------------------монтирование на клиенте
root@cox:~# mount -r -vvvv -t nfs4 -o rw 192.168.33.1:/mnt/torrents/ /mnt/data/
mount.nfs4: timeout set for Tue Jul 23 23:31:01 2019
mount.nfs4: trying text-based options 'vers=4.2,addr=192.168.33.1,clientaddr=172.26.11.11'
mount.nfs4: mount(2): Connection refused
mount.nfs4: trying text-based options 'addr=192.168.33.1'
mount.nfs4: prog 100003, trying vers=3, prot=6
mount.nfs4: portmap query retrying: RPC: Program not registered
mount.nfs4: prog 100003, trying vers=3, prot=17
mount.nfs4: portmap query failed: RPC: Program not registered
mount.nfs4: requested NFS version or transport protocol is not supported




---------------------проверка 
root@cox:~# showmount -e 192.168.33.1
clnt_create: RPC: Program not registered
root@cox:~# 

------------------SERVER===========================
root@data:~# cat /etc/hosts.allow 
# /etc/hosts.allow: list of hosts that are allowed to access the system.
#                   See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: LOCAL @some_netgroup
#             ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you're going to protect the portmapper use the name "rpcbind" for the
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
#
portmap : 172.26.11.11/24 : allow


--------------------------- info
oot@daddta:~# rpcinfo -p localhost
   program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp  38615  status
    100024    1   tcp  54761  status
    100021    1   udp  33509  nlockmgr
    100021    3   udp  33509  nlockmgr
    100021    4   udp  33509  nlockmgr
    100021    1   tcp  39515  nlockmgr
    100021    3   tcp  39515  nlockmgr
    100021    4   tcp  39515  nlockmgr
root@data:~# 



-----------------------
 lsmod | grep nfs
nfsv3                  40960  1
nfsv4                 577536  0
nfs                   262144  3 nfsv4,nfsv3
fscache                65536  2 nfsv4,nfs
nfsd                  339968  1
auth_rpcgss            61440  2 nfsd,rpcsec_gss_krb5
nfs_acl                16384  2 nfsd,nfsv3
lockd                  94208  3 nfsd,nfsv3,nfs
grace                  16384  2 nfsd,lockd
sunrpc                335872  21 nfsd,nfsv4,auth_rpcgss,lockd,nfsv3,rpcsec_gss_krb5,nfs_acl,nfs
root@daddta:~#


--------------------------netstat

root@daddta:~# netstat -nupl | grep rpc
udp        0      0 0.0.0.0:38615           0.0.0.0:*                           11437/rpc.statd     
udp        0      0 0.0.0.0:111             0.0.0.0:*                           14382/rpcbind       
udp        0      0 0.0.0.0:990             0.0.0.0:*                           14382/rpcbind       
udp        0      0 127.0.0.1:1013          0.0.0.0:*                           11437/rpc.statd     
udp6       0      0 :::45600                :::*                                11437/rpc.statd     
udp6       0      0 :::111                  :::*                                14382/rpcbind       
udp6       0      0 :::990                  :::*                                14382/rpcbind       
root@daddta:~# 



-------------------
root@data:~# showmount -e localhost
clnt_create: RPC: Program not registered
root@data:~# 

 
root@deba:/home/yozz# update-initramfs -u
update-initramfs: Generating /boot/initrd.img-3.16.0-4-686-pae
ln: не удалось создать символьную ссылку «/var/tmp/mkinitramfs_GzndUY/sbin/vgchange»: Файл существует
root@deba:/home/yozz# 

 	ns2.vasek.ru
66.66.66.76 	Невозможно определить тип записи. Имя DNS-сервера удалено из списка проверяемых. 

/etc/bind# cat aa.bb.ru 
$TTL 2d
@	IN SOA	ns1.aa.bb.ru.	admin.aa.bb.ru. (
	2015060629	;serial
	2h	;refresh
	1h	;retry
	1w	;expiry
	1d )	;minimum

; Name servers
        IN      NS      ns1.aa.bb.ru.
        IN      NS      ns2.aa.bb.ru.

; PTR records
1       IN      PTR      ns1.aa.bb.ru.
2       IN      PTR      ns2.aa.bb.ru.
3       IN      PTR      www.aa.bb.ru.
www             IN      CNAME   @  
socit.spb.ru.		IN MX	0 mail.aa.bb.ru.
socit.spb.ru.		IN TXT	"v=spf1 ip4:66.66.66.66 mx ptr mx:mail.aa.bb.ru ~all"
aa.bb.ru.		IN NS	ns1.aa.bb.ru.
aa.bb.ru.		IN NS   ns2.aa.bb.ru.
aa.bb.ru.    	IN A	55.55.55.55
mail.aa.bb.ru.	IN A 	66.66.66.66
ftp				IN A 	55.55.55.55
faq				IN A 	55.55.55.55
help				IN A 	55.55.55.55
support				IN A 	55.55.55.55
ns1				IN A	55.55.55.55
ns2		 		IN A	66.66.66.66
cloud				IN A 	55.55.55.55
blog				IN A 	55.55.55.55

root@deba:/home/yozz# cat /etc/bind/db.lan 
$TTL 38400

@       IN      SOA     lan. admin.localdomain.net. (
                        2015020313
                        1d
                        1h
                        1w
                        2h )
 
@   IN   NS   lan.
@ IN NS ns1.lan.
@ IN NS ns2.lan.
@   IN   A    192.168.1.101
z   IN   A    192.168.1.1
free    IN A    192.168.1.101
faq     IN A    192.168.1.101
ats     IN A    192.168.1.135
cisco   IN A  192.168.1.111
zen     IN A 192.168.77.1
tref    IN  A  192.168.88.1
ds      IN  A 172.26.1.25
m1      IN  A  172.26.1.1
m2      IN  A 172.26.1.2
ns1 IN A 192.168.1.101
ns2 IN A 192.168.88.100
ns3 IN A 172.22.22.22
bind IN A 192.168.88.100
tde IN A 192.168.88.113

mserv.lan.      IN      A       172.26.1.22
root@deba:/home/yozz# 

root@deba:/home/yozz# fail2ban-regex /var/log/kern.log /etc/fail2ban/filter.d/shrunk-window.conf 

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/shrunk-window.conf
Use         log file : /var/log/kern.log


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [898] MONTH Day Hour:Minute:Second
`-

Lines: 898 lines, 0 ignored, 0 matched, 898 missed
Missed line(s): too many to print.  Use --print-all-missed to print all 898 lines

Jun  2 16:34:41 deba kernel: [75291.727343] atl1 0000:02:00.0: eth0 link is up 1000 Mbps full duplex
Jun  2 16:58:07 deba kernel: [76698.032019] Peer 206.123.249.115:16000/46728 unexpectedly shrunk window 2743024728:2743042104 (repaired)
Jun  2 17:49:27 deba kernel: [79778.272028] Peer 206.123.249.115:16000/49611 unexpectedly shrunk window 397761337:397843873 (repaired)
Jun  2 18:31:57 deba kernel: [82327.708020] Peer 206.123.249.115:16000/52202 unexpectedly shrunk window 4193374749:4193451493 (repaired)
Jun  2 18:36:25 deba kernel: [82595.844021] Peer 206.123.249.115:16000/52202 unexpectedly shrunk window 4206907277:4206942425 (repaired)
Jun  2 18:56:07 deba kernel: [83777.716020] Peer 206.123.249.115:16000/53990 unexpectedly shrunk window 3827203265:3827288697 (repaired)
root@deba:/var/log# 

[Definition]
failregex = TCP\: Peer <HOST>\:.* unexpectedly shrunk window.*repaired+
ignoreregex =
root@deba:/home/yozz# 

 X3_Terran_Conflict_&_Albion_prelude.tar.gz
root@zzz:/home/yozz/Загрузки/X3# ali
alias  alien  
root@zzz:/home/yozz/Загрузки/X3# alien X3.tar.gz -d
tar: Ignoring unknown extended header keyword 'SCHILY.fflags'
tar: Ignoring unknown extended header keyword 'SCHILY.fflags'
tar: Ignoring unknown extended header keyword 'SCHILY.fflags'
^C
root@zzz:/home/yozz/Загрузки/X3# 


e' for more information.
root@zzz:/home/yozz/Загрузки/X3# tar --version
tar (GNU tar) 1.27.1
Copyright (C) 2013 Free Software Foundation, Inc.
Лицензия GPLv3+: GNU GPL версии 3 или новее <http://gnu.org/licenses/gpl.html>
Это свободное ПО: вы можете продавать и распространять его.
Нет НИКАКИХ ГАРАНТИЙ до степени, разрешённой законом.

Авторы: John Gilmore и Jay Fenlason

root@deba:/home/yozz# uname -v
#1 SMP Debian 3.16.7-ckt9-3~deb8u1 (2015-04-24)
root@deba:/home/yozz# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 8.0 (jessie)
Release:        8.0
Codename:       jessie
root@deba:/home/yozz# 

root@deba:/home/yozz# service fail2ban status 
● fail2ban.service - LSB: Start/stop fail2ban
   Loaded: loaded (/etc/init.d/fail2ban)
   Active: active (running) since Пн 2015-06-01 19:40:33 MSK; 20h ago
  Process: 644 ExecStart=/etc/init.d/fail2ban start (code=exited, status=0/SUCCESS)
   CGroup: /system.slice/fail2ban.service
           └─1290 /usr/bin/python /usr/bin/fail2ban-server -b -s /var/run/fail2ban/f...

июн 01 19:40:28 deba fail2ban[644]: Starting authentication failure monitor: fa...''
июн 01 19:40:28 deba fail2ban[644]: WARNING 'ignoreregex' not defined in 'Defin...''
июн 01 19:40:33 deba fail2ban[644]: .
Hint: Some lines were ellipsized, use -l to show in full.

#[named-refused-tcp]
#
#enabled  = true
#port     = domain,953
#protocol = tcp
#filter   = named-refused
#logpath  = /var/log/named/security.log

[named-refused-udp]

enabled   = true
port      = domain,953
protocol  = udp
filter    = named-refused
action    = iptables-multiport[name=Named, port="domain,953", protocol=udp]
logpath   = /var/log/named/security.log
bantime   = 31536000
maxretry  = 10

##########
######################################





[named-ddos-tcp]
enabled  = true
port     = domain,953
protocol = tcp
filter   = named-ddos
logpath  = /var/log/named/query.log
maxretry = 8

[named-ddos-udp]
enabled  = true
port     = domain,953
protocol = udp
filter   = named-ddos
logpath  = /var/log/named/query.log
maxretry = 8

May-2015 21:50:54.715 client 45.101.62.132#38734 (yloj.ml.gg): query (cache) 'yloj.ml.gg/A/IN' denied
29-May-2015 21:50:55.342 client 51.8.82.224#46832 (mjov.ml.gg): query (cache) 'mjov.ml.gg/A/IN' denied
29-May-2015 21:50:55.342 client 58.55.90.144#52478 (qdif.ml.gg): query (cache) 'qdif.ml.gg/A/IN' denied
29-May-2015 21:50:55.352 client 106.143.126.65#20833 (qpufodqnyrqx.ml.gg): query (cache) 'qpufodqnyrqx.ml.gg/A/IN' denied
29-May-2015 21:50:55.353 client 111.15.87.56#13144 (sdufwtuzctif.ml.gg): query (cache) 'sdufwtuzctif.ml.gg/A/IN' denied
29-May-2015 21:50:56.319 client 107.61.188.235#37223 (sr.ml.gg): query (cache) 'sr.ml.gg/A/IN' denied
29-May-2015 21:50:56.323 client 47.91.91.141#47171 (afwtefktmzknyx.ml.gg): query (cache) 'afwtefktmzknyx.ml.gg/A/IN' denied
29-May-2015 21:50:57.724 client 85.33.68.76#60558 (onqpezkrkr.yyy.gg): query (cache) 'onqpezkrkr.yyy.gg/A/IN' denied
29-May-2015 21:50:57.846 client 63.181.133.44#664 (utkpwzoryz.yyy.gg): query (cache) 'utkpwzoryz.yyy.gg/A/IN' denied
29-May-2015 21:50:58.089 client 31.246.38.34#25614 (clwlyjozmz.yyy.gg): query (cache) 'clwlyjozmz.yyy.gg/A/IN' denied
root@deba:/home/yozz# 

root@deba:/home/yozz# cat /etc/fail2ban/filter.d/named-refused.conf
# Fail2Ban filter file for named (bind9).
#

# This filter blocks attacks against named (bind9) however it requires special
# configuration on bind.
#
# By default, logging is off with bind9 installation.
#
# You will need something like this in your named.conf to provide proper logging.
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# };

[Definition]

# Daemon name
_daemon=named

# Shortcuts for easier comprehension of the failregex

__pid_re=(?:\[\d+\])
__daemon_re=\(?%(_daemon)s(?:\(\S+\))?\)?:?
__daemon_combs_re=(?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:)

#       hostname       daemon_id         spaces
# this can be optional (for instance if we match named native log files)
__line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?

#failregex = ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
#            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
#            ^%(__line_prefix)s(\.\d+)?( error:)?\s*client <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$

failregex =     ^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: (view (internal|external): )?query(?: \(cache\))? '.*' denied\s*$
                ^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: zone transfer '\S+/AXFR/\w+' denied\s*$
                ^%(__line_prefix)sclient <HOST>#\S+( \([\S.]+\))?: bad zone transfer request: '\S+/IN': non-authoritative zone \(NOTAUTH\)\s*$

# DEV Notes:
# Trying to generalize the
#          structure which is general to capture general patterns in log
#          lines to cover different configurations/distributions
#          
# (\.\d+)? is a really ugly catch of the microseconds not captured in the date detector
#
# Author: Yaroslav Halchenko
root@deba:/home/yozz#