SSH/FTP : Limiter les tentatives d'intrusion

Bonjour, je cherche à configurer correctement blockhosts pour empecher
les tentatives d'intrusion à répétition et banir temporairement les
adresses IP sources.

J'aurais voulu essayer fail2ban mais il requiert une version de Python
non encore dispo sur ma distribution (CentOS 4.5)

Le problème est que depuis que j'utilise blockhosts je n'arrive plus à
me connecter en FTP sur le serveur.

Ce que je ne comprends pas c'est que blockhosts.py n'est exécuté qu'une
fois pas heure, et que dans l'intervalle il n'apparait pas dans ps - Al
Pourtant quand je tente de me connecter avec un client ftp, j'obtiens
ceci dans /var/log/messages
blockhosts: echo tag: 192.168.1.1-vsftpd@192.168.1.11

Je ne comprends pas comment blockhosts peut s'exécuter sur demande,
d'ailleurs iptables --list retourne ceci :
Chain INPUT (policy ACCEPT)
target prot opt source destination
blockhosts all -- anywhere anywhere

Que fait cette target 'blockhosts' ici, à quoi correspond elle ? Est-ce
que ça signifie que blockhosts.py est exécuté par iptables ? Comme un
filtre ? Mais où est-ce que c'est déclaré ce genre de comportement ?

Voila, si vous avez un peu d'aide à me fournir ça serait sympa !


/etc/blockhosts.cfg (ne comportant que les sections que j'ai modifié)

#-----------------------------------------------------------------------
[common]
# common section is variables that may be used by main program, mail, etc

#HOSTS_BLOCKFILE = "/etc/hosts.allow"
# the name of the block-file on your computer - usually hosts.allow or
# hosts.deny, see "man 5 hosts_access" for details on these files.
# default is hosts.allow

#HOST_BLOCKLINE = ["ALL: ", " : deny"]
# the line to output, with Host Ip Address in between the strings above,
# to turn on blocking of that IP address

#VERBOSE = Log.MESSAGE_LEVEL_ERROR #-> error (same as --quiet option)
VERBOSE = Log.MESSAGE_LEVEL_WARNING #-> warning (default)
#VERBOSE = Log.MESSAGE_LEVEL_INFO #-> info (same as --verbose option)
#VERBOSE = Log.MESSAGE_LEVEL_DEBUG #-> debug (same as --debug option)
# logging message levels - each level includes all levels above it

#-----------------------------------------------------------------------
[filters]
# filters section defines configuration for filtering watched hosts
# into the blocked hosts list

COUNT_THRESHOLD = 7
# number of invalid attempts after which host is blocked
# note that actual denial make take one or more attempts - depends on the
# timing of when LOGFILES are updated by the system, and when this script
# gets to run

#AGE_THRESHOLD = 12
# number of hours after which host entry is discarded from hosts.deny
# 24 -> one day, 168 -> one week, 720 -> 30 days, integer values only
# most attackers go away after they are blocked, so to keep hosts.deny
# file size small, no reason to make this any more than, say, half-a-day

WHITELIST = [ "127.0.0.1", "192.168.1.1", "194.146.224.129"]
#WHITELIST = []
#WHITELIST = [ "127.0.0.1", "10\.0\.0\..*", ]
# A list of IP (IPv4) addresses or regular expressions that represent
# a IP (IPv4) address - this is the list of white-listed IP addresses.
# When considering IPs to block, if a IP address maches any item in this
# list, then it will be removed from the block list - so won't be blocked.

#BLACKLIST = []
#BLACKLIST = [ "192.168.10.1", "10\..*", ]
# A list of IP (IPv4) addresses or regular expressions that represent
# a IP (IPv4) address - this is the list of black-listed IP addresses.
# When considering IPs to block, if a IP address maches any item in this
# list, then it will be immediately added to the block list, even if
# COUNT_THRESHOLD may not have been reached.
# IP addresses directly specified in this list without a regular expression
# will be immediately added to the blocked list.
# WHITELIST takes precedence over BLACKLIST - so a match in both will mean
# it is white-listed.

#-----------------------------------------------------------------------
[blockhosts]
# blockhosts section defines the log files to scan and patterns to look for

#LOGFILES = [ "/var/log/secure", ]
#LOGFILES = [ "/var/log/auth.log", ]
LOGFILES = [ "/var/log/secure", "/var/log/xferlog", ]
# default list of logs to process, comma separated, can follow Python
# syntax, should be a sequence (list or tuple) of strings representing
# filenames: 1 or more files, default is single file: /var/log/secure

#LOCKFILE = "/tmp/blockhosts.lock"
# need create/write access to this file, used to make sure only one
# instance of blockhosts.py script writes the HOSTS_BLOCKFILE at one time
# note that the mail/iptables/iproute parts of the program do not serialize

#-----------------------------------------------------------------------
[ipblock]
# ipblock section for enabling protection using TCP/IP level blocking -
# by using null routes, or iptables filtering, all network communication
# is stopped from a particular IP address

#IPBLOCK = ""
#IPBLOCK = "iproute"
IPBLOCK = "iptables"
# "iproute": Do TCP/IP blocking using route commands to setup null-routes.
# ip route add <ip-addr> via 127.0.0.1
# "iptable": Do TCP/IP blocking, using iptables packet filtering.
# iptables --append blockhosts --source <ip-addr> -j DROP

#-----------------------------------------------------------------------