動作
このログファイル/var/log/asterisk/fail2ban2を監視して/etc/fail2ban/filter.d/asterisk.confに設定された条件に合致すると
iptablesで不正アクセスを停止させる
vi /etc/asterisk/logger.conf
[general]
#include logger_general_additional.conf
#include logger_general_custom.conf
dateformat=%F %T ; ISO 8601 date format
messages => security,notice,warning,error
[logfiles]
#include logger_logfiles_additional.conf
#include logger_logfiles_custom.conf
asterisk –rx “logger reload”
apt–get install fail2ban
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
enabled =true だけが有効である
実際はsshとasterisk-iptablesだけが有効である
vi /etc/fail2ban/jail.local
[asterisk-tcp]
enabled = false
filter = asterisk
port = 5060,5061
protocol = tcp
logpath = /var/log/asterisk/messages
[asterisk-udp]
enabled = false
filter = asterisk
port = 5060,5061
protocol = udp
logpath = /var/log/asterisk/messages
#新規追記
[asterisk-iptables]
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail[name=SIP, dest=ckenko25@gmail.com, sender=fail2ban@localhost]
logpath = /var/log/asterisk/fail2ban
maxretry = 4
findtime = 21600
bantime = 86400
#ホワイトリスト設定
ignoreip = 127.0.0.1 192.168.1.0/24
/var/log/asterisk/fail2ban がないときは空のファイルを作る
touch /var/log/asterisk/fail2ban
cd /etc/fail2ban/filter.d
mv asterisk.conf asterisk.conf.org
vi asterisk.conf
|
# Fail2Ban configuration file
#
#
# $Revision: 251 $
#
[INCLUDES]
# Read common prefixes. If any customizations available — read them from
# common.local
before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named “host”. The tag “<HOST>” can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
# Asterisk 1.8 uses Host:Port format which is reflected here
failregex = NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – Wrong password
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – No matching peer found
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – No matching peer found
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – Username/auth name mismatch
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – Device does not match ACL
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – Peer is not supposed to register
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – ACL error (permit/deny)
NOTICE.* .*: Registration from ‘.*’ failed for ‘<HOST>:.*’ – Device does not match ACL
NOTICE.* .*: Registration from ‘\”.*\”.*’ failed for ‘<HOST>:.*’ – No matching peer found
NOTICE.* .*: Registration from ‘\”.*\”.*’ failed for ‘<HOST>:.*’ – Wrong password
NOTICE.* <HOST> failed to authenticate as ‘.*’$
NOTICE.* .*: No registration for peer ‘.*’ \(from <HOST>\)
NOTICE.* .*: Host <HOST> failed MD5 authentication for ‘.*’ (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
NOTICE.* .*: <HOST> failed to authenticate as ‘.*’
NOTICE.* .*: <HOST> tried to authenticate with nonexistent user ‘.*’
VERBOSE.*SIP/<HOST>–.*Received incoming SIP connection from unknown peer
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
|
service fail2ban restart
freepbxの設定
設定→Asterisk SIP設定
chan SIP Setting→
フィールドを追加する
alwaysauthreject = yes
fail2banの起動確認
iptables -L
fail2banのstatusを確認する
systemctl status fail2ban
banされたIPアドレスの確認
fail2ban-client status asterisk-iptables
banされたIPアドレスの確認
apt-get install ipset
ipset –list
監視しているログファイル
/var/log/asterisk/fail2ban
コメント