Shaandhada Fail2ban ee OpenVPN Access Server: real_ip iyo jail

Waxaad ka koobiyeysay OpenVPN jail dood bulsho, waxaad dib u bilowday fail2ban, mana jiro cinwaan waligiis la xannibo. Sababtu badanaa waa qaabka log: Access Server ma qoro sadarrada guuldarrada xaqiijinta ee shaandho caadi ah uu filayo. Ka hor inta aanad taaban shaandhada, hubi in diiwaannada jiraan, maxaa yeelay qaab ma la macaamil karo waxa adeeggu waligiis aanu diiwaangelin.

Kani waa habka aan ku raaco Access Server host: hubi qaabka diiwaanka, qor hal muujin xidhan, ku tijaabi logga dhabta ah, ka dib u kala qaybi jail-yada dusha la weerarayo oo hubi in xannibaaddu gaarto firewallka.

Hubi in diiwaanka guuldarrada uu jiro

Access Server wuxuu sadarradiisa qaabaysan ku qoraa /var/log/openvpnas.log, cinwaanka macmiilka waxa uu ku jiraa goob real_ip oo ku dhex jira xardho, ma aha bilowga sadarka syslog. Ka hor inta aanad qorin wax qaab ah, raadi gelitaan guuldareystay oo aad ogtahay inuu dhacay:

grep -i 'LOG ERR' /var/log/openvpnas.log | tail -20

Haddii wax aanay soo bixin, heerka log ayaa ah tuhmanaha xiga. Access Server waxa uu leeyahay shidaha debug ee keydka log ee /usr/local/openvpn_as/etc/as.conf (DEBUG_LOGDB=1), iyo adeegga waa in dib loo bilaabaa ka dib marka la beddelo. U qaado shidahaas sidii dejinta ogaal oo dib loo dhigi doono marka qaabkaagu diyaar noqdo, ma aha sida jaangooyo joogto ah.

Inta aad faylka ku jirto, ogsoonow dusha kee ayaa ku qora. Guuldarrada bogga macmiilka, isdhexgalka maamulka iyo xaqiijinta tunnel-ka waxay ku dhacaan isla fayl laakiin calaamado kala duwan, faahfaahintaasna waxay go'aan ka gaadhaa qaabeynta jail-yada mar dambe.

Ku xidh hal shaandho real_ip

Muujinta u hay cidhiidhi. Shaandho sheegata kasta sadar leh cinwaan IP waxay dadka u xannibi doontaa go'itaanno caadi ah, server mashquul ahna calaamadda keliya waa macaamiisha ka cabanaya in la qufulay sababtoo ah waxay xireen laptop. Sheeg diiwaanka khaladka oo qabo cinwaanka xardhooyinka dhexdooda:

# /etc/fail2ban/filter.d/openvpnaccess.local
[Definition]
failregex = ^ .*LOG ERR.*"real_ip": "<HOST>".*
ignoreregex =

Bannaanka hore ma aha qurxin. Access Server wuxuu diiwaannadiisa gudaha u riixaa, ku xidhnaantaasna waxay ka hortagtaa qaabka inuu sidoo kale sheegto sadarro ay adeegyo aan xiriir la lahayn isla faylka ku qoraan. Haddii diiwaannadaadu ay beddelkeeda bilowgooda ku qaataan shaabadda waqtiga, la jaan-qaad horgalahaas, laakiin ku xidh wax dhab ahaan ku jira diiwaan kasta oo aad rabto inaad sheegato.

Marka aad u baahan tahay saxnaan dushii kasta, sii cidhiidhi iyadoo aad dalbato calaamadda dusha (WEB_CLIENT, WEB_ADMIN ama VPN) isla sadarka. Hal shaandho oo leh saddex qaab ayaa ka fudud in la baaro saddex shaandho oo ku kala duwan hal eray.

Tijaabi muujinta ka hor inta aanad shidin jail

Marnaba ha shidin shaandho aadan ku ordinin logga wax soo saarka. Tijaabada la diiwaangeliyey waxay shaandhada laba jeer dhaqaaqisaa, hal mar si loo rarto iyo hal mar si loo dabaqo, warbixinta sadarrada laga boodayna waa qaybta akhriska mudan:

fail2ban-regex --print-all-missed /var/log/openvpnas.log \
  /etc/fail2ban/filter.d/openvpnaccess.local \
  /etc/fail2ban/filter.d/openvpnaccess.local > missed.txt

Isbarbardhig tirada iswaafaqsanaanta guuldarrada aad ku xaqiijisay tallaabada koowaad. Eber iswaafaqsanaan waxay ka dhigan tahay qaabka waa khalad; iswaafaqsanaan sadarrada aan guuldarrooyin xaqiijin ahayn waxay ka dhigan tahay waa aad u ballaaran yahay. Akhri missed.txt ilaa aad sharaxi karto sadar kasta oo aad dooratay inaadan sheegato.

Tijaabadan ku samee nuqul haddii loggu weyn yahay, oo ku celi ka dib cusboonaysiin kasta oo Access Server ah. Qaabka loggu waa isdhexgalka aad la jaan-qaadaysid, mana aha API deggan.

U kala qaybi jail-yada dusha, ma aha daemon-ka

Hal Access Server wuxuu soo bandhigaa dhawr dusha xaqiijin: isdhexgalka web ee macmiilka iyo maamulka oo ku yaal 943/tcp, iyo tunnel-ka oo ku yaal 1194/udp ama 443/tcp inta badan hirgelinta. Hal jail oo dhammaantood daboola waxay u ogolaataa isku dayga qiyaasta tunnel-ka inuu xannibo cinwaan haddana ah wadadaada maamulka, wuuna qariyaa dusha dhab ahaan la weerarayo. Si dusha kasta jail u gaar ah oo leh dekeddiisa iyo xadkiisa:

# /etc/fail2ban/jail.d/openvpnaccess.local
[openvpnas-web-client]
enabled  = true
port     = 943
protocol = tcp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 3
findtime = 10m
bantime  = 1h
[openvpnas-tunnel]
enabled  = true
port     = 443
protocol = udp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 5
findtime = 10m
bantime  = 1h

Ku bilow tiriyo yar iyo xannibaad gaaban, ka dib kor u qaad markaad daawato toddobaad taraafik dhab ah. Xad deeqsi ah oo ku yaal cinwaan xafiis la wadaago wuxuu ciqaabaa macmiil kasta oo ka dambeeya hal NAT, xannibaad gardarro ah oo ku yaal dusha tunnel-kana waxay go'doomisaa macaamiil sharci ah oo aqoonsigooda kaydsan habeenkii dhacay.

Hubi xannibaadda, backend-ka iyo waxyeellada dhinaca

Ka dib dib u bilaabid, soo saarista xaaladdu waa xaqiijinta ugu degdegga badan ee jail-ku jiro oo tirinayo:

fail2ban-client status
fail2ban-client status openvpnas-tunnel

Ka dib hubi in xannibaaddu gaarto firewallka aad dhab ahaan maamusho, maxaa yeelay jail loo habeeyay backend aan qofna fulin waxba ma ilaaliso. Ficilka iptables cinwaannadu waxay ka soo muuqdaan silsilad lagu magacaabay jail-ka (f2b-openvpnas-tunnel); ficilka nftables waxay ku dhacaan jaantus ku jira shaxda fail2ban u gaar ah. Hubi tan hostkaagu isticmaalo halkii aad ka malayn lahayd.

Laba hubin oo dhinac ah ayaa ka muhiimsan xannibaadda lafteeda. Marka hore, hubi in real_ip yahay cinwaanka macmiilka oo aanu ahayn dheellitirka culayska ama proxy rogan; proxy ka dambeeya xannibaad kastu waxay ku dhacdaa proxy-ga oo wuxuu la tuurayaa adeegga oo dhan. Marka labaad, qor habka xannibaadda looga saaro, maxaa yeelay cinwaanka 02:00 ka gudba xadka badanaa waa injineerka waajibka ah: fail2ban-client set openvpnas-tunnel unbanip 203.0.113.24.

Xusuuso xadka inta aad hagaajinayso. Fail2ban waa xaddidka xawaaraha hal dusha xaqiijin, ma aha lakabka xakamaynta gelitaanka. Ma beddelo MFA, xaddidaadda akoon kasta ama isdhexgalka maamulka inuu ka baxo internetka guud, Access Server-na wuxuu leeyahay dejinta autoban u gaar ah oo mudan in la hubiyo ka hor inta aadan isku ururin laba xaddid xawaare oo isla deked ah.