Iptables-Fail2ban处理bind 非法***
?早上發(fā)現(xiàn)DNS流量有些異常,查了query.log日志如下:
9-Apr-2013 13:49:33.418 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.475 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.487 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.516 queries: info: client 70.39.93.72#49940: view other_user: query: isc.org IN ANY +ED (163.177.24.74)
09-Apr-2013 13:49:33.557 queries: info: client 185.12.119.16#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.588 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.657 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.663 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.758 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.802 queries: info: client 70.39.93.72#49940: view other_user: query: isc.org IN ANY +ED (163.177.24.74)
09-Apr-2013 13:49:33.824 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
09-Apr-2013 13:49:33.848 queries: info: client 199.19.213.88#25345: view other_user: query: isc.org IN ANY +ED (183.60.126.74)
處理方法:
添加iptables規(guī)則(需要添加connlimit模塊),限制單IP并發(fā)請求數(shù):
一、首先檢查bind本身安全,利用bind添加acl,同時限制遞歸查詢,添加黑名單。
全局設(shè)置變更:
allow-query { mynetwork; }; ?#這里設(shè)置自己網(wǎng)絡(luò),zone里面可以設(shè)置成any
allow-recursion { mynetwork; }; ? #針對遞歸進(jìn)行處理
#allow-query-cache {mynetwork;}; ?#針對查詢緩存處理
? ? ? ? version ? ? ? ? ? ? ? ? ? ? "hello babay"; #隱藏版本
? ? ? ??edns-udp-size 1024; ?# 設(shè)置udp消息大小,單位字節(jié)
? ? ? ? max-udp-size 4096; #設(shè)置最大udp消息大小,單位字節(jié)
? ? blackhole {blackhats;};#設(shè)置黑名單
二、利用fail2ban過濾日志,調(diào)用iptables限制指定ip地址
下載fail2ban:?https://github.com/fail2ban
或http://sourceforge.net/projects/fail2ban/
我這里用的是fail2ban-0.8.4,解壓包后
執(zhí)行python setup.py install安裝完成。
/etc/fail2ban/jail.conf ? ? 過濾相關(guān)服務(wù)配置文件
/etc/fail2ban/fail2ban.conf ? 主配置文件,設(shè)置sock和日志文件
/etc/fail2ban/filter.d/ ? 相應(yīng)服務(wù)的過濾規(guī)則文件路徑
/etc/fail2ban/action.d/ ?相應(yīng)服務(wù)的動作配置文件路徑
jail.conf添加指定服務(wù)參數(shù):
添加過濾規(guī)則:named-refused.conf
執(zhí)行動作文件#egrep -v '^#|^$' /etc/fail2ban/action.d/iptables-multiport.conf?
fail2ban-client ?start或fail2ban-server 啟動服務(wù)
我們看下效果吧,已經(jīng)有拉黑的IP了。
#fail2ban-client ?status named-ddos-tcp
Status for the jail: named-ddos-tcp
|- filter
| ?|- File list: /opt/soft/bind/log/query.log?
| ?|- Currently failed: 5
| ?`- Total failed: 299
`- action
? ?|- Currently banned: 5
? ?| ?`- IP list: 107.20.206.69 94.75.243.137 61.147.112.29 178.32.244.170 61.147.112.32 ? (國外的IP已經(jīng)拉黑啦)
? ?`- Total banned: 15
Chain OUTPUT (policy ACCEPT 163M packets, 203G bytes)
?pkts bytes target ? ? prot opt in ? ? out ? ? source ? ? ? ? ? ? ? destination ? ? ? ??
Iptables的也已經(jīng)自動添加了
Chain fail2ban-Named (2 references)
?pkts bytes target ? ? prot opt in ? ? out ? ? source ? ? ? ? ? ? ? destination ? ? ? ??
? ? 9 ? 576 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 174.142.207.122 ? ? ?0.0.0.0/0 ? ? ? ? ??
? 241 15424 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 61.147.120.25 ? ? ? ?0.0.0.0/0 ? ? ? ? ??
? ?27 ?1728 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 61.147.112.32 ? ? ? ?0.0.0.0/0 ? ? ? ? ??
? 115 ?7360 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 178.32.244.170 ? ? ? 0.0.0.0/0 ? ? ? ? ??
? 119 ?7616 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 61.147.112.29 ? ? ? ?0.0.0.0/0 ? ? ? ? ??
? ?51 ?3264 DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 94.75.243.137 ? ? ? ?0.0.0.0/0 ? ? ? ? ??
?2206 ?141K DROP ? ? ? all ?-- ?* ? ? ?* ? ? ? 107.20.206.69 ? ? ? ?0.0.0.0/0 ? ? ? ? ??
12829 ?833K RETURN ? ? all ?-- ?* ? ? ?* ? ? ? 0.0.0.0/0 ? ? ? ? ? ?0.0.0.0/0 ? ? ? ? ??
? ? 0 ? ? 0 RETURN ? ? all ?-- ?* ? ? ?* ? ? ? 0.0.0.0/0 ? ? ? ? ? ?0.0.0.0/0 ? ?
查閱資料地址:
http://ftp.isc.org/isc/bind9/cur/9.8/doc/arm/Bv9ARM.html
http://www.isc.org/software/bind/documentation
http://www.minihowto.eu/protectio-against-isc-org-any-attack-dns-attack-isc-org-any-query
http://www.bergercity.de/tag/bind/
http://sourceforge.net/projects/fail2ban/
http://www.fail2ban.org/wiki/index.php/HOWTO_fail2ban_0.7.x#Iptables_action_setup
?
?
轉(zhuǎn)載于:https://blog.51cto.com/5iqiong/1175015
總結(jié)
以上是生活随笔為你收集整理的Iptables-Fail2ban处理bind 非法***的全部內(nèi)容,希望文章能夠幫你解決所遇到的問題。
- 上一篇: 梦到日本鬼子逮住怎么回事
- 下一篇: .net 预编译 提示中导入的类型 冲突