SARK V4.0.0 Fail2ban

From sailpbx
Revision as of 16:38, 27 September 2013 by Adminwiki (talk | contribs) (→‎/etc/fail2ban/filter.d/asterisk)
Jump to: navigation, search

Up a level

Introduction

SARK200 systems after 4.0.0-84 have fail2ban pre-installed; here are the configuration settings used.

/etc/asterisk/logger.conf

Change the date format in the general section of asterisk/logger.conf as follows 

[general]

dateformat=%F %T       ; ISO 8601 date format


/etc/fail2ban/filter.d/asterisk.conf

add this file 

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf


[Definition]

#_daemon = asterisk

# Option:  failregex
# Fail2Ban configuration file
#
#
# $Revision: 251 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


[Definition]

#_daemon = asterisk

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
# Asterisk 1.8 uses Host:Port format which is reflected here

failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
            NOTICE.* <HOST> failed to authenticate as '.*'$
            NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
            NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
            NOTICE.* .*: <HOST> failed to authenticate as '.*'
            NOTICE.* .*: <HOST> tried  to authenticate with nonexistent user '.*'
            VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer
   
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

/etc/fail2ban/jail.conf

append the following to the jail.conf file 

[asterisk-iptables]

enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
#sendmail-whois[name=ASTERISK, dest=admin@yourco.com, sender=fail2ban@somepbx.com]
logpath  = /var/log/asterisk/messages
maxretry = 5
bantime = 14400

restart fail2ban

restart the fail2ban daemon 

fail2ban-client stop
fail2ban-client start

Installing fail2ban on earlier S200 releases

At the linux console run the following 

apt-get update
apt-get install fail2ban

Now use the instructions above to tailor the fail2ban files which you will find in the /etc/fail2ban tree.

Retrieved from ‘http://sailpbx.com/mediawiki/index.php?title=SARK_V4.0.0_Fail2ban&oldid=1691’