Fail2Ban

開始安裝

yast > Software > Software Management >

Search Phrase = fail2ban <Enter>

Actions = Install <項目會出現＋號>

Accept <Enter>

設定 Fail2ban

vi /etc/fail2ban/filter.d/asterisk.conf

# Fail2Ban configuration file
#
#
# $Revision: 250 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf


[Definition]

#_daemon = asterisk

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#

failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
            NOTICE.* .*: Registration from '.*" .* failed for '<HOST>' - Peer is not supposed to register
            NOTICE.* <HOST> failed to authenticate as '.*'$
            NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
            NOTICE.* .*: Failed to authenticate user .*@<HOST>.*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

vi /etc/fail2ban/jail.conf

##
[asterisk-iptables]

enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=root, sender=fail2ban@example.org]
logpath  = /var/log/asterisk/fail2ban
maxretry = 5
bantime = 259200

NOTES:

logpath  路徑必須與下述的 logger.conf 的設定相同。

設定 Asterisk

vi /etc/asterisk/logger.conf

[general]
dateformat=%F %T

[logfiles]
console => notice,warning,error
messages => notice,warning,error,debug,verbose
fail2ban => notice

NOTES:

增加  dateformat 與 fail2ban logfile

啟動 Fail2ban

// 載入 Asterisk 的 logger 設定

asterisk -rx "module reload logger"
asterisk -rx "logger show channels"

Channel                             Type     Status    Configuration
-------                             ----     ------    -------------
/var/log/asterisk/fail2ban          File     Enabled    - Notice
/var/log/asterisk/messages          File     Enabled    - Debug Verbose Warning Notice Error
                                    Console  Enabled    - Warning Notice Error

// 開機自動啟動 Fail2ban

yast > System

參考連結

• Preventing Brute Force Attacks With Fail2ban On OpenSUSE 10.3
• Fail2ban - Asterisk
• Fail2Ban (with iptables) And Asterisk (voip-info)
• Install Fail2Ban on Elastix 1.6