Debian 10 VPS上Fail2Ban工作状态验证及封禁后仍有登录尝试的技术问询

各位大佬好，我有一台运行在VPS上的Debian 10服务器，目前只安装了tinyproxy（HTTP代理）和fail2ban两款软件。

我现在有点懵，搞不清楚Fail2Ban到底有没有正常生效——也就是它有没有按照预期，通过IPTables规则封禁恶意IP。举个实际的例子：

• 我的auth.log里，IP 192.241.141.43几乎每分钟都在尝试登录服务器
• fail2ban.log里明确记录这个IP已经被封禁了
• 查看Iptables规则，也能看到192.241.141.43确实在封禁列表里

我本来以为IP被封禁后，恶意用户根本没法发起登录请求，但现在看起来他们还是能不断尝试。所以想请教两个问题：

1. 从目前的日志和配置来看，Fail2Ban是不是真的在正常工作？
2. 为什么已经被封禁的恶意IP还能发起登录尝试？

麻烦各位帮忙看看，万分感谢！

相关日志与配置信息 #

Nmap端口扫描结果 #

# Nmap 7.80 scan initiated Sat Jan 27 15:25:04 2024 as: nmap -sS -oG out.txt

107.174.156.124

Host: 107.174.156.124 (107-174-156-124-host.colocrossing.com)

Status: Up

Host: 107.174.156.124 (107-174-156-124-host.colocrossing.com)

Ports:
139/filtered/tcp//netbios-ssn///,
445/filtered/tcp//microsoft-ds///,
8888/open/tcp//sun-answerbook///

Ignored State: closed (997)

# Nmap done at Sat Jan 27 15:25:06 2024
-- 1 IP address (1 host up) scanned in 2.20 seconds

Fail2Ban jail.local配置 #

#
# JAILS
#

# SSH servers
#
[sshd]
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
enabled = true
mode = aggressive
port = 63xxx
filter = sshd
logpath = /var/log/auth.log
bantime = 2000000
findtime = 7200
maxretry = 2
backend = %(sshd_backend)s
action = iptables-multiport[name=sshd, port="ssh", protocol=tcp]

Fail2Ban fail2ban.local配置 #

# Options: dbpurgeage
# Notes.: Sets age at which bans should be purged from the database
# Values: [ SECONDS ] Default: 86400 (24hours)
dbpurgeage = 2100000

Auth.log日志样本 #

下面是192.241.141.43的登录尝试记录，这类日志几乎每分钟都会出现：

Jan 27 15:54:55 racknerd-64d010 sshd[2232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.241.141.43  user=root
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Failed password for root from 192.241.141.43 port 54798 ssh2
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Received disconnect from 192.241.141.43 port 54798:11: Bye Bye [preauth]
Jan 27 15:54:57 racknerd-64d010 sshd[2232]: Disconnected from authenticating user root 192.241.141.43 port 54798 [preauth]

Fail2Ban.log日志样本 #

这里可以看到系统已经提示192.241.141.43处于已封禁状态：

2024-01-27 15:55:50,928 fail2ban.actions        [29992]: WARNING [sshd] 82.102.12.130 already banned
2024-01-27 15:55:50,929 fail2ban.actions        [29992]: WARNING [sshd] 192.241.141.43 already banned
2024-01-27 15:55:50,929 fail2ban.actions        [29992]: WARNING [sshd] 159.75.161.40 already banned

Iptables扫描结果 #

查看Iptables规则，192.241.141.43确实在封禁列表中：

0     0 REJECT     all  --  *      *       61.231.64.170        0.0.0.0/0            reject-with icmp-port-unreachable
0     0 REJECT     all  --  *      *       192.241.141.43       0.0.0.0/0            reject-with icmp-port-unreachable
0     0 REJECT     all  --  *      *       104.250.34.177       0.0.0.0/0            reject-with icmp-port-unreachable

备注：内容来源于stack exchange，提问作者xstack