1 | изначальная версия редактировать | |
Есть ASTERISK13, есть fail2ban. Вижу попытки регистрации с одного IP к разным к разным пирам (7-8 попыток) и с разных портов, но fail2ban не срабатывает. Почему?
2 | No.2 Revision редактировать |
Есть ASTERISK13, есть fail2ban. Вижу попытки регистрации с одного IP к разным к разным пирам (7-8 попыток) и с разных портов, но fail2ban не срабатывает. Почему?
root@ihost:~# fail2ban-regex /var/log/asterisk/security /etc/fail2ban/filter.d/asterisk.conf
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/asterisk.conf
Use log file : /var/log/asterisk/security
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [8195] Year-Month-Day Hour:Minute:Second
`-
Lines: 8195 lines, 0 ignored, 0 matched, 8195 missed
Missed line(s): too many to print. Use --print-all-missed to print all 8195 lines
3 | No.3 Revision редактировать |
Есть ASTERISK13, есть fail2ban. Вижу попытки регистрации с одного IP к разным к разным пирам (7-8 попыток) и с разных портов, но fail2ban не срабатывает. Почему?
root@ihost:~# fail2ban-regex /var/log/asterisk/security /etc/fail2ban/filter.d/asterisk.conf
Running tests
=============
Use failregex file : /etc/fail2ban/filter.d/asterisk.conf
Use log file : /var/log/asterisk/security
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [8195] Year-Month-Day Hour:Minute:Second
`-
Lines: 8195 lines, 0 ignored, 0 matched, 8195 missed
Missed line(s): too many to print. Use --print-all-missed to print all 8195 lines
В настройках:
[Definition]
_daemon = asterisk
__pid_re = (?:\[\d+\])
# All Asterisk log messages begin like this:
log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?
failregex = ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword| WrongPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d*",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])? )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
ignoreregex =
Проект компании "АТС Дизайн"
Asterisk® и Digium® являются зарегистрированными торговыми марками компании
Digium, Inc., США.
IP АТС Asterisk распространяется под лицензией
GNU GPL.