19:52 2010)
72.55.156.243 (Sun Jun 06 15:19:52 2010)
72.55.156.243 (Sun Jun 06 15:19:52 2010)
72.55.156.243 (Sun Jun 06 15:19:53 2010)
72.55.156.243 (Sun Jun 06 15:19:53 2010)
72.55.156.243 (Sun Jun 06 15:19:53 2010)
88.80.10.1 (Sun Jun 06 22:02:12 2010)
202.67.197.61 (Wed Jun 09 08:08:56 2010)
61.153.150.170 (Fri Jun 11 13:39:20 2010)
61.153.150.170 (Fri Jun 11 17:15:17 2010)
Date template hits:
41 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s):
Success, the total number of match is 20
However, look at the above section 'Running tests' which could contain important
information.
3 COMMENTAIRES