Здравствуйте! помогите с вопросом! имеем bind и debain
root@deba:/home/yozz# uname -v
#1 SMP Debian 3.16.7-ckt9-3~deb8u1 (2015-04-24)
root@deba:/home/yozz# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 8.0 (jessie)
Release: 8.0
Codename: jessie
root@deba:/home/yozz#
при запуске fail2bain
root@deba:/home/yozz# service fail2ban status
● fail2ban.service - LSB: Start/stop fail2ban
Loaded: loaded (/etc/init.d/fail2ban)
Active: active (running) since Пн 2015-06-01 19:40:33 MSK; 20h ago
Process: 644 ExecStart=/etc/init.d/fail2ban start (code=exited, status=0/SUCCESS)
CGroup: /system.slice/fail2ban.service
└─1290 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/f...
июн 01 19:40:28 deba fail2ban[644]: Starting authentication failure monitor: fa...''
июн 01 19:40:28 deba fail2ban[644]: WARNING 'ignoreregex' not defined in 'Defin...''
июн 01 19:40:33 deba fail2ban[644]: .
Hint: Some lines were ellipsized, use -l to show in full.
помогите пожалуйста исправить ошибку!!!
в /etc/fai2ban/jail.conf есть строки
#[named-refused-tcp]
#
#enabled = true
#port = domain,953
#protocol = tcp
#filter = named-refused
#logpath = /var/log/named/security.log
[named-refused-udp]
enabled = true
port = domain,953
protocol = udp
filter = named-refused
action = iptables-multiport[name=Named, port="domain,953", protocol=udp]
logpath = /var/log/named/security.log
bantime = 31536000
maxretry = 10
##########
######################################
[named-ddos-tcp]
enabled = true
port = domain,953
protocol = tcp
filter = named-ddos
logpath = /var/log/named/query.log
maxretry = 8
[named-ddos-udp]
enabled = true
port = domain,953
protocol = udp
filter = named-ddos
logpath = /var/log/named/query.log
maxretry = 8
файл лога присутствует
/var/log/named/security.log
May-2015 21:50:54.715 client 45.101.62.132#38734 (yloj.ml.gg): query (cache) 'yloj.ml.gg/A/IN' denied
29-May-2015 21:50:55.342 client 51.8.82.224#46832 (mjov.ml.gg): query (cache) 'mjov.ml.gg/A/IN' denied
29-May-2015 21:50:55.342 client 58.55.90.144#52478 (qdif.ml.gg): query (cache) 'qdif.ml.gg/A/IN' denied
29-May-2015 21:50:55.352 client 106.143.126.65#20833 (qpufodqnyrqx.ml.gg): query (cache) 'qpufodqnyrqx.ml.gg/A/IN' denied
29-May-2015 21:50:55.353 client 111.15.87.56#13144 (sdufwtuzctif.ml.gg): query (cache) 'sdufwtuzctif.ml.gg/A/IN' denied
29-May-2015 21:50:56.319 client 107.61.188.235#37223 (sr.ml.gg): query (cache) 'sr.ml.gg/A/IN' denied
29-May-2015 21:50:56.323 client 47.91.91.141#47171 (afwtefktmzknyx.ml.gg): query (cache) 'afwtefktmzknyx.ml.gg/A/IN' denied
29-May-2015 21:50:57.724 client 85.33.68.76#60558 (onqpezkrkr.yyy.gg): query (cache) 'onqpezkrkr.yyy.gg/A/IN' denied
29-May-2015 21:50:57.846 client 63.181.133.44#664 (utkpwzoryz.yyy.gg): query (cache) 'utkpwzoryz.yyy.gg/A/IN' denied
29-May-2015 21:50:58.089 client 31.246.38.34#25614 (clwlyjozmz.yyy.gg): query (cache) 'clwlyjozmz.yyy.gg/A/IN' denied
root@deba:/home/yozz#
полагаю проблема где то тут..
root@deba:/home/yozz# cat /etc/fail2ban/filter.d/named-refused.conf
# Fail2Ban filter file for named (bind9).
#
# This filter blocks attacks against named (bind9) however it requires special
# configuration on bind.
#
# By default, logging is off with bind9 installation.
#
# You will need something like this in your named.conf to provide proper logging.
#
# logging {
# channel security_file {
# file "/var/log/named/security.log" versions 3 size 30m;
# severity dynamic;
# print-time yes;
# };
# category security {
# security_file;
# };
# };
[Definition]
# Daemon name
_daemon=named
# Shortcuts for easier comprehension of the failregex
__pid_re=(?:\[\d+\])
__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)
# hostname daemon_id spaces
# this can be optional (for instance if we match named native log files)
__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
#failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
# ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
# ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
failregex = ^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$
# DEV Notes:
# Trying to generalize the
# structure which is general to capture general patterns in log
# lines to cover different configurations/distributions
#
# (\.\d+)? is a really ugly catch of the microseconds not captured in the date detector
#
# Author: Yaroslav Halchenko
root@deba:/home/yozz#
