No problem, I need to take notes anyway. Here they are...
A. /etc/fail2ban/filter.d/freeswitch.conf needs the following text:
NOTE: Internal and Public sofia profiles need: <param name="log-auth-failures" value="true"/>
[freeswitch]
enabled = true
port = 5060,5061,5080,5081,5076 5074 5071
filter = freeswitch
logpath = /var/log/freeswitch/freeswitch.log
maxretry = 3
C. Drop these rules into iptables to block the scanners on ports 5060 and 5080
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli" --algo bm
iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm
iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm
iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli" --algo bm
D. Change SSH port from 22 to a custom number
vi /etc/ssh/sshd_config
E. Update SSH jail in /etc/fail2ban/jail.conf to custom port number.
[ssh]
enabled = true
port = 9898,22
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
F. I also have additional security using CDR records (curl). If a call comes in that does not have an 'account number' set (a custom variable we set for all incoming and outgoing calls from our customers) then we execute a shell command to block that IP without delay because they obviously aren't one of our customers. We are using mod_httapi and all calls start that way for us, so it's easy to set the variable as all calls start with <continue>.
iptables -A INPUT -s 65.55.44.100 -j DROP
Where 65.55.44.100 is the ip to block.
Don