구차니의 잡동사니 모음

:[N]bn[ext][!] [+cmd] [N]                               *:bn* *:bnext* *E87*

                Go to [N]th next buffer in buffer list.  [N] defaults to one.

                Wraps around the end of the buffer list.

                See |:buffer-!| for [!].

                Also see ||+cmd|.

                If you are in a help buffer, this takes you to the next help

                buffer (if there is one).  Similarly, if you are in a normal

                (non-help) buffer, this takes you to the next normal buffer.

                This is so that if you have invoked help, it doesn't get in

                the way when you're browsing code/text buffers.  The next three

                commands also work like this. 

:[N]bN[ext][!] [+cmd] [N]               *:bN* *:bNext* *:bp* *:bprevious* *E88*

:[N]bp[revious][!] [+cmd] [N]

                Go to [N]th previous buffer in buffer list.  [N] defaults to

                one.  Wraps around the start of the buffer list.

                See |:buffer-!| for [!] and 'switchbuf'.

                Also see ||+cmd|. 

:br[ewind][!] [+cmd]                                    *:br* *:brewind*

                Go to first buffer in buffer list.  If the buffer list is

                empty, go to the first unlisted buffer.

                See |:buffer-!| for [!].

:bf[irst] [+cmd]                                        *:bf* *:bfirst*

                Same as |:brewind|.

                Also see |+cmd|. 

:bl[ast][!] [+cmd]                                      *:bl* *:blast*

                Go to last buffer in buffer list.  If the buffer list is

                empty, go to the last unlisted buffer.

                See |:buffer-!| for [!]. 

:[N]bd[elete][!]                        *:bd* *:bdel* *:bdelete* *E516*

:bd[elete][!] [N]

                Unload buffer [N] (default: current buffer) and delete it from

                the buffer list.  If the buffer was changed, this fails,

                unless when [!] is specified, in which case changes are lost.

                The file remains unaffected.  Any windows for this buffer are

                closed.  If buffer [N] is the current buffer, another buffer

                will be displayed instead.  This is the most recent entry in

                the jump list that points into a loaded buffer.

                Actually, the buffer isn't completely deleted, it is removed

                from the buffer list |unlisted-buffer| and option values,

                variables and mappings/abbreviations for the buffer are

                cleared. 

:[N]bw[ipeout][!]                       *:bw* *:bwipe* *:bwipeout* *E517*

:bw[ipeout][!] {bufname}

:N,Mbw[ipeout][!]

:bw[ipeout][!] N1 N2 ...

                Like |:bdelete|, but really delete the buffer.  Everything

                related to the buffer is lost.  All marks in this buffer

                become invalid, option settings are lost, etc.  Don't use this

                unless you know what you are doing. 

 CTRL-W CTRL-V                                           *CTRL-W_CTRL-V*

CTRL-W v                                                *CTRL-W_v*

:[N]vs[plit] [++opt] [+cmd] [file]                      *:vs* *:vsplit*

                Like |:split|, but split vertically.  The windows will be

                spread out horizontally if

                1. a width was not specified,

                2. 'equalalways' is set,

                3. 'eadirection' isn't "ver", and

                4. one of the other windows is wider than the current or new

                   window.

                Note: In other places CTRL-Q does the same as CTRL-V, but here

                it doesn't!

CTRL-W n                                                *CTRL-W_n*

CTRL-W CTRL_N                                           *CTRL-W_CTRL-N*

:[N]new [++opt] [+cmd]                                  *:new*

                Create a new window and start editing an empty file in it.

                Make new window N high (default is to use half the existing

                height).  Reduces the current window height to create room (and

                others, if the 'equalalways' option is set and 'eadirection'

                isn't "hor").

                Also see |++opt| and |+cmd|.

                If 'fileformats' is not empty, the first format given will be

                used for the new buffer.  If 'fileformats' is empty, the

                'fileformat' of the current buffer is used.  This can be

                overridden with the |++opt| argument.

                Autocommands are executed in this order:

                1. WinLeave for the current window

                2. WinEnter for the new window

                3. BufLeave for the current buffer

                4. BufEnter for the new buffer

                This behaves like a ":split" first, and then an ":enew"

                command.

:[N]vne[w] [++opt] [+cmd] [file]                        *:vne* *:vnew*

                Like |:new|, but split vertically.  If 'equalalways' is set

                and 'eadirection' isn't "ver" the windows will be spread out

                horizontally, unless a width was specified.

:[N]new [++opt] [+cmd] {file}

:[N]sp[lit] [++opt] [+cmd] {file}                       *:split_f*

                Create a new window and start editing file {file} in it.  This

                behaves like a ":split" first, and then an ":e" command.

                If [+cmd] is given, execute the command when the file has been

                loaded |+cmd|.

                Also see |++opt|.

                Make new window N high (default is to use half the existing

                height).  Reduces the current window height to create room

                (and others, if the 'equalalways' option is set).

$ vi /etc/fail2ban/jail.conf

banaction = iptables-multiport

$ vi /etc/fail2ban/action.d/iptables-multiport.conf

actionban = iptables -I fail2ban-<name> 1 -s <ip>/24 -j <blocktype>

actionunban = iptables -D fail2ban-<name> -s <ip>/24 -j <blocktype>

$ man iptables

       [!] -s, --source address[/mask][,...]

              Source  specification.  Address  can  be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be

              resolved once only, before the rule is submitted to the kernel.  Please note that specifying any name to be resolved with a remote query such as DNS is

              a  really bad idea.  The mask can be either an ipv4 network mask (for iptables) or a plain number, specifying the number of 1's at the left side of the

              network mask.  Thus, an iptables mask of 24 is equivalent to 255.255.255.0.  A "!" argument before the address specification inverts the sense  of  the

              address.  The  flag  --src  is an alias for this option.  Multiple addresses can be specified, but this will expand to multiple rules (when adding with

              -A), or will cause multiple rules to be deleted (with -D).

$ fail2ban-client 

    set <JAIL> banip <IP>                    manually Ban <IP> for <JAIL>

    set <JAIL> unbanip <IP>                  manually Unban <IP> in <JAIL>

$ sudo fail2ban-client set ssh banip 221.194.44.252

$ sudo fail2ban-client set ssh banip 221.194.44.252/24 

$ sudo iptables -L

Chain fail2ban-ssh (1 references)

target     prot opt source               destination

REJECT     all  --  221.194.44.0/24      anywhere             reject-with icmp-port-unreachable

REJECT     all  --  221.194.44.252       anywhere             reject-with icmp-port-unreachable

RETURN     all  --  anywhere             anywhere 

$ sudo webalizer -c /etc/webalizer/webalizer.conf.old 

$ grep "PAM 5 more authentication" /var/log/auth.log*

$ grep "Failed password for" /var/log/auth.log*  

$ sudo apt-cache search fail2ban

fail2ban - ban hosts that cause multiple authentication errors 

$ sudo apt-get install fail2ban 

auth.log.1:Jan 23 10:50:45 raspberrypi sshd[2616]: Failed password for invalid user gopher from 106.247.230.226 port 39683 ssh2

auth.log.1:Jan 23 10:50:47 raspberrypi sshd[2616]: Failed password for invalid user gopher from 106.247.230.226 port 39683 ssh2

auth.log.1:Jan 23 10:52:14 raspberrypi sshd[2622]: Failed password for invalid user nfsnobody from 106.247.230.226 port 49373 ssh2

auth.log.1:Jan 23 10:52:16 raspberrypi sshd[2622]: Failed password for invalid user nfsnobody from 106.247.230.226 port 49373 ssh2

auth.log.1:Jan 23 10:52:18 raspberrypi sshd[2622]: Failed password for invalid user nfsnobody from 106.247.230.226 port 49373 ssh2

auth.log.1:Jan 23 10:52:58 raspberrypi sshd[2629]: Failed password for games from 106.247.230.226 port 49461 ssh2

auth.log.1:Jan 23 10:53:00 raspberrypi sshd[2629]: Failed password for games from 106.247.230.226 port 49461 ssh2

auth.log.1:Jan 23 10:53:02 raspberrypi sshd[2629]: Failed password for games from 106.247.230.226 port 49461 ssh2

auth.log.1:Jan 23 10:55:12 raspberrypi sshd[2638]: Failed password for invalid user teamspeak2 from 106.247.230.226 port 52864 ssh2

auth.log.1:Jan 23 10:55:15 raspberrypi sshd[2638]: Failed password for invalid user teamspeak2 from 106.247.230.226 port 52864 ssh2

auth.log.1:Jan 23 10:56:38 raspberrypi sshd[2647]: Failed password for invalid user teamspeak2 from 106.247.230.226 port 50460 ssh2

auth.log.1:Jan 23 10:57:21 raspberrypi sshd[2653]: Failed password for invalid user ts4 from 106.247.230.226 port 60900 ssh2

auth.log.1:Jan 23 11:00:14 raspberrypi sshd[2662]: Failed password for invalid user offline from 106.247.230.226 port 54433 ssh2

auth.log.1:Jan 23 11:00:56 raspberrypi sshd[2668]: Failed password for invalid user webdesign from 106.247.230.226 port 52505 ssh2

auth.log.1:Jan 23 11:02:19 raspberrypi sshd[2673]: Failed password for invalid user reddragon from 106.247.230.226 port 56955 ssh2 

$ sudo vi /etc/fail2ban/jail.conf

[DEFAULT]

ignoreip = 127.0.0.1/8 192.168.219.1/24

ignorecommand =

bantime  = 2592000

findtime = 60

maxretry = 5

[ssh]

enabled  = true

port     = ssh

filter   = sshd

logpath  = /var/log/auth.log

maxretry = 5

[apache]

enabled  = false

port     = http,https

filter   = apache-auth

logpath  = /var/log/apache*/*error.log

maxretry = 5

$ sudo iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

fail2ban-ssh  tcp  --  anywhere             anywhere             multiport dports ssh

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

Chain fail2ban-ssh (1 references)

target     prot opt source               destination

REJECT     all  --  221.194.44.252       anywhere             reject-with icmp-port-unreachable

RETURN     all  --  anywhere             anywhere

Feb  9 04:48:52 raspberrypi sshd[3342]: Invalid user admin from 221.194.44.252

Feb  9 04:48:52 raspberrypi sshd[3342]: input_userauth_request: invalid user admin [preauth]

Feb  9 04:48:52 raspberrypi sshd[3342]: pam_unix(sshd:auth): check pass; user unknown

Feb  9 04:48:52 raspberrypi sshd[3342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.194.44.252

Feb  9 04:48:53 raspberrypi sshd[3342]: Failed password for invalid user admin from 221.194.44.252 port 2815 ssh2

Feb  9 04:48:53 raspberrypi sshd[3342]: pam_unix(sshd:auth): check pass; user unknown

Feb  9 04:48:55 raspberrypi sshd[3342]: Failed password for invalid user admin from 221.194.44.252 port 2815 ssh2

Feb  9 04:48:55 raspberrypi sshd[3342]: pam_unix(sshd:auth): check pass; user unknown

Feb  9 04:48:57 raspberrypi sshd[3342]: Failed password for invalid user admin from 221.194.44.252 port 2815 ssh2

Feb  9 04:48:57 raspberrypi sshd[3342]: pam_unix(sshd:auth): check pass; user unknown

Feb  9 04:48:59 raspberrypi sshd[3342]: Failed password for invalid user admin from 221.194.44.252 port 2815 ssh2

Feb  9 04:48:59 raspberrypi sshd[3342]: pam_unix(sshd:auth): check pass; user unknown

Feb  9 04:49:01 raspberrypi sshd[3342]: Failed password for invalid user admin from 221.194.44.252 port 2815 ssh2

Feb  9 04:49:01 raspberrypi sshd[3342]: fatal: Read from socket failed: Connection reset by peer [preauth]

Feb  9 04:49:01 raspberrypi sshd[3342]: PAM 4 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.194.44.252

Feb  9 04:49:01 raspberrypi sshd[3342]: PAM service(sshd) ignoring max retries; 5 > 3 

2017-02-09 04:49:01,756 fail2ban.actions[31809]: WARNING [ssh] Ban 221.194.44.252

2017-02-09 08:50:18,961 fail2ban.server [31809]: INFO    Stopping all jails

2017-02-09 08:50:19,255 fail2ban.actions[31809]: WARNING [ssh] Unban 221.194.44.252 

<Directory /var/www/>

Options FollowSymLinks MultiViews

AllowOverride None

Order deny,allow

Allow from xxx.xxx.xxx.xxx

Allow from xxx.xxx.xxx.xxx

Allow from xxx.xxx.xxx.xxx

Deny from all

</Directory>

#Required set of rewrite rules

RewriteEngine on

RewriteMap    hosts-deny  txt:/etc/apache/banned-hosts

RewriteCond   ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]

RewriteCond   ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND

RewriteRule   ^  /why-am-i-banned.html

##  inside our banned hosts file, we have:

## /etc/apache2/banned-hosts (maintain the format .. its not just a plain text file)

## 

193.102.180.41 -

192.168.111.45 -

www.example.com -

www.sumwia.net -