Zivler 398 Posted April 30, 2015 Report Share Posted April 30, 2015 Приветствую. Недавно заказал VPS, на котором планирую размещать видеозаписи для своего сайта. То есть, сайт находится на одном хостинге, а видео хранится на VPS. Столкнулся с такой проблемой. Едва-ли загрузил 20 видеозаписей и вставил их на сайт, как на графике нагрузки стал замечать нагрузку на процессор 100%. В списке процессов вижу некую команду whois, которая полностью загружает процессор. После этого лишь перезагрузка сервера решает проблему... на несколько часов. Потом снова появляется whois, и сервер ложится. Что это? В техподдержке написали [цитирую]: fail2ban - добавляет в файрволл тех кто ломится без паролей и потом пытается послать письмо администратору Whois - пытается рассказать Администратору кто и что.. можно отрубить это (ну чтоб не писал письма) Но как отрубить не написали. Ну, и делать за меня, разумеется, это будут только за деньги (платная поддержка - 10 евро). Поэтому прошу помощи у тех, кто разбирается, как исправить проблему. Ниже на картинке я попытался показать, как это выглядит в списке процессов в ISP manager. Заскринить не могу, потому что не имею доступа к серверу, когда этот процесс включается, а после перезагрузки его нет. Видел лишь этот whois единожды вчера, когда он положил процессор не полностью, а загрузил лишь на 92%. P.S. Пользователь - возможно не root, а apache. Точно не помню. Но команда -- точно whois. Link to post Share on other sites
vertas52 143 Posted April 30, 2015 Report Share Posted April 30, 2015 Чёт конфиги с утра не телепатятся, можно содержимое /etc/fail2ban/fail2ban.conf и jail.confПосмотрите, какое значение у dest в /etc/fail2ban/action.d/mail.conf и /etc/fail2ban/action.d/sendmail.conf Link to post Share on other sites
Zivler 398 Posted April 30, 2015 Author Report Share Posted April 30, 2015 содержимое /etc/fail2ban/fail2ban.conf # Fail2Ban main configuration file # # Comments: use '#' for comment lines and ';' (following a space) for inline comments # # Changes: in most of the cases you should not modify this # file, but provide customizations in fail2ban.local file, e.g.: # # [Definition] # loglevel = 4 # [Definition] # Option: loglevel # Notes.: Set the log level output. # 1 = ERROR # 2 = WARN # 3 = INFO # 4 = DEBUG # Values: [ NUM ] Default: 1 # loglevel = 1 # Option: logtarget # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. # Only one log target can be specified. # If you change logtarget from the default value and you are # using logrotate -- also adjust or disable rotation in the # corresponding configuration file # (e.g. /etc/logrotate.d/fail2ban on Debian systems) # Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR # logtarget = SYSLOG # Option: socket # Notes.: Set the socket file. This is used to communicate with the daemon. Do # not remove this file when Fail2ban runs. It will not be possible to # communicate with the server afterwards. # Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.sock # socket = /var/run/fail2ban/fail2ban.sock # Option: pidfile # Notes.: Set the PID file. This is used to store the process ID of the # fail2ban server. # Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.pid # pidfile = /var/run/fail2ban/fail2ban.pid jail.conf # Fail2Ban jail base specification file # # HOW TO ACTIVATE JAILS: # # YOU SHOULD NOT MODIFY THIS FILE. # # It will probably be overwitten or improved in a distribution update. # # Provide customizations in a jail.local file or a jail.d/customisation.local. # For example to change the default bantime for all jails and to enable the # ssh-iptables jail the following (uncommented) would appear in the .local file. # See man 5 jail.conf for details. # # [DEFAULT] # bantime = 3600 # # [ssh-iptables] # enabled = true # Comments: use '#' for comment lines and ';' (following a space) for inline comments # The DEFAULT allows a global definition of the options. They can be overridden # in each jail afterwards. [DEFAULT] # "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not # ban a host which matches an address in this list. Several addresses can be # defined using space separator. ignoreip = 127.0.0.1/8 # "bantime" is the number of seconds that a host is banned. bantime = 600 # A host is banned if it has generated "maxretry" during the last "findtime" # seconds. findtime = 600 # "maxretry" is the number of failures before a host get banned. maxretry = 3 # "backend" specifies the backend used to get files modification. # Available options are "pyinotify", "gamin", "polling" and "auto". # This option can be overridden in each jail as well. # # pyinotify: requires pyinotify (a file alteration monitor) to be installed. # If pyinotify is not installed, Fail2ban will use auto. # gamin: requires Gamin (a file alteration monitor) to be installed. # If Gamin is not installed, Fail2ban will use auto. # polling: uses a polling algorithm which does not require external libraries. # auto: will try to use the following backends, in order: # pyinotify, gamin, polling. backend = auto # "usedns" specifies if jails should trust hostnames in logs, # warn when DNS lookups are performed, or ignore all hostnames in logs # # yes: if a hostname is encountered, a DNS lookup will be performed. # warn: if a hostname is encountered, a DNS lookup will be performed, # but it will be logged as a warning. # no: if a hostname is encountered, will not be used for banning, # but it will be logged as info. usedns = warn # This jail corresponds to the standard configuration in Fail2ban. # The mail-whois action send a notification e-mail with a whois request # in the body. [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com, sendername="Fail2Ban"] logpath = /var/log/secure maxretry = 5 [proftpd-iptables] enabled = false filter = proftpd action = iptables[name=ProFTPD, port=ftp, protocol=tcp] sendmail-whois[name=ProFTPD, dest=you@example.com] logpath = /var/log/proftpd/proftpd.log maxretry = 6 # This jail forces the backend to "polling". [sasl-iptables] enabled = false filter = postfix-sasl backend = polling action = iptables[name=sasl, port=smtp, protocol=tcp] sendmail-whois[name=sasl, dest=you@example.com] logpath = /var/log/mail.log # ASSP SMTP Proxy Jail [assp] enabled = false filter = assp action = iptables-multiport[name=assp,port="25,465,587"] logpath = /root/path/to/assp/logs/maillog.txt # Here we use TCP-Wrappers instead of Netfilter/Iptables. "ignoreregex" is # used to avoid banning the user "myuser". [ssh-tcpwrapper] enabled = false filter = sshd action = hostsdeny[daemon_list=sshd] sendmail-whois[name=SSH, dest=you@example.com] ignoreregex = for myuser from logpath = /var/log/sshd.log # Here we use blackhole routes for not requiring any additional kernel support # to store large volumes of banned IPs [ssh-route] enabled = false filter = sshd action = route logpath = /var/log/sshd.log maxretry = 5 # Here we use a combination of Netfilter/Iptables and IPsets # for storing large volumes of banned IPs # # IPset comes in two versions. See ipset -V for which one to use # requires the ipset package and kernel support. [ssh-iptables-ipset4] enabled = false filter = sshd action = iptables-ipset-proto4[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/sshd.log maxretry = 5 [ssh-iptables-ipset6] enabled = false filter = sshd action = iptables-ipset-proto6[name=SSH, port=ssh, protocol=tcp, bantime=600] logpath = /var/log/sshd.log maxretry = 5 # bsd-ipfw is ipfw used by BSD. It uses ipfw tables. # table number must be unique. # # This will create a deny rule for that table ONLY if a rule # for the table doesn't ready exist. # [ssh-bsd-ipfw] enabled = false filter = sshd action = bsd-ipfw[port=ssh,table=1] logpath = /var/log/auth.log maxretry = 5 # This jail demonstrates the use of wildcards in "logpath". # Moreover, it is possible to give other files on a new line. [apache-tcpwrapper] enabled = false filter = apache-auth action = hostsdeny logpath = /var/log/apache*/*error.log /home/www/myhomepage/error.log maxretry = 6 [nginx-http-auth] enabled = false filter = nginx-http-auth action = iptables-multiport[name=nginx-http-auth,port="80,443"] logpath = /var/log/nginx/error.log # The hosts.deny path can be defined with the "file" argument if it is # not in /etc. [postfix-tcpwrapper] enabled = false filter = postfix action = hostsdeny[file=/not/a/standard/path/hosts.deny] sendmail[name=Postfix, dest=you@example.com] logpath = /var/log/postfix.log bantime = 300 # Do not ban anybody. Just report information about the remote host. # A notification is sent at most every 600 seconds (bantime). [vsftpd-notification] enabled = false filter = vsftpd action = sendmail-whois[name=VSFTPD, dest=you@example.com] logpath = /var/log/vsftpd.log maxretry = 5 bantime = 1800 # Same as above but with banning the IP address. [vsftpd-iptables] enabled = false filter = vsftpd action = iptables[name=VSFTPD, port=ftp, protocol=tcp] sendmail-whois[name=VSFTPD, dest=you@example.com] logpath = /var/log/vsftpd.log maxretry = 5 bantime = 1800 # Ban hosts which agent identifies spammer robots crawling the web # for email addresses. The mail outputs are buffered. [apache-badbots] enabled = false filter = apache-badbots action = iptables-multiport[name=BadBots, port="http,https"] sendmail-buffered[name=BadBots, lines=5, dest=you@example.com] logpath = /var/www/*/logs/access_log bantime = 172800 maxretry = 1 # Use shorewall instead of iptables. [apache-shorewall] enabled = false filter = apache-noscript action = shorewall sendmail[name=Postfix, dest=you@example.com] logpath = /var/log/apache2/error_log # Monitor roundcube server [roundcube-iptables] enabled = false filter = roundcube-auth action = iptables-multiport[name=RoundCube, port="http,https"] logpath = /var/log/roundcube/userlogins # Monitor SOGo groupware server [sogo-iptables] enabled = false filter = sogo-auth # without proxy this would be: # port = 20000 action = iptables-multiport[name=SOGo, port="http,https"] logpath = /var/log/sogo/sogo.log # Ban attackers that try to use PHP's URL-fopen() functionality # through GET/POST variables. - Experimental, with more than a year # of usage in production environments. [php-url-fopen] enabled = false action = iptables-multiport[name=php-url-open, port="http,https"] filter = php-url-fopen logpath = /var/www/*/logs/access_log maxretry = 1 [suhosin] enabled = false filter = suhosin action = iptables-multiport[name=suhosin, port="http,https"] # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2 [lighttpd-auth] enabled = false filter = lighttpd-auth action = iptables-multiport[name=lighttpd-auth, port="http,https"] # adapt the following two items as needed logpath = /var/log/lighttpd/error.log maxretry = 2 # This jail uses ipfw, the standard firewall on FreeBSD. The "ignoreip" # option is overridden in this jail. Moreover, the action "mail-whois" defines # the variable "name" which contains a comma using "". The characters '' are # valid too. [ssh-ipfw] enabled = false filter = sshd action = ipfw[localhost=192.168.0.1] sendmail-whois[name="SSH,IPFW", dest=you@example.com] logpath = /var/log/auth.log ignoreip = 168.192.0.1 # !!! WARNING !!! # Since UDP is connection-less protocol, spoofing of IP and imitation # of illegal actions is way too simple. Thus enabling of this filter # might provide an easy way for implementing a DoS against a chosen # victim. See # http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html # Please DO NOT USE this jail unless you know what you are doing. # # IMPORTANT: see filter.d/named-refused for instructions to enable logging # This jail blocks UDP traffic for DNS requests. # [named-refused-udp] # # enabled = false # filter = named-refused # action = iptables-multiport[name=Named, port="domain,953", protocol=udp] # sendmail-whois[name=Named, dest=you@example.com] # logpath = /var/log/named/security.log # ignoreip = 168.192.0.1 # IMPORTANT: see filter.d/named-refused for instructions to enable logging # This jail blocks TCP traffic for DNS requests. [named-refused-tcp] enabled = false filter = named-refused action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] sendmail-whois[name=Named, dest=you@example.com] logpath = /var/log/named/security.log ignoreip = 168.192.0.1 [asterisk] enabled = false filter = asterisk action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath = /var/log/asterisk/messages maxretry = 10 # Historical support (before https://github.com/fail2ban/fail2ban/issues/37 was fixed ) # use [asterisk] for new jails [asterisk-tcp] enabled = false filter = asterisk action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath = /var/log/asterisk/messages maxretry = 10 # Historical support (before https://github.com/fail2ban/fail2ban/issues/37 was fixed ) # use [asterisk] for new jails [asterisk-udp] enabled = false filter = asterisk action = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath = /var/log/asterisk/messages maxretry = 10 [mysqld-iptables] enabled = false filter = mysqld-auth action = iptables[name=mysql, port=3306, protocol=tcp] sendmail-whois[name=MySQL, dest=root, sender=fail2ban@example.com] logpath = /var/log/mysqld.log maxretry = 5 [mysqld-syslog-iptables] enabled = false filter = mysqld-auth action = iptables[name=mysql, port=3306, protocol=tcp] logpath = /var/log/daemon.log maxretry = 5 # Jail for more extended banning of persistent abusers # !!! WARNING !!! # Make sure that your loglevel specified in fail2ban.conf/.local # is not at DEBUG level -- which might then cause fail2ban to fall into # an infinite loop constantly feeding itself with non-informative lines [recidive] enabled = false filter = recidive logpath = /var/log/fail2ban.log action = iptables-allports[name=recidive] sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log] bantime = 604800 ; 1 week findtime = 86400 ; 1 day maxretry = 5 # PF is a BSD based firewall [ssh-pf] enabled = false filter = sshd action = pf logpath = /var/log/sshd.log maxretry = 5 [3proxy] enabled = false filter = 3proxy action = iptables[name=3proxy, port=3128, protocol=tcp] logpath = /var/log/3proxy.log [exim] enabled = false filter = exim action = iptables-multiport[name=exim,port="25,465,587"] logpath = /var/log/exim/mainlog [exim-spam] enabled = false filter = exim-spam action = iptables-multiport[name=exim-spam,port="25,465,587"] logpath = /var/log/exim/mainlog [perdition] enabled = false filter = perdition action = iptables-multiport[name=perdition,port="110,143,993,995"] logpath = /var/log/maillog [uwimap-auth] enabled = false filter = uwimap-auth action = iptables-multiport[name=uwimap-auth,port="110,143,993,995"] logpath = /var/log/maillog [osx-ssh-ipfw] enabled = false filter = sshd action = osx-ipfw logpath = /var/log/secure.log maxretry = 5 [ssh-apf] enabled = false filter = sshd action = apf[name=SSH] logpath = /var/log/secure maxretry = 5 [osx-ssh-afctl] enabled = false filter = sshd action = osx-afctl[bantime=600] logpath = /var/log/secure.log maxretry = 5 [webmin-auth] enabled = false filter = webmin-auth action = iptables-multiport[name=webmin,port="10000"] logpath = /var/log/auth.log # dovecot defaults to logging to the mail syslog facility # but can be set by syslog_facility in the dovecot configuration. [dovecot] enabled = false filter = dovecot action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps,submission,smtps,sieve", protocol=tcp] logpath = /var/log/mail.log [dovecot-auth] enabled = false filter = dovecot action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps,submission,smtps,sieve", protocol=tcp] logpath = /var/log/secure [selinux-ssh] enabled = false filter = selinux-ssh action = iptables[name=SELINUX-SSH, port=ssh, protocol=tcp] logpath = /var/log/audit/audit.log maxretry = 5 Link to post Share on other sites
vertas52 143 Posted April 30, 2015 Report Share Posted April 30, 2015 [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com, sendername=Fail2Ban] logpath = /var/log/secure maxretry = 5 Закоментируйте action [ssh-iptables] enabled = true filter = sshd # action = iptables[name=SSH, port=ssh, protocol=tcp] # sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com, sendername=Fail2Ban] logpath = /var/log/secure maxretry = 5 Link to post Share on other sites
Zivler 398 Posted April 30, 2015 Author Report Share Posted April 30, 2015 Сделал. Спасибо. Теперь буду мониторить, будет ли снова перегружаться проц. Буду отписываться тут. Link to post Share on other sites
vertas52 143 Posted April 30, 2015 Report Share Posted April 30, 2015 Сделал. Спасибо. Теперь буду мониторить, будет ли снова перегружаться проц. Буду отписываться тут. демона не забыли перезапустить? Link to post Share on other sites
Zivler 398 Posted April 30, 2015 Author Report Share Posted April 30, 2015 демона не забыли перезапустить? Не силён в VDS-терминологии, это моё первое знакомство (до этого потребности не было). Что значит "перезапустить демона"? Я перезагрузил весь VDS. Link to post Share on other sites
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now