I'm a unix admin at a college. I've two web servers. One of them is for faculty and one of them is for the official college web team. The offical web server proxies requests for faculty web pages, so even though they're two separate servers, from the faculty and browser point of view, it appears as one server.
In order to save the faculty some confusion, I forward port 22 (using socat) on the official server to the faculty server and make sshd on the the official server listen on a different port. This way, faculty can ssh to mycollege.edu, even though that's the DNS name of the official server. It means the web team gets confused more often, but that's way better than several hundred confused faculty.
I use Fail2Ban to keep the brute force ssh logins to a somewhat more manageable quantity. This doesn't work for these two web servers because every ssh connection to the faculty server comes from the official server, and I obviously don't want to block connections from the official server.
What I want to do, is find a way to track failed logins across the servers, so I can have the official server block the source IP. The problem is, the official server knows the source IP but not which logins failed and the faculty server knows which logins failed, but not the source IP.
I should be able to do this by tracking the source port on the connections between the offical and faculty servers. Official knows source IP of original connection and the source port for the subsequent connection to the faculty server. The faculty server knows the source port from the official server and weather the login failed.
Basically, I would keep a log of foreign source IPs and internal source ports on the official (outward facing) server and a log of internal source ports and login failures on the faculty (internal) server. Then I could send the log entries from the faculty server to the official server and the official server could analyze it and firewall as appropriate.
SO! Here's my questions:
- Is this a crazy idea with a much simpler solution?
- If this isn't crazy, what's the best way to gather that internal source port info? Socat (on external, official host) can log some stuff, but what it appears to call the source port doesn't match anything in connections I'm watching on the internal/faculty host (using tcpdump).