Banaction ɗaya, hanyoyi biyu: gyara jail na fail2ban-VPN

Babu wani abu a cikin fail2ban da ke jefar da fakiti da kansa: yana kiran wani aiki, kuma wannan aikin ne ke ambata yarjejeniya da tashar. Lokacin da jail ya ba da rahoton ban yayin da daemon ke ci gaba da karɓar shiga, ban ɗin yawanci gaskiya ne kuma ya fi ƙunci fiye da yadda log ɗin ke nunawa. Abokin ciniki da ya sake haɗawa ta wata hanyar ba ya taɓa cin karo da dokar da aka sanya. Kwatanta abin da aikin ya sanya da abin da daemon ke saurare kafin ka canza wani abu, domin hujja tana cikin sarkar wutar bango da aikin ya rubuta, ba cikin jerin jail ba.

Karanta sarkar, ba taƙaitaccen jail ba

fail2ban yana saka sarkarsa gaban sarkar sabis ɗin, don haka jerin ƙididdiga yana nuna daidai abin da yake wanzu. Sarkar da aka ambata da sunan jail, tana ɗauke da doka ɗaya wadda ginshiƙin yarjejeniyarta ya karanta udp, cikakken bayani ne game da shiga TCP da ke ci gaba da zuwa. Ana ƙin fakiti UDP ne kawai daga tushen da aka hana. Sabis ɗin yana da mai saurare TCP, kuma babu wani abu a wannan sarkar da ya taɓa shi.

Kula kuma da tasirin jail makwabci. Mai masauki ɗaya na iya zama kamar an daidaita shi sosai don kawai wata jail ta bayar da rabin da ya ɓace, kuma wannan ginin ɗin ba ya yin komai inda ba a sanya wannan jail ba.

Aikin yana ambata yarjejeniya ɗaya, kuma a nan ne yake karyewa

Kowace banaction samfurin umarnin wutar bango ne, kuma yarjejeniyar tana cikin ɗaya daga cikin maɓallan wuri. Ƙunci yana da niyya, domin jail na yanar gizo da jail na DNS ba su da wani aiki da hana tashoshi iri ɗaya. Yana zama tarko lokacin da sabis ɗin ke saurare a fiye da hanya ɗaya, abin da daemon ɗin VPN ke yi akai-akai. Tacewar na iya lura da shiga da suka gaza daga hanyoyin biyu yayin da aikin ke rufe ɗaya.

Aiwatarwar SoftEther da OpenVPN yawanci suna saurare a UDP da TCP lokaci ɗaya, kuma domin layin log ɗin ya yi kama a kowane hali tacewar tana lura da duka. Rashin daidaiton ba ya bayyana a rahoton jail ɗin kanta. fail2ban ya ƙidaya gazawar daidai sannan ya sanya doka da ta shafi rabin zirga-zirgar da waɗannan gazawar suka zo a kai.

Sa ban ɗin ya rufe duka hanyoyin biyu

Gyara shi a cikin ma'anar jail maimakon; dokokin da aka rubuta da hannu za a rikice su a sake lodawa na gaba. Rubuta ayyuka biyu a fili, ɗaya ga kowace yarjejeniya:

action = %(banaction)s[name=%(__name__)s-tcp, actionname=%(__name__)s-tcp, protocol="tcp", port="%(port)s", chain="%(chain)s"]
         %(banaction)s[name=%(__name__)s-udp, actionname=%(__name__)s-udp, protocol="udp", port="%(port)s", chain="%(chain)s"]

Kada ka yi ƙoƙarin gajarta hakan da protocol = all. Banaction na asali aikin multiport ne, kuma yana faɗaɗawa zuwa -p <protocol> -m multiport --dports <port>; ba tare da yarjejeniyar L4 babu abin da daidaitawar tasha za ta gwada, don haka iptables ya ƙi dokar yayin da jail ke ci gaba da ba da rahoton ban mai nasara. Aikin kowane tasha kamar iptables-allports ko nftables-allports yana karɓar shigarwa ɗaya, amma yana hana kowace tasha a wannan tushen, wanda wani shawara ne daban kuma yana buƙatar hujjarsa. Bar protocol a tcp ko udp kuma ka karɓi shigarwar biyu.

Tabbatar da dokar tana wanzu maimakon dogara da saitin, domin saiti yana kwatanta niyya har sai sarka ta riƙe shi:

iptables -S f2b-vpn-tcp
iptables -S f2b-vpn-udp

Kowace sarka ya kamata ta lissafta doka ɗaya, da -p tcp a farkon da -p udp a na biyu, duka biyun suna ambata adireshin da aka hana. Sannan tabbatar an ƙi wannan adireshin a duka hanyoyin biyu. Ban da ba ka gani a sarkar bege ne, kuma rahoton gaba na wannan alamar zai sake kashe wannan awa ɗin.

Abin da ban har yanzu ke ɓatarwa, da shari'a ta gaba

Abin da aikin ke yi shi ne ƙin tushe ɗaya, kuma kawai a tashoshin da aka jera a ciki. Ba ya yin komai game da mai hari da ke juyar da adireshi, kuma ba zai iya raba na'ura mai ƙiyayya daga hanyar fita ta NAT mai matakin dillali da ɗaruruwan masu amfani ke rabawa ba, inda ban ɗaya ke hana mutanen da ba su yi komai ba. Tabbatar tacewar tana karanta adireshin da abokin ciniki ke da shi da gaske, ba kanun da aka tura ko adireshin wakili ba. Rike taga ɗin ya zama gajere sosai don kuskure ya ƙare da kansa.

Babu ɗaya daga cikin waɗannan da ke ba da hujjar tsallake gyaran yarjejeniya; yana ba da hujjar riƙe ra'ayoyi biyu a lokaci ɗaya. Ban ɗin ya fi ƙunci fiye da yadda taƙaitaccen jail ke nunawa, kuma ko cikakken ban ya fi ƙunci fiye da barazanar. Sanya sarkar wutar bango kusa da jerin masu saurare na daemon kuma kwatanta yarjejeniya da yarjejeniya, domin waɗannan jerin biyu ne ke yanke shawara ko ban zai iya isa sabis ɗin kwata-kwata.

Rike umarnin sake lodawa da jerin sarka a cikin runbook kusa da jail. Mutum na gaba zai buƙaci duka biyun, kuma taƙaitaccen jail ba zai gaya masa ɗaya ba.