渔人小径 · 唯逻辑不破
昨日午后慢跑，点开一张「猛士 Vol.01」。典型的80年代合成器音效混在一起，不可谓不嘈杂，而彼时我秒退30年的情绪，因与目之所及的巨大反差，默默调整十多秒才逐渐平静下来。
生于小镇做题者的年代，物质匮乏，照片平均每3年能拍上一张已然很知足，遑论视频。然数十年如白驹过隙，故地重游，无论所到何处，不消说，尽皆物是人非，不复当年贫苦朴实之窘态。
「猛士」、「荷东」，一声前奏想起，动次打次。那台靠小学考试成绩换得的价值不菲的国产单放，插着音质不能说全损但也有限的头戴耳机，再配上玻璃下压着课程表和一些票据的方台，台面再摆放上书籍、笔记、作业和文具…… 恰似《少林足球》里星爷闭幕仰面：“我感觉到，全部都回来了”。
家里那位问我，迪高这么吵，你确定小学生能听这个写作业？
嘿嘿。
本文：配置fail2ban实现PVE web登录入口的暴破防护。
On a Proxmox VE host accessible to the public internet, using fail2ban to protect SSH away from malicious traffic is fairly common, but what about the web management portal?
I’ve got a blog post talking about that, which seems promising. However it’s already version 8.x, I’m learning something about journald, and so far it’s good to me – I don’t want reinstall the rsyslog just for this, then how can I get it work? Let’s find out.
Daily routine, check the system journal with something like journalctl --since='yesterday' .
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
Jan 09 16:29:23 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:29:26 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:31:33 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:31:35 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:33:44 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:33:45 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:35:54 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:35:56 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:38:04 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:38:05 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:40:14 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:40:16 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:42:25 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:42:27 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:44:35 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:44:37 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:46:46 pve-host IPCC.xs[3863529]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:46:48 pve-host pvedaemon[3863529]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure Jan 09 16:48:56 pve-host IPCC.xs[3998275]: pam_unix(proxmox-ve-auth:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=::ffff:162.19.61.xxx user=root Jan 09 16:48:58 pve-host pvedaemon[3998275]: authentication failure; rhost=::ffff:162.19.61.xxx user=root@pam msg=Authentication failure |
The filter rule of /etc/fail2ban/filter.d/pvedaemon.conf .
|
1 2 3 4 5 6 7 |
[DEFAULT] _daemon = pvedaemon [Definition] failregex = pvedaemon\[.*authentication failure; rhost=<HOST> user=.* msg=.* ignoreregex = journalmatch = _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon |
Then enable the jail in /etc/fail2ban/jail.local .
|
1 2 3 4 5 6 7 8 |
#... below the sshd conf, add this for pve daemon [pvedaemon] enabled = true port = https,http,8006 filter = pvedaemon backend = systemd #... others |
Restart the fail2ban service, here it goes.
|
1 2 3 4 5 6 7 8 9 10 |
$ fail2ban-client status pvedaemon Status for the jail: pvedaemon |- Filter | |- Currently failed: 0 | |- Total failed: 2 | `- Journal matches: _SYSTEMD_UNIT=pvedaemon.service + _COMM=pvedaemon `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 162.19.61.xxx |
Then we can also check the iptables -nvL and fail2ban.log for some more detail – try it by yourself, could be interesting.
完整阅读本篇»使用Proxmox-Port，成功在Pi 5b上搞起PVE。
其上又装了个Arch、Rocky9和WoA（Windows on Arm），把host和三个vm都塞进一张32G tf卡，加之WoA的一些特定配置，过程是崎岖了一点，但结果还是显而易见的 —— 这一天还是来了，PVE on aarch64。
Arm Linux KVM再带Linux vm是蛮有实际意义的，家里已经用了两年多了（外加incus容器），只不过那块RK3399没搞pve，用的是更传统的libvirt。
pi 5b走kvm虚拟化运行arch和win两台vm
得益于树莓派5b不错的性能，简单操作一下WoA，体验上也不再是行为艺术。至于WoA本身是不是行为艺术，只能说高通的X Elite明显还是拖不动微软的意兴阑珊，不由得让人想起当年Nokia、木马哥和Win Phone的那场爱恨情仇。
完整阅读本篇»Powered by WordPress | 京ICP备17001541号-1 | 
京公网安备 11011502004657号
