fail2ban海关行动永久禁止中国的IP

Question

当一个IP地址被禁止时，我如何检查被禁止的IP地址是否来自中国。如果是，那就把它添加到永久禁令名单中。

我找到了这个很好的指南，它把被禁止的IP写成文件。

原因:我每天都会收到中国的大量暴力攻击，谢天谢地，fail2ban帮助限制了这一点，尽管他们看起来越来越糟糕，他们只是在改变他们的IP地址。

或者更好的情况是，如果有一个已知的黑客IP地址的维护数据库。

示例1

Hi,

The IP 60.169.78.77 has just been banned by Fail2Ban after
4 attempts against vsftpd.


Here are more information about 60.169.78.77:

% [whois.apnic.net node-7]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        60.166.0.0 - 60.175.255.255
netname:        CHINANET-AH
descr:          CHINANET anhui province network
descr:          China Telecom
descr:          A12,Xin-Jie-Kou-Wai Street
descr:          Beijing 100088
country:        CN
admin-c:        CH93-AP
tech-c:         JW89-AP
mnt-by:         APNIC-HM
mnt-routes:     MAINT-CHINANET-AH
mnt-lower:      MAINT-CHINANET-AH
status:         ALLOCATED PORTABLE
changed:        hm-changed@apnic.net 20040721
source:         APNIC

person:         Chinanet Hostmaster
nic-hdl:        CH93-AP
e-mail:         anti-spam@ns.chinanet.cn.net
address:        No.31 ,jingrong street,beijing
address:        100032
phone:          +86-10-58501724
fax-no:         +86-10-58501724
country:        CN
changed:        dingsy@cndata.com 20070416
mnt-by:         MAINT-CHINANET
source:         APNIC

person:         Jinneng Wang
address:        17/F, Postal Building No.120 Changjiang
address:        Middle Road, Hefei, Anhui, China
country:        CN
phone:          +86-551-2659073
fax-no:         +86-551-2659287
e-mail:         wang@mail.hf.ah.cninfo.net
nic-hdl:        JW89-AP
mnt-by:         MAINT-NEW
changed:        wang@mail.hf.ah.cninfo.net 19990818
source:         APNIC

Regards,

Fail2Ban

示例2

Hi,

The IP 60.169.78.81 has just been banned by Fail2Ban after
4 attempts against vsftpd.


Here are more information about 60.169.78.81:

% [whois.apnic.net node-6]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        60.166.0.0 - 60.175.255.255
netname:        CHINANET-AH
descr:          CHINANET anhui province network
descr:          China Telecom
descr:          A12,Xin-Jie-Kou-Wai Street
descr:          Beijing 100088
country:        CN
admin-c:        CH93-AP
tech-c:         JW89-AP
mnt-by:         APNIC-HM
mnt-routes:     MAINT-CHINANET-AH
mnt-lower:      MAINT-CHINANET-AH
status:         ALLOCATED PORTABLE
changed:        hm-changed@apnic.net 20040721
source:         APNIC

person:         Chinanet Hostmaster
nic-hdl:        CH93-AP
e-mail:         anti-spam@ns.chinanet.cn.net
address:        No.31 ,jingrong street,beijing
address:        100032
phone:          +86-10-58501724
fax-no:         +86-10-58501724
country:        CN
changed:        dingsy@cndata.com 20070416
mnt-by:         MAINT-CHINANET
source:         APNIC

person:         Jinneng Wang
address:        17/F, Postal Building No.120 Changjiang
address:        Middle Road, Hefei, Anhui, China
country:        CN
phone:          +86-551-2659073
fax-no:         +86-551-2659287
e-mail:         wang@mail.hf.ah.cninfo.net
nic-hdl:        JW89-AP
mnt-by:         MAINT-NEW
changed:        wang@mail.hf.ah.cninfo.net 19990818
source:         APNIC

Regards,

Fail2Ban

示例3

Hi,

The IP 222.133.244.99 has just been banned by Fail2Ban after
4 attempts against vsftpd.


Here are more information about 222.133.244.99:

% [whois.apnic.net node-6]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:        222.133.244.96 - 222.133.244.127
netname:        LCZFFHQ
country:        CN
descr:          liaochenggovermentfanghuoqiang
admin-c:        DS95-AP
tech-c:         DS95-AP
status:         ASSIGNED NON-PORTABLE
changed:        ip@sdinfo.net 20060122
mnt-by:         MAINT-CNCGROUP-SD
source:         APNIC

route:          222.132.0.0/14
descr:          CNC Group CHINA169 Shandong Province Network
country:        CN
origin:         AS4837
mnt-by:         MAINT-CNCGROUP-RR
changed:        abuse@cnc-noc.net 20060118
source:         APNIC

person:         Data Communication Bureau Shandong
nic-hdl:        DS95-AP
e-mail:         ip@sdinfo.net
address:        No.77 Jingsan Road,Jinan,Shandong,P.R.China
phone:          +86-531-6052611
fax-no:         +86-531-6052414
country:        CN
changed:        ip@sdinfo.net 20050330
mnt-by:         MAINT-CNCGROUP-SD
source:         APNIC

Regards,

Fail2Ban

Answer 1

我建议您不要为此而使用GeoIP数据库，比如http://www.maxmind.com/download/geoip/database/。

大多数编程语言(如PHP、Python、Perl、.)具有可以轻松解析这些格式的绑定。

今天，“黑客IP”数据库已经没有任何意义了，特别是因为：

• IPv4 IP的所有者变化非常迅速
• 由于僵尸网络的广泛存在，IP的所有权和使用是不明确的。
• 采用IPv6 (最后！)使第一个问题变得更糟，并且保持一个2^128个地址的数据库几乎是不可能的(尽管它可能是稀疏的)。