Fail2ban - A tool against brute force - Revision history

Pw44 at 05:58, 23 February 2013

2013-02-23T05:58:56Z

←Older revision		Revision as of 05:58, 23 February 2013
Line 1:		Line 1:
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44\|1004Status=Works\|1004UpdatedDate=23 January 2013\|1004UpdatedBy=pw44}}
	~~{{versioninfo~~\|1004Status=Works\|1004UpdatedDate=23 January 2013\|1004UpdatedBy=pw44}}

Pw44 at 05:57, 23 February 2013

2013-02-23T05:57:41Z

←Older revision		Revision as of 05:57, 23 February 2013
Line 1:		Line 1:
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}
			{{versioninfo\|1004Status=Works\|1004UpdatedDate=23 January 2013\|1004UpdatedBy=pw44}}


	Having asterik installed is almost an invitation for others wishing to place calls at your expense.		Having asterik installed is almost an invitation for others wishing to place calls at your expense.

Pw44 at 05:54, 23 February 2013

2013-02-23T05:54:35Z

←Older revision		Revision as of 05:54, 23 February 2013
Line 87:		Line 87:
	#		#
	ignoreregex =		ignoreregex =


	'''FOR ASTERISK 1.8''', insert the following (copy & paste)		'''FOR ASTERISK 1.8''', insert the following (copy & paste)

	# Fail2Ban configuration file		# Fail2Ban configuration file
	#		#
	#		#
	# $Revision: 250 $		# $Revision: 250 $
	#		#
	[INCLUDES]		[INCLUDES]
	# Read common prefixes. If any customizations available -- read them from		# Read common prefixes. If any customizations available -- read them from
	# common.local		# common.local
	#before = common.conf		#before = common.conf
	[Definition]		[Definition]
	#_daemon = asterisk		#_daemon = asterisk
	# Option: failregex		# Option: failregex
	# Notes.: regex to match the password failures messages in the logfile. The		# Notes.: regex to match the password failures messages in the logfile. The
	# host must be matched by a group named "host". The tag "<HOST>" can		# host must be matched by a group named "host". The tag "<HOST>" can
	# be used for standard IP/hostname matching and is only an alias for		# be used for standard IP/hostname matching and is only an alias for
	# (?:::f{4,6}:)?(?P<host>\S+)		# (?:::f{4,6}:)?(?P<host>\S+)
	# Values: TEXT		# Values: TEXT
	#		#
	failregex = NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Wrong password		failregex = NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Wrong password
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - No matching peer found		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - No matching peer found
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - No matching peer found		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - No matching peer found
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Username/auth name mismatch		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Username/auth name mismatch
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Device does not match ACL		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Device does not match ACL
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Peer is not supposed to register		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Peer is not supposed to register
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - ACL error (permit/deny)		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - ACL error (permit/deny)
	NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Device does not match ACL		NOTICE.* .: Registration from '.' failed for '<HOST>:.*' - Device does not match ACL
	NOTICE.* .: Registration from '\".\".' failed for '<HOST>:.' - No matching peer found		NOTICE.* .: Registration from '\".\".' failed for '<HOST>:.' - No matching peer found
	NOTICE.* .: Registration from '\".\".' failed for '<HOST>:.' - Wrong password		NOTICE.* .: Registration from '\".\".' failed for '<HOST>:.' - Wrong password
	NOTICE.* <HOST> failed to authenticate as '.*'$		NOTICE.* <HOST> failed to authenticate as '.*'$
	NOTICE.* .: No registration for peer '.' $from <HOST>$		NOTICE.* .: No registration for peer '.' $from <HOST>$
	NOTICE.* .: Host <HOST> failed MD5 authentication for '.' (.*)		NOTICE.* .: Host <HOST> failed MD5 authentication for '.' (.*)
	NOTICE.* .: Failed to authenticate user .@<HOST>.*		NOTICE.* .: Failed to authenticate user .@<HOST>.*
	NOTICE.* .: <HOST> failed to authenticate as '.'		NOTICE.* .: <HOST> failed to authenticate as '.'
	NOTICE.* .: <HOST> tried to authenticate with nonexistent user '.'		NOTICE.* .: <HOST> tried to authenticate with nonexistent user '.'
	VERBOSE.SIP/<HOST>-.Received incoming SIP connection from unknown peer		VERBOSE.SIP/<HOST>-.Received incoming SIP connection from unknown peer

	# Option: ignoreregex		# Option: ignoreregex
	# Notes.: regex to ignore. If this regex matches, the line is ignored.		# Notes.: regex to ignore. If this regex matches, the line is ignored.
	# Values: TEXT		# Values: TEXT
	#		#
	ignoreregex =		ignoreregex =

Pw44 at 05:51, 23 February 2013

2013-02-23T05:51:58Z

@@ Line 53: / Line 53: @@
   vi asterisk.conf
-insert the following (copy & paste)
+'''FOR ASTERISK 1.'''4, insert the following (copy & paste)
-  # Fail2Ban configuration file
+  # Fail2Ban configuration file (for asterisk 1.4)
+  #
+  #
@@ Line 87: / Line 87: @@
+  #
   ignoreregex =
 Next edit /etc/fail2ban/jail.conf to include the following section so that it uses the new filter.

Cfernandes at 11:44, 12 January 2013

2013-01-12T11:44:16Z

←Older revision		Revision as of 11:44, 12 January 2013
Line 12:		Line 12:
	Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with		Files under /etc/asterisk/ are owned by the asterisk user, so preceed any edit commands with
	sudo -u asterisk <command>		sudo -u asterisk <command>

			on Linuxmce 1004 no need to edit sip.conf this is implemented on asterisk realtime database.

	The first thing to do is edit /etc/asterisk/sip.conf and add the following line:		The first thing to do is edit /etc/asterisk/sip.conf and add the following line:
	alwaysauthreject=yes		alwaysauthreject=yes

Mcefan at 22:34, 19 October 2012

2012-10-19T22:34:26Z

←Older revision		Revision as of 22:34, 19 October 2012
Line 1:		Line 1:
	~~[[Category: Tutorials\|Firewall, fail2ban]]~~
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}

Mcefan at 04:40, 9 October 2012

2012-10-09T04:40:22Z

←Older revision		Revision as of 04:40, 9 October 2012
Line 1:		Line 1:
	[[Category: Tutorials]]		[[Category: Tutorials\|Firewall, fail2ban]]
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}

Mcefan at 11:20, 8 October 2012

2012-10-08T11:20:08Z

←Older revision		Revision as of 11:20, 8 October 2012
Line 1:		Line 1:
	[[Category: Tutorials]]		[[Category: Tutorials]]
	[[Category: Networking\|~~firewall~~, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}

Mcefan at 11:18, 8 October 2012

2012-10-08T11:18:49Z

←Older revision		Revision as of 11:18, 8 October 2012
Line 1:		Line 1:
	[[Category: Tutorials]]		[[Category: Tutorials]]
	[[Category: Networking]]		[[Category: Networking\|firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}

Pw44 at 21:04, 15 October 2010

2010-10-15T21:04:03Z

←Older revision		Revision as of 21:04, 15 October 2010
Line 245:		Line 245:


	I hope this helps.		I hope this wiki helps.

	source:		source:

←Older revision		Revision as of 05:58, 23 February 2013
Line 1:		Line 1:
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44\|1004Status=Works\|1004UpdatedDate=23 January 2013\|1004UpdatedBy=pw44}}
	~~{{versioninfo~~\|1004Status=Works\|1004UpdatedDate=23 January 2013\|1004UpdatedBy=pw44}}

←Older revision		Revision as of 22:34, 19 October 2012
Line 1:		Line 1:
	~~[[Category: Tutorials\|Firewall, fail2ban]]~~
	[[Category: Networking\|Firewall, fail2ban]]		[[Category: Networking\|Firewall, fail2ban]]
	{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}		{{versioninfo\|810Status=Works\|810UpdatedDate=5 October 2010\|810UpdatedBy=pw44}}