<div dir="ltr">The failregex statement in my jail.conf file is:<br><b><br>failregex</b> = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password<br> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found<br>
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch<br> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<br>
NOTICE.* <HOST> failed to authenticate as '.*'$<br> NOTICE.* .*: No registration for peer '.*' (from <HOST>)<br> NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)<br>
<span style="color: rgb(0, 153, 0);"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)</span><br><br><br>This is a log entry in /var/log/asterisk/full that shows the scan being performed:<br>
<br><br><b>2010-08-01 07:00:13 NOTICE[22540] chan_sip.c: Registration from '"123456"<sip:123456@************>' failed for '193.158.62.48' - ACL error (permit/deny)</b><br><br>The problem is that fail2ban does not detect this attack that was performed for an amount of time of about half an hour.<br>
<br><br>Please help me identify the problem.<br><br></div>