mint 19 fail2ban asterisk

Fail2Ban

2020.01.292023.01.18

# apt-get install fail2ban

# cp /etc/fail2ban/fail2ban.conf  /etc/fail2ban/fail2ban.local

# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# rm /etc/fail2ban/jail.d/*

# vi /etc/fail2ban/action.d/iptables-asterisk.conf

# Fail2Ban configuration file
#
# Author: Razvan Turtureanu
#
# $Revision$
#

[Definition]

# Option: actionstart
# Notes.: command executed once at the start of Fail2Ban.
# Values: CMD
#
actionstart = iptables -N fail2ban-<name>
iptables -A fail2ban-<name> -j RETURN
iptables -I <chain> -p tcp --dport 5061 -j fail2ban-<name>
iptables -I <chain> -p udp --dport 5060 -j fail2ban-<name>
iptables -I <chain> -p tcp --dport 5060 -j fail2ban-<name>

# Option: actionstop
# Notes.: command executed once at the end of Fail2Ban
# Values: CMD
#
actionstop = iptables -D <chain> -p tcp --dport 5061 -j fail2ban-<name>
iptables -D <chain> -p udp --dport 5060 -j fail2ban-<name>
iptables -D <chain> -p tcp --dport 5060 -j fail2ban-<name>
iptables -F fail2ban-<name>
iptables -X fail2ban-<name>

# Option: actioncheck
# Notes.: command executed once before each actionban command
# Values: CMD
#
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

# Option: actionban
# Notes.: command executed when banning an IP. Take care that the
# command is executed with Fail2Ban user rights.
# Tags: <ip> IP address
# <failures> number of failures
# <time> unix timestamp of the ban time
# Values: CMD
#
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP

# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the

# vi /etc/fail2ban/jail.local

[DEFAULT]
bantime = 864000 ; 10 day
ignoreip = 127.0.0.1 192.168.1.0/24 8.8.8.8 8.8.4.4 117.102.195.171 167.99.119.244 167.99.119.203 167.99.48.91 165.227.184.188 159.65.253.49 159.65.252.186 159.65.251.173 159.65.186.176 107.170.123.70

[sshd]
enabled = true

[asterisk]
enabled = true
filter = asterisk
action = iptables-asterisk[name=asterisk]
sendmail[name=Asterisk, dest=ckenko25@gmail.com, sender=root]
logpath = /var/log/asterisk/full
bantime = 31536000 ; 1 year
findtime = 86400 ;1 day
maxretry = 5