分类： 网事-网摘

fail2ban阻止vsftpd暴力攻击失败的对策

Fail2ban is failing to ban VSFTPD bruteforce:

In my case with VSFTPD, with unresolvable DNS names from /var/log/secure:

Scenario: VSFTP configuration is set for PAM authentication, using xferlog in standard format. Fail2ban for vsftpd is watching /var/log/secure

Problem: PAM sends failed login information to /var/log/secure, but the remote server’s IP address has been replaced by a DNS name. Resulting DNS name does not resolve or does not resolve correctly, thus fail2ban is unable to ban the IP address.

Fix: Configure VSFTP for “dual_log_enable=YES”, and have fail2ban watch /var/log/vsftpd.log instead. This log file shows the incoming ip address instead of the DNS name.

[ update: you also need to adde’use_localtime=YES’ to config file of VSFTPD. otherwise, above trick not working. it took me hours to solve the problem. :(]

Source and more tips.

CentOS安装Socks5

1.配置编译环境
2.安装socks5必要的包

yum -y install gcc automake make

yum -y install pam-devel openldap-devel cyrus-sasl-devel

3.下载，编译安装ss5（socks5）

wget http://disk.boluo.org/linux/27001-ss5-3.6.1-1.tar.gz
tar zxvf 27001-ss5-3.6.1-1.tar.gz
cd ss5-3.6.1
./configure
make
make install

可以通过修改 /etc/opt/ss5/ss5.conf 设置密码

# SHost                  SPort           Authentication
#
auth 0.0.0.0/0           –                –
# SHost                  SPort           Authentication

#

auth 0.0.0.0/0           –                  u

在 /etc/opt/ss5/ss5.passwd 中添加 用户名和密码 如：

admin   123456

使用用户验证，重启ss5服务

/etc/init.d/ss5 start