<html><head></head><body><div>On Thu, 2018-03-01 at 15:02 +0200, Atux Atux wrote:</div><div><br></div><blockquote type="cite"><div>I have tried to implement it through fail2ban, but it doe snot seem to work for my asterisk implementation.</div></blockquote><div><br></div><div><br></div><div>I'm happy with Fail2Ban protecting my Asterisk 13. Here is my configuration:</div><div><br></div><div>in /etc/asterisk/logger.conf:</div><div><br></div><div>messages => security,notice,warning,error</div><div><br></div><div><br></div><div>in /etc/asterisk/sip.conf:</div><div><br></div><div>allowguest=yes</div><div>context=unauthenticated</div><div><br></div><div><br></div><div>in /etc/asterisk/extensions.conf:</div><div><br></div><div>[unauthenticated]</div><div>;; Incomming calls from unauthenticated caller -> Fail2Ban</div><div>exten => _X.,1,Log(WARNING,fail2ban='${CHANNEL(peerip)}') </div><div>exten => _X.,2,Set(CDR(UserField)=SIP PEER IP: ${CHANNEL(peerip)})</div><div>exten => _X.,3,HangUp()</div><div><br></div><div>exten => _+X.,1,Log(WARNING,fail2ban='${CHANNEL(peerip)}') </div><div>exten => _+X.,2,Set(CDR(UserField)=SIP PEER IP: ${CHANNEL(peerip)})</div><div>exten => _+X.,3,HangUp()</div><div><br></div><div><br></div><div>in /etc/fail2ban/jail.conf:</div><div><br></div><div>[asterisk]</div><div>filter = asterisk</div><div>action = iptables-allports[name=ASTERISK]</div><div>logpath = /var/log/asterisk/messages</div><div>maxretry = 1</div><div>findtime = 86400</div><div>bantime = 518400</div><div>enabled = true</div><div><br></div><div><br></div><div>in /etc/fail2ban/filter.d</div><div><br></div><div># Fail2Ban configuration file</div><div>#</div><div>#</div><div># $Revision: 250 $</div><div>#</div><div><br></div><div>[INCLUDES]</div><div><br></div><div># Read common prefixes. If any customizations available -- read them from</div><div># common.local</div><div>#before = common.conf</div><div><br></div><div><br></div><div>[Definition]</div><div><br></div><div>#_daemon = asterisk</div><div><br></div><div># Option: failregex</div><div># Notes.: regex to match the password failures messages in the logfile. The</div><div># host must be matched by a group named "host". The tag "<HOST>" can</div><div># be used for standard IP/hostname matching and is only an alias for</div><div># (?:::f{4,6}:)?(?P<host>\S+)</div><div># Values: TEXT</div><div>#</div><div>failregex = <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Call from '.*' \(<HOST>(:[0-9]{1,5})?\) to extension '.*' rejected because extension not found in context 'unauthenticated'</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* chan_sip.c: Call from '.*' \(<HOST>(:[0-9]{1,5})?\) to extension '.*' rejected because extension not found in context 'unauthenticated'</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Not a local domain</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device not configured to use this transport type</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' \(.*\)</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Host <HOST> denied access to register peer '.*'</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Host <HOST> did not provide proper plaintext password for '.*'</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Registration of '.*' rejected: '.*' from: '<HOST>'</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Peer '.*' is not dynamic (from <HOST>)</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>NOTICE.* .*: Host <HOST> denied access to register peer '.*'</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>SECURITY.* .*: SecurityEvent="InvalidAccountID".*,Severity="Error",Service="SIP".*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>SECURITY.* .*: SecurityEvent="FailedACL".*,Severity="Error",Service="SIP".*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>SECURITY.* .*: SecurityEvent="InvalidPassword".*,Severity="Error",Service="SIP".*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"</div><div> <span class="Apple-tab-span" style="white-space:pre"> </span>SECURITY.* .*: SecurityEvent="ChallengeResponseFailed".*,Severity="Error",Service="SIP".*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>VERBOSE.* logger.c: -- .*IP/<HOST>-.* Playing 'ss-noservice' \(language '.*'\)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>SECURITY.* .*: SecurityEvent="ChallengeSent".*,Severity="Informational",Service="SIP".*,AccountID="sip:<a href="mailto:.*@93.94.247.123">.*@93.94.247.123</a>".*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+</div><div><span class="Apple-tab-span" style="white-space:pre"> </span><span class="Apple-tab-span" style="white-space:pre"> </span>WARNING.* .*: fail2ban='<HOST>'</div><div><br></div><div># Option: ignoreregex</div><div># Notes.: regex to ignore. If this regex matches, the line is ignored.</div><div># Values: TEXT</div><div>#</div><div>ignoreregex =</div><div><br></div><div><br></div></body></html>