<span style="font-family: Arial, Helvetica, Sans-Serif; font-size: 12px"><div>John V</div>
<div> </div>
<div>Are you using pjsip? We are have several test servers and I just checked my /etc/fail2ban/filter.d/asterisk.conf and it is not updated for pjsip implementations. Looking at the security log files and the regex I noticed that some items are being banned but others are not due to changes in the messages for pjsip. </div>
<div>Anyone got an updated asterisk.conf for fail2ban.</div>
<div> </div>
<div>Bryant</div>
<div> </div>
<hr align="center" size="2" width="100%" />
<div><span style="font-family: tahoma,arial,sans-serif; font-size: 10pt;"><b>From</b>: "Telium Technical Support" <support@telium.ca><br />
<b>Sent</b>: Wednesday, March 1, 2017 9:54 PM<br />
<b>To</b>: "Asterisk Users Mailing List - Non-Commercial Discussion" <asterisk-users@lists.digium.com><br />
<b>Subject</b>: Re: [asterisk-users] fail2ban Asterisk 13.13.1</span>
<div> </div>
<style type="text/css"><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<div class="WordSection1">
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">If this is a small site, I recommend you download the free version of SecAst (<a href="http://www.telium.ca">www.telium.ca</a>) and replace fail2ban. SecAst does NOT use the log file, or regexes, to match etc…instead it talks to Asterisk through the AMI to extract security information. Messing with regexes is a losing battle, and the lag in reading logs can allow an attacker 100+ registration attempts before fail2ban even does anything (assuming the IP is exposed in the Asterisk log).</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">If this is a large install then post in the commercial list for more information.</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">-Raj-</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentColor currentColor; padding: 3pt 0cm 0cm; border-image: none;">
<p class="MsoNormal"><b>From:</b> asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] <b>On Behalf Of </b>Tech Support<br />
<b>Sent:</b> Wednesday, March 1, 2017 2:37 PM<br />
<b>To:</b> 'Asterisk Users Mailing List - Non-Commercial Discussion' <asterisk-users@lists.digium.com><br />
<b>Subject:</b> Re: [asterisk-users] fail2ban Asterisk 13.13.1</p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> It's possible that you need to increase the value of ‘findtime’ to something greater than 300 secs. You also may want to set “timestamp = yes” in asterisk.conf so each line in the CLI will be time stamped. Time stamping it will be the definitive determination on whether or not the ‘findtime’ is the culprit.</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">Regards;</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">John V. </span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentColor currentColor; padding: 3pt 0cm 0cm; border-image: none;">
<p class="MsoNormal"><b><span style="font-family: "Tahoma",sans-serif; font-size: 10pt;">From:</span></b><span style="font-family: "Tahoma",sans-serif; font-size: 10pt;"> <a href="mailto:asterisk-users-bounces@lists.digium.com">asterisk-users-bounces@lists.digium.com</a> [<a href="mailto:asterisk-users-bounces@lists.digium.com">mailto:asterisk-users-bounces@lists.digium.com</a>] <b>On Behalf Of </b>Motty Cruz<br />
<b>Sent:</b> Wednesday, March 01, 2017 01:29 PM<br />
<b>To:</b> 'Asterisk Users Mailing List - Non-Commercial Discussion'<br />
<b>Subject:</b> [asterisk-users] fail2ban Asterisk 13.13.1</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Hello, fail2ban does not ban offending IP.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">NOTICE[29784] chan_sip.c: Registration from '"user3"<<a href="sip:1005@asterisk-ip:5060">sip:1005@asterisk-ip:5060</a>>' failed for 'offending-IP:53417' - Wrong password</p>
<p class="MsoNormal">NOTICE[29784] chan_sip.c: Registration from '"user3"<<a href="sip:1005@asterisk-ip:5060">sip:1005@asterisk-ip:5060</a>>' failed for ‘offending-IP:53911' - Wrong password</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"># A host is banned if it has generated "maxretry" during the last "findtime"</p>
<p class="MsoNormal"># seconds.</p>
<p class="MsoNormal">findtime = 300</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">[asterisk-iptables]</p>
<p class="MsoNormal">enable = true</p>
<p class="MsoNormal">port = 5060,5061</p>
<p class="MsoNormal">filter = asterisk</p>
<p class="MsoNormal">action = iptables-allports[name=ASTERISK, protocol=all]</p>
<p class="MsoNormal"> sendmail[name=ASTERISK, <a href="mailto:dest=motty@email.com">dest=motty@email.com</a>, <a href="mailto:sender=fail2ban@asterisk-ip.com">sender=fail2ban@asterisk-ip.com</a>]</p>
<p class="MsoNormal">#action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]</p>
<p class="MsoNormal"> %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]</p>
<p class="MsoNormal"> %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]</p>
<p class="MsoNormal">logpath = /var/log/asterisk/messages</p>
<p class="MsoNormal">maxretry = 3</p>
<p class="MsoNormal">findtime = 300</p>
<p class="MsoNormal">bantime = -1</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">in filter.d</p>
<p class="MsoNormal">asterisk.conf</p>
<p class="MsoNormal">failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s hacking attempt detected '<HOST>'$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from <HOST>"$</p>
<p class="MsoNormal"> ^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - ACL error (permit/deny)</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL</p>
<p class="MsoNormal"> NOTICE.* <HOST> failed to authenticate as '.*'$</p>
<p class="MsoNormal"> NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)</p>
<p class="MsoNormal"> NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)</p>
<p class="MsoNormal"> NOTICE.* .*: Failed to authenticate user <a href="mailto:.*@%3cHOST%3e.*">.*@<HOST>.*</a></p>
<p class="MsoNormal"> NOTICE.* .*: Sending fake auth rejection for device .*\<<a href="sip:.*\@%3cHOST">sip:.*\@<HOST</a>>\>;tag=.*</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - No matching peer found</p>
<p class="MsoNormal"> NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - Wrong password</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">ignoreregex =</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks</p>
<p class="MsoNormal">Motty</p>
</div>
</div></span>