From 7d465f98c109801d6162ecb01d301aee7fbe2d8c Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Wed, 11 Jan 2012 16:35:40 +0100 Subject: [PATCH 1/8] Add asterisk support --- config/filter.d/asterisk.conf | 32 ++++++++++++++++++++++++++++++++ config/jail.conf | 8 ++++++++ 2 files changed, 40 insertions(+) create mode 100644 config/filter.d/asterisk.conf diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf new file mode 100644 index 00000000..6d493f13 --- /dev/null +++ b/config/filter.d/asterisk.conf @@ -0,0 +1,32 @@ +# Fail2Ban configuration file +# +# Author: Xavier Devlamynck +# +# $Revision$ +# + +[Definition] + +# Option: failregex +# Notes.: regex to match the password failures messages in the logfile. The +# host must be matched by a group named "host". The tag "" can +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) +# Values: TEXT +# +failregex = NOTICE.* .*: Registration from '.*' failed for '' - Wrong password + NOTICE.* .*: Registration from '.*' failed for '' - No matching peer found + NOTICE.* .*: Registration from '.*' failed for '' - Username/auth name mismatch + NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL + NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register + NOTICE.* .*: Registration from '.*' failed for '' - ACL error (permit/deny) + NOTICE.* failed to authenticate as '.*'$ + NOTICE.* .*: No registration for peer '.*' \(from \) + NOTICE.* .*: Host failed MD5 authentication for '.*' (.*) + NOTICE.* .*: Failed to authenticate user .*@.* + +# Option: ignoreregex +# Notes.: regex to ignore. If this regex matches, the line is ignored. +# Values: TEXT +# +ignoreregex = diff --git a/config/jail.conf b/config/jail.conf index cdef1cb3..6ebb223b 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -254,3 +254,11 @@ action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] logpath = /var/log/named/security.log ignoreip = 168.192.0.1 +[asterisk] +enabled = true +filter = asterisk +action = iptables-multiport[name=Asterisk, port="5060", protocol="tcp,udp"] + sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] +logpath = /var/log/asterisk/messages +maxretry = 5 +bantime = 259200 From d98cdb25d6455bfb2ff74abc40953914ae6b76bd Mon Sep 17 00:00:00 2001 From: Xavier D Date: Mon, 13 Feb 2012 17:11:32 +0100 Subject: [PATCH 2/8] Add $ at the end of the failregex --- config/filter.d/asterisk.conf | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 6d493f13..21081d98 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -14,16 +14,16 @@ # (?:::f{4,6}:)?(?P\S+) # Values: TEXT # -failregex = NOTICE.* .*: Registration from '.*' failed for '' - Wrong password - NOTICE.* .*: Registration from '.*' failed for '' - No matching peer found - NOTICE.* .*: Registration from '.*' failed for '' - Username/auth name mismatch - NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL - NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register - NOTICE.* .*: Registration from '.*' failed for '' - ACL error (permit/deny) +failregex = NOTICE.* .*: Registration from '.*' failed for '' - Wrong password$ + NOTICE.* .*: Registration from '.*' failed for '' - No matching peer found$ + NOTICE.* .*: Registration from '.*' failed for '' - Username/auth name mismatch$ + NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL$ + NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register$ + NOTICE.* .*: Registration from '.*' failed for '' - ACL error (permit/deny)$ NOTICE.* failed to authenticate as '.*'$ - NOTICE.* .*: No registration for peer '.*' \(from \) - NOTICE.* .*: Host failed MD5 authentication for '.*' (.*) - NOTICE.* .*: Failed to authenticate user .*@.* + NOTICE.* .*: No registration for peer '.*' \(from \)$ + NOTICE.* .*: Host failed MD5 authentication for '.*' (.*)$ + NOTICE.* .*: Failed to authenticate user .*@.*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From 7a76838737880122b2f2c8c0fcb952e3eb633ebd Mon Sep 17 00:00:00 2001 From: Xavier D Date: Mon, 13 Feb 2012 17:57:55 +0100 Subject: [PATCH 3/8] Add sample log file for asterisk --- testcases/files/logs/asterisk | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 testcases/files/logs/asterisk diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk new file mode 100644 index 00000000..4715f608 --- /dev/null +++ b/testcases/files/logs/asterisk @@ -0,0 +1,11 @@ +# Sample log files for asterisk +[2012-02-13 17:21:54] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - Wrong password +[2012-02-13 17:18:22] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - No matching peer found +[2012-02-13 17:21:21] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - Username/auth name mismatch +[2012-02-13 17:32:01] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - Device does not match ACL +[2012-02-13 17:34:10] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - Peer is not supposed to register +[2012-02-13 17:36:23] NOTICE[1638] chan_sip.c: Registration from '' failed for '1.2.3.4' - ACL error (permit/deny) +[2012-02-13 17:53:59] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed to authenticate as 'Fail2ban' +[2012-02-13 17:39:20] NOTICE[1638] chan_iax2.c: No registration for peer 'Fail2ban' (from 1.2.3.4) +[2012-02-13 17:44:26] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed MD5 authentication for 'Fail2ban' (e7df7cd2ca07f4f1ab415d457a6e1c13 != 53ac4bc41ee4ec77888ed4aa50677247) +[2012-02-13 17:37:07] NOTICE[1638] chan_sip.c: Failed to authenticate user "Fail2ban" ;tag=1r698745234 From c7613ce311ab2f3290d8f159ca3a7d75c7fa62dd Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Wed, 15 Feb 2012 18:55:35 +0100 Subject: [PATCH 4/8] Remove custom bantime --- config/jail.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 6ebb223b..fa144933 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -261,4 +261,3 @@ action = iptables-multiport[name=Asterisk, port="5060", protocol="tcp,udp"] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath = /var/log/asterisk/messages maxretry = 5 -bantime = 259200 From c679a1a588e70fdf95ce652fea34742b8b75148c Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Tue, 21 Feb 2012 18:05:53 +0100 Subject: [PATCH 5/8] Change NOTICE by NOTICE%(__pid_re)s --- config/filter.d/asterisk.conf | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 21081d98..4f15ff56 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -14,16 +14,16 @@ # (?:::f{4,6}:)?(?P\S+) # Values: TEXT # -failregex = NOTICE.* .*: Registration from '.*' failed for '' - Wrong password$ - NOTICE.* .*: Registration from '.*' failed for '' - No matching peer found$ - NOTICE.* .*: Registration from '.*' failed for '' - Username/auth name mismatch$ - NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL$ - NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register$ - NOTICE.* .*: Registration from '.*' failed for '' - ACL error (permit/deny)$ - NOTICE.* failed to authenticate as '.*'$ - NOTICE.* .*: No registration for peer '.*' \(from \)$ - NOTICE.* .*: Host failed MD5 authentication for '.*' (.*)$ - NOTICE.* .*: Failed to authenticate user .*@.*$ +failregex = NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - Wrong password$ + NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - No matching peer found$ + NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - Username/auth name mismatch$ + NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - Device does not match ACL$ + NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - Peer is not supposed to register$ + NOTICE%(__pid_re)s .*: Registration from '.*' failed for '' - ACL error (permit/deny)$ + NOTICE%(__pid_re)s failed to authenticate as '.*'$ + NOTICE%(__pid_re)s .*: No registration for peer '.*' \(from \)$ + NOTICE%(__pid_re)s .*: Host failed MD5 authentication for '.*' (.*)$ + NOTICE%(__pid_re)s .*: Failed to authenticate user .*@.*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. From df0e0fdc07313caf976bc37203824d826774fcce Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Tue, 21 Feb 2012 18:53:44 +0100 Subject: [PATCH 6/8] Change jail for asterisk, add support for SIP and SIP-TLS on TCP and UDP ports --- config/jail.conf | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index fa144933..2e433e0c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -254,10 +254,18 @@ action = iptables-multiport[name=Named, port="domain,953", protocol=tcp] logpath = /var/log/named/security.log ignoreip = 168.192.0.1 -[asterisk] +[asterisk-tcp] enabled = true filter = asterisk -action = iptables-multiport[name=Asterisk, port="5060", protocol="tcp,udp"] +action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] logpath = /var/log/asterisk/messages -maxretry = 5 +maxretry = 10 + +[asterisk-udp] +enabled = true +filter = asterisk +action = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp] + sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] +logpath = /var/log/asterisk/messages +maxretry = 10 From 180c17bede4bb6301b7de2be241f4513a877e5ff Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Mon, 27 Feb 2012 16:14:18 +0100 Subject: [PATCH 7/8] Disable asterisk jail by default --- config/jail.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 2e433e0c..c51aa6bf 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -255,7 +255,7 @@ logpath = /var/log/named/security.log ignoreip = 168.192.0.1 [asterisk-tcp] -enabled = true +enabled = false filter = asterisk action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] @@ -263,7 +263,7 @@ logpath = /var/log/asterisk/messages maxretry = 10 [asterisk-udp] -enabled = true +enabled = false filter = asterisk action = iptables-multiport[name=asterisk-udp, port="5060,5061", protocol=udp] sendmail-whois[name=Asterisk, dest=you@example.com, sender=fail2ban@example.com] From 8c00ce0a653d090c7cdb4fe1c415f8ee64446443 Mon Sep 17 00:00:00 2001 From: Xavier Devlamynck Date: Tue, 28 Feb 2012 17:28:06 +0100 Subject: [PATCH 8/8] Add the INCLUDE section to use __pid_re feature --- config/filter.d/asterisk.conf | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 4f15ff56..73947a67 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -5,6 +5,13 @@ # $Revision$ # + +[INCLUDES] + +# Read common prefixes. If any customizations available -- read them from +# common.local +before = common.conf + [Definition] # Option: failregex