Hello.

I have this config for freeswitch:

jail.local:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5
[freeswitch]
enabled  = true
port     = 5060,5061,5080,5081
ignoreip = 127.0.0.1/8 10.10.0.0/16
filter   = freeswitch
logpath  = /var/log/freeswitch/freeswitch.log
maxretry = 1
findtime = 600
bantime  = 60
action   = iptables-ban


freeswitch.conf:

[Definition]

failregex = ^[-: \.\d]+ \[WARNING\] sofia_reg\.c:\d+ Can't find user
\[\d+@[^\]]+\] from <HOST>$

ignoreregex =



When running

fail2ban-regex /var/log/freeswitch/freeswitch.log
/etc/fail2ban/filter.d/freeswitch.conf

There are matches with failed users:

/usr/share/fail2ban/server/filter.py:442: DeprecationWarning: the md5
module is deprecated; use hashlib instead
   import md5

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/freeswitch.conf
Use log file   : /var/log/freeswitch/freeswitch.log


Results
=======

Failregex
|- Regular expressions:
|  [1] ^[-: \.\d]+ \[WARNING\] sofia_reg\.c:\d+ Can't find user
\[\d+@[^\]]+\] from <HOST>$
|
`- Number of matches:
    [1] 18 match(es)

Ignoreregex
|- Regular expressions:
|
`- Number of matches:

Summary
=======

Addresses found:
[1]
     163.172.194.73 (Wed May 11 10:16:54 2016)
     163.172.194.73 (Wed May 11 10:18:02 2016)
     163.172.194.73 (Wed May 11 10:18:30 2016)
     163.172.194.73 (Wed May 11 10:18:40 2016)
     163.172.194.73 (Wed May 11 10:19:10 2016)
     163.172.194.73 (Wed May 11 10:19:29 2016)
     163.172.194.73 (Wed May 11 10:20:10 2016)
     163.172.194.73 (Wed May 11 10:20:30 2016)
     163.172.194.73 (Wed May 11 10:20:37 2016)
     163.172.194.73 (Wed May 11 10:21:42 2016)
     163.172.194.73 (Wed May 11 10:21:53 2016)
     163.172.194.73 (Wed May 11 10:22:00 2016)
     163.172.194.73 (Wed May 11 10:22:50 2016)
     163.172.194.73 (Wed May 11 10:23:13 2016)
     163.172.194.73 (Wed May 11 10:23:28 2016)
     163.172.194.73 (Wed May 11 10:23:30 2016)
     163.172.194.73 (Wed May 11 10:25:07 2016)
     163.172.194.73 (Wed May 11 10:25:29 2016)

Date template hits:
0 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
5196 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>

Success, the total number of match is 18

However, look at the above section 'Running tests' which could contain
important
information.


However, fail2ban does not ban that ip. Although when ssh login attempt
is detected, fail2ban does ban the ip.

I've checked the time and time zone and all ok. On server Local time is
+3 from UTC. sshd log, freeswitch log and fail2ban log are in same time
zone.

What could be the culprit?

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org