Tacewar Fail2ban don OpenVPN Access Server: real_ip da kurkuku

Ka kwafi OpenVPN kurkuku daga wani rubutu na al'umma, ka sake kunna fail2ban, kuma babu wani adireshi da ake hana shi har abada. Dalili kusan koyaushe shine tsarin log: Access Server baya rubuta layukan gazawar tabbatarwa da tacewa na yau da kullum ke tsammani. Kafin ka taba tacewar, tabbatar da cewa bayanan suna nan kwata-kwata, domin tsari ba zai iya dacewa da abin da sabis bai taba rubutawa ba.

Wannan shine runbook da nake bi a kan uwar garken Access Server: tabbatar da siffar bayanin, rubuta magana guda mai angama, gwada ta da ainihin log, sannan raba kurkuku bisa saman da ake kai hari kuma tabbatar cewa hana ya isa ga firewall.

Tabbatar cewa bayanin gazawar yana nan

Access Server yana rubuta nasa layukan tsari zuwa /var/log/openvpnas.log, kuma adireshin abokin ciniki yana cikin filin real_ip a cikin alamomin zance, ba a farkon layin syslog ba. Nemo gazawar shiga da ka san ta faru kafin ka rubuta kowane tsari:

grep -i 'LOG ERR' /var/log/openvpnas.log | tail -20

Idan babu abin da ya bayyana, matakin log shine wanda ake zargi na gaba. Access Server yana da makullin gyara na bayanan log a /usr/local/openvpn_as/etc/as.conf (DEBUG_LOGDB=1), kuma dole ne a sake kunna sabis bayan an canza shi. Dauki wannan makullin a matsayin saitin bincike da za a sake saukar da shi da zarar ka sami tsarinka, ba a matsayin daidaitaccen saiti na dindindin ba.

Yayin da kake cikin fayil din, lura da wadanne saman ne suke rubutu a ciki. Gazawar tashar abokin ciniki, na'urar gudanarwa da tabbatarwar tunnel duk suna sauka a fayil daya da alamomi daban-daban, kuma wannan dalla-dalla ne ke kayyade tsarin kurkuku daga baya.

Kafa tacewa guda kan real_ip

Rike maganar a kunci. Tacewar da ke da'awar kowane layi mai adireshin IP zai hana mutane saboda katsewar yau da kullum, kuma a kan uwar garke mai aiki alamar ita ce kawai masu amfani suna korafin an kulle su saboda sun rufe kwamfutar tafi-da-gidanka. Da'awar bayanin kuskure ka kama adireshin da ke cikin alamomin zance:

# /etc/fail2ban/filter.d/openvpnaccess.local
[Definition]
failregex = ^ .*LOG ERR.*"real_ip": "<HOST>".*
ignoreregex =

Wurin farko ba na ado ba ne. Access Server yana shigar da bayanansa, kuma kafa a kai yana hana tsarin da'awar layukan da wasu sabis da ba su da alaka suke rubutawa a fayil daya. Idan bayananka suna dauke da tambarin lokaci a farko maimakon haka, daidaita wannan prefix din, amma kafa kan wani abu da gaske yake cikin kowane bayanin da kake niyyar da'awarsa.

Lokacin da kake bukatar daidaito bisa kowane saman, kara kuntata ta hanyar bukatar alamar saman (WEB_CLIENT, WEB_ADMIN ko VPN) a cikin layi daya. Tacewa daya mai tsari uku ya fi saukin dubawa fiye da tacewa uku da suka bambanta da kalma daya.

Gwada maganar kafin ka kunna kurkuku

Kada ka taba kunna tacewar da ba ka gudanar da ita a kan log din samarwa ba. Gwajin da aka rubuta yana ba da tacewar sau biyu, daya don lodawa daya kuma don amfani, kuma rahoton layukan da aka rasa shine bangaren da ya cancanci karantawa:

fail2ban-regex --print-all-missed /var/log/openvpnas.log \
  /etc/fail2ban/filter.d/openvpnaccess.local \
  /etc/fail2ban/filter.d/openvpnaccess.local > missed.txt

Kwatanta adadin daidaito da gazawar da ka tabbatar a mataki na farko. Sifili daidaito yana nufin tsarin ba daidai ba ne; daidaito a kan layukan da ba gazawar tabbatarwa ba ne yana nufin ya yi yawa. Karanta missed.txt har sai ka iya bayyana kowane layin da ka zaba ba ka da'awarsa ba.

Yi wannan gwaji a kan kwafi idan log din ya yi girma, kuma sake yin shi bayan kowane habakar Access Server. Tsarin log shine hanyar da kuke daidaitawa da ita, kuma ba API mai tsayawa ba ce.

Raba kurkuku bisa saman, ba bisa daemon ba

Access Server daya yana gabatar da saman tabbatarwa da yawa: hanyoyin yanar gizo na abokin ciniki da na gudanarwa a 943/tcp, da tunnel a 1194/udp ko 443/tcp a yawancin turawa. Kurkuku daya da ke rufe dukansu yana barin kokarin tsammani a tunnel su hana adireshin da shi ma hanyar gudanarwa ce, kuma yana boye wane saman ake kai hari da gaske. Ba kowane saman kurkukunsa tare da tasharsa da kofofinsa:

# /etc/fail2ban/jail.d/openvpnaccess.local
[openvpnas-web-client]
enabled  = true
port     = 943
protocol = tcp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 3
findtime = 10m
bantime  = 1h
[openvpnas-tunnel]
enabled  = true
port     = 443
protocol = udp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 5
findtime = 10m
bantime  = 1h

Fara da kananan kididdiga da dan gajeren hani, sannan ka daga su bayan ka kalli makonni biyu na ainihin zirga-zirga. Kofar karimci a kan adireshin ofis din da aka raba yana azabtar da kowane mai amfani a bayan NAT daya, kuma hani mai tsanani a saman tunnel yana katse abokan ciniki na halal wadanda bayanan shigarsu da aka adana suka kare cikin dare.

Tabbatar da hani, backend da barna

Bayan sake kunnawa, fitarwar matsayi ita ce mafi saurin tabbatar da cewa kurkukun yana nan kuma yana kirga:

fail2ban-client status
fail2ban-client status openvpnas-tunnel

Sannan tabbatar cewa hani ya isa firewall din da kake gudanarwa da gaske, domin kurkukun da aka saita don backend din da babu wanda ke aiwatar da shi baya kare kome. Da aikin iptables adiresoshin suna bayyana a cikin sarkar da aka yi wa suna bayan kurkukun (f2b-openvpnas-tunnel); da aikin nftables suna sauka cikin saiti a cikin teburin fail2ban din kansa. Duba wanda uwar garkenka ke amfani da shi maimakon dauka.

Duba biyu na barna sun fi hani kansa muhimmanci. Na farko, tabbatar cewa real_ip adireshin abokin ciniki ne ba ma'aunin nauyi ko wakili na baya ba; a bayan wakili kowane hani yana sauka kan wakilin kuma yana jawo dukan sabis din tare da shi. Na biyu, rubuta hanyar cire hani, domin adireshin da ya ketare kofa da 02:00 yawanci na injiniyan da ke jiran kira ne: fail2ban-client set openvpnas-tunnel unbanip 203.0.113.24.

Ka tuna da iyaka yayin daidaitawa. Fail2ban mai iyakance sauri ne a kan saman tabbatarwa daya, ba layin kula da shiga ba. Ba ya maye gurbin MFA, kuntatawar kowane asusu, ko ajiye na'urar gudanarwa daga intanet din jama'a, kuma Access Server yana da nasa saitin autoban wadanda ya cancanci dubawa kafin ka tara masu iyakance sauri biyu a kan tasha daya.