Hi Don,Yes that should do what you want.regards,DavidOn 15 September 2016 at 15:14, Don Hawkins <hawkins@hawkinsegroup.com> wrote:So, to only block failures does this regex look right? I basically just removed "failure|challenge" and replaced with "failure"failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$On Sun, Sep 11, 2016 at 2:23 AM, Angel Elena <craem@craem.net> wrote:Great!!!
Thanks for sharing.
-------------------------------- De: Don Hawkins <hawkins@hawkinsegroup.com>
Ángel Elena Medina _o)
craem@craem.net / \\
http://blog.craem.net _(___V
@craem_
--------------------------------
-----Mensaje original-----
Enviado: Dom 11-09-2016 03:22
Asunto: Re: [Freeswitch-users] Getting fail2ban working properly
Para: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org >;
> <mailto:gassaad@emassembly.com> No problem, I need to take notes anyway. Here they are...
>
>
> A. /etc/fail2ban/filter.d/freeswitch.conf needs the following text:
>
> https://github.com/fail2ban/fail2ban/blob/master/config/filt er.d/freeswitch.conf
>
> NOTE: Internal and Public sofia profiles need: <param name="log-auth-failures"
> value="true"/>
>
>
> B. /etc/fail2ban/jail.conf and in /etc/fail2ban/jail.local (not sure which one
> is working, I had to create jail.local)
>
> [freeswitch]
> enabled = true
> port = 5060,5061,5080,5081,5076 5074 5071
> filter = freeswitch
> logpath = /var/log/freeswitch/freeswitch.log
> maxretry = 3
>
>
> C. Drop these rules into iptables to block the scanners on ports 5060 and 5080
>
> iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string
> "VaxSIPUserAgent" --algo bm
> iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string
> "friendly-scanner" --algo bm
> iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli"
> --algo bm
> iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string
> "VaxSIPUserAgent" --algo bm
> iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string
> "friendly-scanner" --algo bm
> iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli"
> --algo bm
>
>
> D. Change SSH port from 22 to a custom number
>
> vi /etc/ssh/sshd_config
>
>
> E. Update SSH jail in /etc/fail2ban/jail.conf to custom port number.
>
> [ssh]
>
> enabled = true
> port = 9898,22
> filter = sshd
> logpath = /var/log/auth.log
> maxretry = 6
>
>
> F. I also have additional security using CDR records (curl). If a call comes
> in that does not have an 'account number' set (a custom variable we set for all
> incoming and outgoing calls from our customers) then we execute a shell command
> to block that IP without delay because they obviously aren't one of our
> customers. We are using mod_httapi and all calls start that way for us, so it's
> easy to set the variable as all calls start with <continue>.
>
>
> iptables -A INPUT -s 65.55.44.100 -j DROP
>
>
> Where 65.55.44.100 is the ip to block.
>
>
>
> Don
>
>
>
>
> On Sat, Sep 10, 2016 at 7:58 PM, George Assaad <gassaad@emassembly.com
> > wrote: > <mailto:hawkins@hawkinsegroup.
> Hi Don,
> Could you please share your final settings since it works.
>
> Thanks,
>
> George
>
> On Sep 10, 2016, at 5:49 PM, Don Hawkins <hawkins@hawkinsegroup.com
com > > wrote:
>
> Just want to update everyone that the registration attempts have almost stopped
> 100% since blocking the sniffers and setting a 4 hour block time after three
> failed registrations.
>
> Good day!
>
> On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com
> <mailto:jungleboogie0@gmail.com > > wrote:
> On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com
> <mailto:hawkins@hawkinsegroup.com > > wrote:
> > Can someone share with me how to block all ports except the important ones?
>
> I had the same question about a month ago:
> http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121694.html
> <http://lists.freeswitch.org/pipermail/freeswitch-users/2016 >-August/121694.html
>
>
> Colin gives good advice here:
> http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121730.html
> <http://lists.freeswitch.org/pipermail/freeswitch-users/2016 >-August/121730.html
>
>
> I've also had success with contacting the originating network and
> request their customer to stop the traffic to me.
>
> Here's the abuse form for online.net <http://online.net/> :
> https://console.online.net/en/account/abuses/search
>
> By the way, if the fail2ban page on confluence needs updating, please
> update it or list what's wrong with it. I do see it indicates to
> create the jail.local and that's what you were missing for yours to
> work properly.
>
>
> --
> -------
> inum: 883510009027723
> sip: jungleboogie@sip2sip.info <mailto:jungleboogie@sip2sip.info >
>
> ____________________________________________________________ > consulting@freeswitch.org <mailto:consulting@freeswitch._____________
> Professional FreeSWITCH Consulting Services:
org >
> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/ >
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org <http://www.freeswitch.org/>
> http://confluence.freeswitch.org <http://confluence.freeswitch.org/ >
> http://www.cluecon.com <http://www.cluecon.com/>
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> <mailto:FreeSWITCH-users@lists.freeswitch.org >
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-use >rs
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users
> <http://lists.freeswitch.org/mailman/options/freeswitch-user >s
> http://www.freeswitch.org <http://www.freeswitch.org/>
>
>
>
> --
> Sincerely,
> Don Hawkins
> CEO
> Hawkins Enterprise Group LLC
> http://hawkinsegroup.com <http://hawkinsegroup.com/>
> Zello PTT <http://zello.com/> : push2don
> P: 469-214-5044
> ____________________________________________________________ > consulting@freeswitch.org <mailto:consulting@freeswitch._____________
> Professional FreeSWITCH Consulting Services:
org >
> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com >
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org <http://www.freeswitch.org>
> http://confluence.freeswitch.org <http://confluence.freeswitch.org >
> http://www.cluecon.com <http://www.cluecon.com>
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> <mailto:FreeSWITCH-users@lists.freeswitch.org >
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-use >rs
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users
> <http://lists.freeswitch.org/mailman/options/freeswitch-user >s
> http://www.freeswitch.org <http://www.freeswitch.org>
>
>
> ____________________________________________________________ > consulting@freeswitch.org <mailto:consulting@freeswitch._____________
> Professional FreeSWITCH Consulting Services:
org >
> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com >
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org <http://www.freeswitch.org>
> http://confluence.freeswitch.org <http://confluence.freeswitch.org >
> http://www.cluecon.com <http://www.cluecon.com>
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> <mailto:FreeSWITCH-users@lists.freeswitch.org >
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-use >rs
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users
> <http://lists.freeswitch.org/mailman/options/freeswitch-user >s
> http://www.freeswitch.org <http://www.freeswitch.org>
>
>
>
> --
> Sincerely,
> Don Hawkins
> CEO
> Hawkins Enterprise Group LLC
> http://hawkinsegroup.com <http://hawkinsegroup.com>
> Zello PTT <http://zello.com> : push2don
> P: 469-214-5044
>
> ____________________________________________________________ _____________
>
> Professional FreeSWITCH Consulting Services:
>
> consulting@freeswitch.org
>
> http://www.freeswitchsolutions.com
>
>
>
> Official FreeSWITCH Sites
>
> http://www.freeswitch.org
>
> http://confluence.freeswitch.org
>
> http://www.cluecon.com
>
>
>
> FreeSWITCH-users mailing list
>
> FreeSWITCH-users@lists.freeswitch.org
>
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
>
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users
>
> http://www.freeswitch.org
>
>
____________________________________________________________ _____________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users
http://www.freeswitch.org--Zello PTT: push2donP: 469-214-5044
____________________________________________________________ _____________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-user s
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/ freeswitch-users
http://www.freeswitch.org--David WithamSenior Voice/Systems EngineerNetsip pty ltd – An Over the Wire Company
Level 1, 24 Little Edward St, Spring Hill QLD 4000t +61 1300 638 747e david.witham@netsip.com.au www.netsip.com.au
____________________________________________________________ _____________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch- users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/ options/freeswitch-users
http://www.freeswitch.org