Isihlungi se-Fail2ban se-OpenVPN Access Server: i-real_ip ne-jail

I-Access Server ibhala ifomethi yayo yelogi, ngakho izihlungi ezijwayelekile azitholi lutho. Gxila ku-real_ip, hlukanisa ama-jail ngokwendawo futhi uhlole ukuthi ikheli akulona iphroksi.

Ukopishe OpenVPN jail kusukela kokuphostwe umphakathi, waqala kabusha i-fail2ban, futhi akukho kheli elivinjwayo. Isizathu cishe njalo ifomethi yelogi: i-Access Server ayibhali imigqa yokwehluleka kokuqinisekisa umuntu ihlungi elijwayelekile eliyilindelayo. Ngaphambi kokuthinta isihlungi, qinisekisa ukuthi amarekhodi akhona, ngoba iphethini ayikwazi ukufanisa lokho okungekho okuqoshwe isevisi.

Le yinqubo engiyilandela kumpheki we-Access Server: qinisekisa isimo serekhodi, bhala isisho esisodwa esigxilile, sihlole kulogi yangempela, bese uhlukanisa ama-jail ngokwendawo ehlaselwayo futhi uqinisekise ukuthi ukuvinjelwa kufinyelela ku-firewall.

Qinisekisa ukuthi irekhodi lokwehluleka likhona

I-Access Server ibhala imigqa yayo ehlelekile ku-/var/log/openvpnas.log, futhi ikheli lekhasimende likusikhundleni real_ip ngaphakathi kwezimpawu zokucaphuna, hhayi ekuqaleni komugqa we-syslog. Ngaphambi kokubhala noma iyiphi iphethini, sesha ukungena okwehlulekile owaziyo ukuthi kwenzekile:

grep -i 'LOG ERR' /var/log/openvpnas.log | tail -20

Uma kungabonakali lutho, izinga lelogi liwumsolwa olandelayo. I-Access Server ineswishi yokulungisa isizindalwazi selogi ku-/usr/local/openvpn_as/etc/as.conf (DEBUG_LOGDB=1), futhi isevisi kufanele iqalwe kabusha ngemva kokuyishintsha. Thatha leyo swishi njengesilungiselelo sokuxilonga okufanele sehliswe futhi uma iphethini yakho isilungile, hhayi njengokuhlelelwa okungunaphakade.

Ngesikhathi usefayelini, qaphela ukuthi yiziphi izindawo ezibhala kuyo. Ukwehluleka kwengosi yekhasimende, kwesixhumi sokulawula kanye nokuqinisekisa umuntu kwethuneli kuwela efayelini elilodwa ngezimpawu ezihlukene, futhi leyo ncazelo inquma ukuhlelwa kwama-jail kamuva.

Gxila isihlungi esisodwa ku-real_ip

Gcina isisho sincane. Isihlungi esifuna wonke umugqa okukheli le-IP uzovimbela abantu ngenxa yokunqamuka okujwayelekile, futhi kuseva ematasa uphawu okuwukuphela kwalo ukuthi abasebenzisi bakhala ngokuthi bavalelwe ngaphandle ngenxa yokuvala i-laptop. Funa irekhodi lephutha bese ubamba ikheli elingaphakathi kwezimpawu zokucaphuna:

# /etc/fail2ban/filter.d/openvpnaccess.local
[Definition]
failregex = ^ .*LOG ERR.*"real_ip": "<HOST>".*
ignoreregex =

Isikhala sokuqala asiwona umhlobiso. I-Access Server ihlehlisa amarekhodi ayo, futhi ukugxila kuso kuvimbela iphethini ukuthi ingafuni nemigqa ebhalwa ezinye izinsiza ezingahlobene efayelini elifanayo. Uma amarekhodi akho enesigxivizo sesikhathi ekuqaleni esikhundleni salokho, fanisa leso siqalo, kodwa gxila entweni ekhona ngempela kuyo yonke irekhodi ohlose ukuyifuna.

Uma udinga ukunemba ngokwendawo, nciphisa ngokwengeziwe ngokufuna uphawu lwendawo (WEB_CLIENT, WEB_ADMIN noma VPN) emugqeni ofanayo. Isihlungi esisodwa esinamaphethini amathathu silula ukuyihlola kunezihlungi ezintathu ezihluke ngakelinye igama.

Hlola isisho ngaphambi kokunika amandla i-jail

Ungalokothi unike amandla isihlungi ongakaze usisebenzise kulogi yokukhiqiza. Ukuhlolwa okubhaliwe kudlulisa isihlungi kabili, kanye ukulayisha kanye nokusebenzisa, futhi umbiko wemigqa eyephukile yiwo ingxenye efanele ifundwe:

fail2ban-regex --print-all-missed /var/log/openvpnas.log \
  /etc/fail2ban/filter.d/openvpnaccess.local \
  /etc/fail2ban/filter.d/openvpnaccess.local > missed.txt

Qhathanisa inani lokufanisa nokwehluleka okuqinisekise kusigaba sokuqala. Ukungafanisi neze kusho ukuthi iphethini ayilungile; ukufanisa emugqeni okungekhona ukwehluleka kokuqinisekisa umuntu kusho ukuthi ibanzi kakhulu. Funda i-missed.txt uze ukwazi ukuchaza wonke umugqa oqokile ukuthi ungawufuni.

Yenza lokhu kuhlolwa kwikhophi uma ilogi inkulu, futhi ukuphindele ngemva kwanoma yikuphi ukuthuthukiswa kwe-Access Server. Ifomethi yelogi iyisixhumi oqhathanisa nayo, futhi akuyona i-API ezinzile.

Hlukanisa ama-jail ngokwendawo, hhayi nge-daemon

I-Access Server eyodwa yethula izindawo eziningi zokuqinisekisa umuntu: izixhumi zewebhu zekhasimende nezokulawula ku-943/tcp, kanye nethuneli ku-1194/udp noma 443/tcp ekusetshenzisweni okuningi. I-jail eyodwa ehlanganisa zonke ivumela imizamo yokuqagela ethuneli ukuvimba ikheli eliyindlela yakho yokulawula futhi, futhi ifihla ukuthi iyiphi indawo ehlaselwayo ngempela. Nika indawo ngayinye i-jail yayo enombobo nemicikilisho yayo:

# /etc/fail2ban/jail.d/openvpnaccess.local
[openvpnas-web-client]
enabled  = true
port     = 943
protocol = tcp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 3
findtime = 10m
bantime  = 1h
[openvpnas-tunnel]
enabled  = true
port     = 443
protocol = udp
filter   = openvpnaccess
logpath  = /var/log/openvpnas.log
maxretry = 5
findtime = 10m
bantime  = 1h

Qala ngezibali ezincane nokuvinjwa okufushane, bese uzikhuphula uma usubuke iviki lokuhamba kwangempela. Umkhawulo okhululekile ekhelini lehhovisi elabelwana ngalo ujezisa wonke umsebenzisi ongemuva kwe-NAT eyodwa, futhi ukuvinjwa okunamandla endaweni yethuneli kunqamula amakhasimende asemthethweni izifakazelo zawo ezigciniwe eziphelelwe yisikhathi ebusuku.

Qinisekisa ukuvinjwa, i-backend kanye nomonakalo oseceleni

Ngemva kokuqalwa kabusha, okukhishwayo kwesimo kuwukuqinisekisa okusheshayo ukuthi i-jail ikhona futhi iyabala:

fail2ban-client status
fail2ban-client status openvpnas-tunnel

Bese uqinisekisa ukuthi ukuvinjwa kufinyelela ku-firewall oyisebenzisayo ngempela, ngoba i-jail ehlelwe i-backend okungekho muntu oyiphogelelayo ayivikeli lutho. Ngomsebenzi we-iptables amakheli avela kuchungechunge oluqanjwe nge-jail (f2b-openvpnas-tunnel); ngomsebenzi we-nftables awela kusethi etafuleni le-fail2ban ngokwayo. Hlola lelo umpheki wakho alisebenzisayo esikhundleni sokucabanga.

Ukuhlolwa okubili oseceleni kubaluleke kakhulu kunokuvinjwa uqobo. Okokuqala, qinisekisa ukuthi i-real_ip iyikheli lekhasimende hhayi isilinganisi somthwalo noma iphroksi ephambene; ngemuva kwephroksi konke ukuvinjwa kuwela kuphroksi futhi kudonse yonke insiza kanye nayo. Okwesibili, bhala inqubo yokuvula ukuvinjwa, ngoba ikheli elidlula umkhawulo ngo-02:00 ngokuvamile elikanjiniyela osebenza ngamashifu: fail2ban-client set openvpnas-tunnel unbanip 203.0.113.24.

Khumbula umngcele ngesikhathi ulungisa. I-Fail2ban isilinganisi sesivinini endaweni eyodwa yokuqinisekisa umuntu, hhayi isendlalelo sokulawula ukufinyelela. Ayithathi indawo ye-MFA, imikhawulo yekhilomitha ngalinye noma yokugcina isixhumi sokulawula ngaphandle kwe-inthanethi yomphakathi, futhi i-Access Server inezilungiselelo zayo ze-autoban okufanele zihlolwe ngaphambi kokunqwabelanisa izilinganisi zevinini ezimbili embotsheni eyodwa.

Izihloko ezihlobene