<div dir="ltr">Think that U should ask in Fain2ban LIST<br></div><div class="gmail_extra"><br><div class="gmail_quote">2017-03-01 20:29 GMT+02:00 Motty Cruz <span dir="ltr"><<a href="mailto:motty.cruz@gmail.com" target="_blank">motty.cruz@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US"><div class="m_6126789913891216800WordSection1"><p class="MsoNormal">Hello, fail2ban does not ban offending IP. <u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">NOTICE[29784] chan_sip.c: Registration from '"user3"<sip:1005@asterisk-ip:<wbr>5060>' failed for 'offending-IP:53417' - Wrong password<u></u><u></u></p><p class="MsoNormal">NOTICE[29784] chan_sip.c: Registration from '"user3"<sip:1005@asterisk-ip:<wbr>5060>' failed for ‘offending-IP:53911' - Wrong password<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">systemctl status fail2ban<u></u><u></u></p><p class="MsoNormal">● fail2ban.service - Fail2Ban Service<u></u><u></u></p><p class="MsoNormal"> Loaded: loaded (/usr/lib/systemd/system/<wbr>fail2ban.service; enabled; vendor preset: disabled)<u></u><u></u></p><p class="MsoNormal"> Active: active (running) since Wed 2017-03-01 00:40:43 PST; 470min ago<u></u><u></u></p><p class="MsoNormal"> Docs: man:fail2ban(1)<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">jail.local<u></u><u></u></p><p class="MsoNormal">[DEFAULT]<u></u><u></u></p><p class="MsoNormal"># "bantime" is the number of seconds that a host is banned.<u></u><u></u></p><p class="MsoNormal">bantime = -1<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"># A host is banned if it has generated "maxretry" during the last "findtime"<u></u><u></u></p><p class="MsoNormal"># seconds.<u></u><u></u></p><p class="MsoNormal">findtime = 300<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"># "maxretry" is the number of failures before a host get banned.<u></u><u></u></p><p class="MsoNormal">maxretry = 3<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">[asterisk-iptables]<u></u><u></u></p><p class="MsoNormal">enable = true<u></u><u></u></p><p class="MsoNormal">port = 5060,5061<u></u><u></u></p><p class="MsoNormal">filter = asterisk<u></u><u></u></p><p class="MsoNormal">action = iptables-allports[name=<wbr>ASTERISK, protocol=all]<u></u><u></u></p><p class="MsoNormal"> sendmail[name=ASTERISK, dest=<a href="mailto:motty@email.com" target="_blank">motty@email.com</a>, sender=<a href="mailto:fail2ban@asterisk-ip.com" target="_blank">fail2ban@asterisk-ip.<wbr>com</a>]<u></u><u></u></p><p class="MsoNormal">#action = %(banaction)s[name=%(__name__)<wbr>s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]<u></u><u></u></p><p class="MsoNormal"> %(banaction)s[name=%(__name__)<wbr>s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]<u></u><u></u></p><p class="MsoNormal"> %(mta)s-whois[name=%(__name__)<wbr>s, dest="%(destemail)s"]<u></u><u></u></p><p class="MsoNormal">logpath = /var/log/asterisk/messages<u></u><u></u></p><p class="MsoNormal">maxretry = 3<u></u><u></u></p><p class="MsoNormal">findtime = 300<u></u><u></u></p><p class="MsoNormal">bantime = -1<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">in filter.d<u></u><u></u></p><p class="MsoNormal">asterisk.conf<u></u><u></u></p><p class="MsoNormal">failregex = ^%(__prefix_line)s%(log_<wbr>prefix)s Registration from '[^']*' failed for '<HOST>(:¥d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error ¥(permit/deny¥)|Not a local domain)$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s Call from '[^']*' ¥(<HOST>:¥d+¥) to extension '[^']*' rejected because extension not found in context<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s Host <HOST> failed to authenticate as '[^']*'$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s No registration for peer '[^']*' ¥(from <HOST>¥)$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s Host <HOST> failed MD5 authentication for '[^']*' ¥([^)]+¥)$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s Failed to authenticate (user|device) [^@]+@<HOST>¥S*$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s hacking attempt detected '<HOST>'$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s SecurityEvent="(FailedACL|<wbr>InvalidAccountID|<wbr>ChallengeResponseFailed|<wbr>InvalidPassword)",EventTV="([¥<wbr>d-]+|%(iso8601)s)",Severity="[<wbr>¥w]+",Service="[¥w]+",<wbr>EventVersion="¥d+",AccountID="<wbr>(¥d*|<unknown>)",SessionID=".+<wbr>",LocalAddress="IPV[46]/(UDP|<wbr>TCP|WS)/[¥da-fA-F:.]+/¥d+",<wbr>RemoteAddress="IPV[46]/(UDP|<wbr>TCP|WS)/<HOST>/¥d+"(,<wbr>Challenge="[¥w/]+")?(,<wbr>ReceivedChallenge="¥w+")?(,<wbr>Response="¥w+",<wbr>ExpectedResponse="¥w*")?(,<wbr>ReceivedHash="[¥da-f]+")?(,<wbr>ACLName="¥w+")?$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s "Rejecting unknown SIP connection from <HOST>"$<u></u><u></u></p><p class="MsoNormal"> ^%(__prefix_line)s%(log_<wbr>prefix)s Request (?:'[^']*' )?from '[^']*' failed for '<HOST>(?::¥d+)?'¥s¥(callid: [^¥)]*¥) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)¥s*$<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<u></u><u></u></p><p class="MsoNormal"> NOTICE.* <HOST> failed to authenticate as '.*'$<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: No registration for peer '.*' ¥(from <HOST>¥)<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Failed to authenticate user .*@<HOST>.*<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Sending fake auth rejection for device .*¥<sip:.*¥@<HOST>¥>;tag=.*<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '¥".*¥".*' failed for '<HOST>' - No matching peer found<u></u><u></u></p><p class="MsoNormal"> NOTICE.* .*: Registration from '¥".*¥".*' failed for '<HOST>' - Wrong password<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">ignoreregex =<u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal">Thanks<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></p><span class="HOEnZb"><font color="#888888"><p class="MsoNormal">Motty<u></u><u></u></p></font></span></div></div><br>--<br>
______________________________<wbr>______________________________<wbr>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.<wbr>org/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/<wbr>wiki/display/AST/Getting+<wbr>Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/<wbr>mailman/listinfo/asterisk-<wbr>users</a><br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div>Best regards<br>Antony<br></div><div>tel. +380669197533</div><div>tel2. +380636564340<br></div><div>Paypal <a href="http://paypal.me/Satskiy?ppid=PPC000654&cnac=PL&rsta=en_PL(en_DK)&cust=NN8XJS9XEP22C&unptid=21db79ac-ef8d-11e5-9553-9c8e992ea258&t=&cal=4d776c21ca7d2&calc=4d776c21ca7d2&calf=4d776c21ca7d2&unp_tpcid=ppme-social-business-profile-created&page=main:email&pgrp=main:email&e=op&mchn=em&s=ci&mail=sys" target="_blank">http://paypal.me/Satskiy</a><br></div><div><a href="mailto:mail%3Asatskiy.a@gmail.com" target="_blank">satskiy.a@gmail.com</a></div></div></div></div></div></div>
</div>