From 04d28fd2e1bb2be5ac82555fb8898fb5239ca658 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Fri, 3 Jan 2014 13:00:37 +1100 Subject: [PATCH 1/5] ENH: add filter freeswitch - as raised on mailing list --- ChangeLog | 2 ++ config/filter.d/freeswitch.conf | 14 ++++++++++++++ config/jail.conf | 12 ++++++++++++ testcases/files/logs/freeswitch | 2 ++ 4 files changed, 30 insertions(+) create mode 100644 config/filter.d/freeswitch.conf create mode 100644 testcases/files/logs/freeswitch diff --git a/ChangeLog b/ChangeLog index c092037a..d4dae353 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,8 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - Add filter for apache-modsecurity - filter.d/nsd.conf -- also amended Unix date template to match nsd format - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543 + - Added filter for freeswitch. Thanks Jim and editors and authors of + http://wiki.freeswitch.org/wiki/Fail2ban - Enhancements: - loglines now also report "[PID]" after the name portion diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf new file mode 100644 index 00000000..3835c5ad --- /dev/null +++ b/config/filter.d/freeswitch.conf @@ -0,0 +1,14 @@ +# Fail2Ban configuration file +# +# In freeswitch configuration: +# + +[Definition] + +failregex = ^\.\d+ \[WARNING\] sofia_reg.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip + +ignoreregex = + +# Author: Rupa SChomaker, soapee01, Daniel Black +# http://wiki.freeswitch.org/wiki/Fail2ban +# diff --git a/config/jail.conf b/config/jail.conf index e9441416..3f660d2c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -382,6 +382,18 @@ action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] logpath = /var/log/asterisk/messages maxretry = 10 + +[freeswitch] + +enabled = false +port = 5060,5061,5080,5081 +filter = freeswitch +logpath = /var/log/freeswitch.log +maxretry = 10 +action = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp] + iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp] + + # Historical support (before https://github.com/fail2ban/fail2ban/issues/37 was fixed ) # use [asterisk] for new jails [asterisk-tcp] diff --git a/testcases/files/logs/freeswitch b/testcases/files/logs/freeswitch new file mode 100644 index 00000000..96e2b1cf --- /dev/null +++ b/testcases/files/logs/freeswitch @@ -0,0 +1,2 @@ +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "81.94.202.251" } +2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251 From d1faae3b3bb91ba170d50a25c8621550c8670fa1 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 4 Jan 2014 08:01:42 +1100 Subject: [PATCH 2/5] BF: port not used in jail definition for freeswitch --- config/jail.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 3f660d2c..1d58edbe 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -386,7 +386,6 @@ maxretry = 10 [freeswitch] enabled = false -port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch.log maxretry = 10 From 36533de6bcf5cfa0a9c5c90d653bd0bf211ef97d Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 4 Jan 2014 08:21:22 +1100 Subject: [PATCH 3/5] ENH: more filter expressions for freeswitch. Anchored existing one at end too --- config/filter.d/freeswitch.conf | 5 ++++- testcases/files/logs/freeswitch | 9 +++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index 3835c5ad..7356286a 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -5,10 +5,13 @@ [Definition] -failregex = ^\.\d+ \[WARNING\] sofia_reg.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip +failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip $ + ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from $ + ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP Rejected by acl "\S+"\. Falling back to Digest auth\.$ ignoreregex = # Author: Rupa SChomaker, soapee01, Daniel Black # http://wiki.freeswitch.org/wiki/Fail2ban +# Thanks to Jim on mailing list of samples and guidance # diff --git a/testcases/files/logs/freeswitch b/testcases/files/logs/freeswitch index 96e2b1cf..8b0ebec4 100644 --- a/testcases/files/logs/freeswitch +++ b/testcases/files/logs/freeswitch @@ -1,2 +1,11 @@ # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "81.94.202.251" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251 +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" } +2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1478 SIP auth failure (INVITE) on sofia profile 'internal' for [000972543480510@192.168.2.51] from ip 5.11.47.236 +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "185.24.234.141" } +2013-12-31 17:39:54.767815 [DEBUG] sofia.c:7954 IP 185.24.234.141 Rejected by acl "domains". Falling back to Digest auth. + +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" } +2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:2531 Can't find user [1001@192.168.2.51] from 5.11.47.236 +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "185.24.234.141" } +2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:2531 Can't find user [100@192.168.2.51] from 185.24.234.141 From 477f30665a2ac8f5a8bb0c6beaa2427d3f2f7243 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 4 Jan 2014 08:31:42 +1100 Subject: [PATCH 4/5] DOC: ignoreip for internal ips on freeswitch --- config/filter.d/freeswitch.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index 7356286a..13204a1e 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -2,6 +2,9 @@ # # In freeswitch configuration: # +# In the fail2ban jail.local file for this filter set ignoreip to the internal +# IP addresses on your LAN. +# [Definition] From 69b3a1cf64e8c6960db7ebb0b6d11d0df4d52909 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 4 Jan 2014 12:10:51 +1100 Subject: [PATCH 5/5] BF: catchin DEBUG messages will result in duplicates --- config/filter.d/freeswitch.conf | 3 ++- testcases/files/logs/freeswitch | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf index 13204a1e..70a1b810 100644 --- a/config/filter.d/freeswitch.conf +++ b/config/filter.d/freeswitch.conf @@ -10,7 +10,6 @@ failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip $ ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from $ - ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP Rejected by acl "\S+"\. Falling back to Digest auth\.$ ignoreregex = @@ -18,3 +17,5 @@ ignoreregex = # http://wiki.freeswitch.org/wiki/Fail2ban # Thanks to Jim on mailing list of samples and guidance # +# No need to match the following. Its a duplicate of the SIP auth regex. +# ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP Rejected by acl "\S+"\. Falling back to Digest auth\.$ diff --git a/testcases/files/logs/freeswitch b/testcases/files/logs/freeswitch index 8b0ebec4..f151995c 100644 --- a/testcases/files/logs/freeswitch +++ b/testcases/files/logs/freeswitch @@ -2,7 +2,7 @@ 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251 # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" } 2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1478 SIP auth failure (INVITE) on sofia profile 'internal' for [000972543480510@192.168.2.51] from ip 5.11.47.236 -# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "185.24.234.141" } +# failJSON: { "time": "2013-12-31T17:39:54", "match": false } 2013-12-31 17:39:54.767815 [DEBUG] sofia.c:7954 IP 185.24.234.141 Rejected by acl "domains". Falling back to Digest auth. # failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "5.11.47.236" }