asterisk fail2ban blacklist

まーひつこい

対策

vi /etc/fail2ban/jail.local

[DEFAULT]
bantime = 864000 ; 10 day
ignoreip = 127.0.0.1/8

banaction = iptables-multiport

[asterisk]
enabled = true
filter = asterisk
action = iptables-asterisk[name=asterisk]

….

vi /etc/fail2ban/action.d/iptables-multiport.conf

….

actionstart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I <chain> -p <protocol> -m multiport –dports <port> -j fail2ban-<name>
cat /etc/fail2ban/ip.blacklist | while read IP; do iptables -I fail2ban-<name> 1 -s $IP -j DROP; done

….

touch /etc/fail2ban/ip.blacklist

chmod 755 /etc/fail2ban/ip.blacklist

/etc/fail2ban/ip.blacklist この中にブロックしたいipを記述する

/etc/ini.d/fail2ban restart

確認

iptables -L

Chain fail2ban-ssh (1 references)
target prot opt source destination
DROP all — 103.fr.dedicated.sh anywhere
DROP all — srv1317.fastwebserver.de anywhere
DROP all — 51-15-161-145.rev.poneytelecom.eu anywhere
DROP all — 51-15-161-156.rev.poneytelecom.eu anywhere
DROP all — 246-166-172-163.rev.cloud.scaleway.com anywhere
RETURN all — anywhere anywhere