<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-2022-jp">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello, fail2ban does not ban offending IP. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>NOTICE[29784] chan_sip.c: Registration from '"user3"<sip:1005@asterisk-ip:5060>' failed for 'offending-IP:53417' - Wrong password<o:p></o:p></p><p class=MsoNormal>NOTICE[29784] chan_sip.c: Registration from '"user3"<sip:1005@asterisk-ip:5060>' failed for ‘offending-IP:53911' - Wrong password<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>systemctl status fail2ban<o:p></o:p></p><p class=MsoNormal>● fail2ban.service - Fail2Ban Service<o:p></o:p></p><p class=MsoNormal> Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: disabled)<o:p></o:p></p><p class=MsoNormal> Active: active (running) since Wed 2017-03-01 00:40:43 PST; 470min ago<o:p></o:p></p><p class=MsoNormal> Docs: man:fail2ban(1)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>jail.local<o:p></o:p></p><p class=MsoNormal>[DEFAULT]<o:p></o:p></p><p class=MsoNormal># "bantime" is the number of seconds that a host is banned.<o:p></o:p></p><p class=MsoNormal>bantime = -1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># A host is banned if it has generated "maxretry" during the last "findtime"<o:p></o:p></p><p class=MsoNormal># seconds.<o:p></o:p></p><p class=MsoNormal>findtime = 300<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># "maxretry" is the number of failures before a host get banned.<o:p></o:p></p><p class=MsoNormal>maxretry = 3<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[asterisk-iptables]<o:p></o:p></p><p class=MsoNormal>enable = true<o:p></o:p></p><p class=MsoNormal>port = 5060,5061<o:p></o:p></p><p class=MsoNormal>filter = asterisk<o:p></o:p></p><p class=MsoNormal>action = iptables-allports[name=ASTERISK, protocol=all]<o:p></o:p></p><p class=MsoNormal> sendmail[name=ASTERISK, dest=motty@email.com, sender=fail2ban@asterisk-ip.com]<o:p></o:p></p><p class=MsoNormal>#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]<o:p></o:p></p><p class=MsoNormal> %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]<o:p></o:p></p><p class=MsoNormal> %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]<o:p></o:p></p><p class=MsoNormal>logpath = /var/log/asterisk/messages<o:p></o:p></p><p class=MsoNormal>maxretry = 3<o:p></o:p></p><p class=MsoNormal>findtime = 300<o:p></o:p></p><p class=MsoNormal>bantime = -1<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>in filter.d<o:p></o:p></p><p class=MsoNormal>asterisk.conf<o:p></o:p></p><p class=MsoNormal>failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:¥d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error ¥(permit/deny¥)|Not a local domain)$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s Call from '[^']*' ¥(<HOST>:¥d+¥) to extension '[^']*' rejected because extension not found in context<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s No registration for peer '[^']*' ¥(from <HOST>¥)$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' ¥([^)]+¥)$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>¥S*$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s hacking attempt detected '<HOST>'$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([¥d-]+|%(iso8601)s)",Severity="[¥w]+",Service="[¥w]+",EventVersion="¥d+",AccountID="(¥d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[¥da-fA-F:.]+/¥d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/¥d+"(,Challenge="[¥w/]+")?(,ReceivedChallenge="¥w+")?(,Response="¥w+",ExpectedResponse="¥w*")?(,ReceivedHash="[¥da-f]+")?(,ACLName="¥w+")?$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from <HOST>"$<o:p></o:p></p><p class=MsoNormal> ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '<HOST>(?::¥d+)?'¥s¥(callid: [^¥)]*¥) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)¥s*$<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<o:p></o:p></p><p class=MsoNormal> NOTICE.* <HOST> failed to authenticate as '.*'$<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: No registration for peer '.*' ¥(from <HOST>¥)<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Failed to authenticate user .*@<HOST>.*<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Sending fake auth rejection for device .*¥<sip:.*¥@<HOST>¥>;tag=.*<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '¥".*¥".*' failed for '<HOST>' - No matching peer found<o:p></o:p></p><p class=MsoNormal> NOTICE.* .*: Registration from '¥".*¥".*' failed for '<HOST>' - Wrong password<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>ignoreregex =<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks<o:p></o:p></p><p class=MsoNormal>Motty<o:p></o:p></p></div></body></html>