Getting fail2ban working properly
Morning! I've followed all instructions here, 10 times over now: https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban Then I type iptables -L f2b-freeswitch iptables: No chain/target/match by that name. It keeps saying it's not there, but I did add it, is there something I'm missing?
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules? -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
Thanks for the reply! *Fail2Ban is running:* root@sip:/etc/fail2ban# fail2ban-client start ERROR Server already running *I added everything in /etc/fail2ban/jail.conf* [ssh] enabled = true port = 22 filter = sshd logpath = /var/log/auth.log maxretry = 6 [freeswitch] enabled = true port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 10 *I also created /etc/fail2ban/filter.d/freeswitch.conf* as shown on https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/freeswitch.... *root@sip:/etc/fail2ban/filter.d# iptables -S* -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but nothing about FreeSwitch. Any help is appreciated. On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules?
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
Hi, I configured fail2ban several times a while ago, but not with freeswitch... If you see that rules are missing, just add them and you can use SSH rules as template. I believe it should make a trick. And I see from you rules, that you are allowing all traffic and this is really bad idea... You should drop everything and allow only needed traffic. With kind regards, Jurijs On Thu, Sep 8, 2016 at 12:15 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Thanks for the reply!
*Fail2Ban is running:* root@sip:/etc/fail2ban# fail2ban-client start ERROR Server already running
*I added everything in /etc/fail2ban/jail.conf*
[ssh] enabled = true port = 22 filter = sshd logpath = /var/log/auth.log maxretry = 6
[freeswitch] enabled = true port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 10
*I also created /etc/fail2ban/filter.d/freeswitch.conf* as shown on https://github.com/fail2ban/fail2ban/blob/master/ config/filter.d/freeswitch.conf
*root@sip:/etc/fail2ban/filter.d# iptables -S* -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but nothing about FreeSwitch.
Any help is appreciated.
On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules?
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On ubuntu it is called : Chain fail2ban-freeswitch (1 references) iptables -L should give you the chain if F2B started correctly, otherwise see the fail2ban log for errors. On Thu, Sep 8, 2016 at 7:42 AM, Jurijs Ivolga <jurijs.ivolga@gmail.com> wrote:
Hi,
I configured fail2ban several times a while ago, but not with freeswitch...
If you see that rules are missing, just add them and you can use SSH rules as template. I believe it should make a trick.
And I see from you rules, that you are allowing all traffic and this is really bad idea...
You should drop everything and allow only needed traffic.
With kind regards,
Jurijs
On Thu, Sep 8, 2016 at 12:15 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Thanks for the reply!
*Fail2Ban is running:* root@sip:/etc/fail2ban# fail2ban-client start ERROR Server already running
*I added everything in /etc/fail2ban/jail.conf*
[ssh] enabled = true port = 22 filter = sshd logpath = /var/log/auth.log maxretry = 6
[freeswitch] enabled = true port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 10
*I also created /etc/fail2ban/filter.d/freeswitch.conf* as shown on https://github.com/fail2ban/fail2ban/blob/master/config/ filter.d/freeswitch.conf
*root@sip:/etc/fail2ban/filter.d# iptables -S* -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but nothing about FreeSwitch.
Any help is appreciated.
On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules?
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
I cleared out the logs and reloaded fail2ban. Going back to look at the logs again now and I don't even see an attempt to load the FreeSwitch filter. fail2ban.log: 2016-09-08 18:21:16,855 fail2ban.server [3576]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.13 2016-09-08 18:21:16,856 fail2ban.jail [3576]: INFO Creating new jail 'ssh' 2016-09-08 18:21:16,856 fail2ban.jail [3576]: INFO Jail 'ssh' uses pyinotify 2016-09-08 18:21:16,862 fail2ban.jail [3576]: INFO Initiated 'pyinotify' backend 2016-09-08 18:21:16,864 fail2ban.filter [3576]: INFO Added logfile = /var/log/auth.log 2016-09-08 18:21:16,866 fail2ban.filter [3576]: INFO Set maxRetry = 6 2016-09-08 18:21:16,867 fail2ban.filter [3576]: INFO Set findtime = 600 2016-09-08 18:21:16,868 fail2ban.actions[3576]: INFO Set banTime = 1800 2016-09-08 18:21:16,889 fail2ban.jail [3576]: INFO Creating new jail 'ssh-ddos' 2016-09-08 18:21:16,890 fail2ban.jail [3576]: INFO Jail 'ssh-ddos' uses pyinotify 2016-09-08 18:21:16,896 fail2ban.jail [3576]: INFO Initiated 'pyinotify' backend 2016-09-08 18:21:16,898 fail2ban.filter [3576]: INFO Added logfile = /var/log/auth.log 2016-09-08 18:21:16,900 fail2ban.filter [3576]: INFO Set maxRetry = 6 2016-09-08 18:21:16,901 fail2ban.filter [3576]: INFO Set findtime = 600 2016-09-08 18:21:16,902 fail2ban.actions[3576]: INFO Set banTime = 1800 2016-09-08 18:21:16,910 fail2ban.jail [3576]: INFO Jail 'ssh' started 2016-09-08 18:21:16,914 fail2ban.jail [3576]: INFO Jail 'ssh-ddos' started On Thu, Sep 8, 2016 at 1:53 AM, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
On ubuntu it is called : Chain fail2ban-freeswitch (1 references)
iptables -L should give you the chain if F2B started correctly, otherwise see the fail2ban log for errors.
On Thu, Sep 8, 2016 at 7:42 AM, Jurijs Ivolga <jurijs.ivolga@gmail.com> wrote:
Hi,
I configured fail2ban several times a while ago, but not with freeswitch...
If you see that rules are missing, just add them and you can use SSH rules as template. I believe it should make a trick.
And I see from you rules, that you are allowing all traffic and this is really bad idea...
You should drop everything and allow only needed traffic.
With kind regards,
Jurijs
On Thu, Sep 8, 2016 at 12:15 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Thanks for the reply!
*Fail2Ban is running:* root@sip:/etc/fail2ban# fail2ban-client start ERROR Server already running
*I added everything in /etc/fail2ban/jail.conf*
[ssh] enabled = true port = 22 filter = sshd logpath = /var/log/auth.log maxretry = 6
[freeswitch] enabled = true port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 10
*I also created /etc/fail2ban/filter.d/freeswitch.conf* as shown on https://github.com/fail2ban/fail2ban/blob/master/config/f ilter.d/freeswitch.conf
*root@sip:/etc/fail2ban/filter.d# iptables -S* -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but nothing about FreeSwitch.
Any help is appreciated.
On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules?
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
So, I got this working by creating a jail.local file. fail2ban was totally ignoring everything in the jail.conf file. But Jurijs is right, all the ports are open so some of the hackers are coming through on ports 5071 and weird numbers that don't even need to be available period. Can someone share with me how to block all ports except the important ones? Thanks! On Thu, Sep 8, 2016 at 1:23 PM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
I cleared out the logs and reloaded fail2ban. Going back to look at the logs again now and I don't even see an attempt to load the FreeSwitch filter.
fail2ban.log:
2016-09-08 18:21:16,855 fail2ban.server [3576]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.13 2016-09-08 18:21:16,856 fail2ban.jail [3576]: INFO Creating new jail 'ssh' 2016-09-08 18:21:16,856 fail2ban.jail [3576]: INFO Jail 'ssh' uses pyinotify 2016-09-08 18:21:16,862 fail2ban.jail [3576]: INFO Initiated 'pyinotify' backend 2016-09-08 18:21:16,864 fail2ban.filter [3576]: INFO Added logfile = /var/log/auth.log 2016-09-08 18:21:16,866 fail2ban.filter [3576]: INFO Set maxRetry = 6 2016-09-08 18:21:16,867 fail2ban.filter [3576]: INFO Set findtime = 600 2016-09-08 18:21:16,868 fail2ban.actions[3576]: INFO Set banTime = 1800 2016-09-08 18:21:16,889 fail2ban.jail [3576]: INFO Creating new jail 'ssh-ddos' 2016-09-08 18:21:16,890 fail2ban.jail [3576]: INFO Jail 'ssh-ddos' uses pyinotify 2016-09-08 18:21:16,896 fail2ban.jail [3576]: INFO Initiated 'pyinotify' backend 2016-09-08 18:21:16,898 fail2ban.filter [3576]: INFO Added logfile = /var/log/auth.log 2016-09-08 18:21:16,900 fail2ban.filter [3576]: INFO Set maxRetry = 6 2016-09-08 18:21:16,901 fail2ban.filter [3576]: INFO Set findtime = 600 2016-09-08 18:21:16,902 fail2ban.actions[3576]: INFO Set banTime = 1800 2016-09-08 18:21:16,910 fail2ban.jail [3576]: INFO Jail 'ssh' started 2016-09-08 18:21:16,914 fail2ban.jail [3576]: INFO Jail 'ssh-ddos' started
On Thu, Sep 8, 2016 at 1:53 AM, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
On ubuntu it is called : Chain fail2ban-freeswitch (1 references)
iptables -L should give you the chain if F2B started correctly, otherwise see the fail2ban log for errors.
On Thu, Sep 8, 2016 at 7:42 AM, Jurijs Ivolga <jurijs.ivolga@gmail.com> wrote:
Hi,
I configured fail2ban several times a while ago, but not with freeswitch...
If you see that rules are missing, just add them and you can use SSH rules as template. I believe it should make a trick.
And I see from you rules, that you are allowing all traffic and this is really bad idea...
You should drop everything and allow only needed traffic.
With kind regards,
Jurijs
On Thu, Sep 8, 2016 at 12:15 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Thanks for the reply!
*Fail2Ban is running:* root@sip:/etc/fail2ban# fail2ban-client start ERROR Server already running
*I added everything in /etc/fail2ban/jail.conf*
[ssh] enabled = true port = 22 filter = sshd logpath = /var/log/auth.log maxretry = 6
[freeswitch] enabled = true port = 5060,5061,5080,5081 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 10
*I also created /etc/fail2ban/filter.d/freeswitch.conf* as shown on https://github.com/fail2ban/fail2ban/blob/master/config/f ilter.d/freeswitch.conf
*root@sip:/etc/fail2ban/filter.d# iptables -S* -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
As you can see when running iptables -S it shoes the "fail2ban-ssh" rule but nothing about FreeSwitch.
Any help is appreciated.
On Wed, Sep 7, 2016 at 11:01 AM, jungle Boogie <jungleboogie0@gmail.com
wrote:
On 7 September 2016 at 08:33, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
It keeps saying it's not there, but I did add it, is there something I'm missing?
How did you add it? Is fail2ban running? Have you restarted your computer after setting up fail2ban? If you do iptables -S, do you see the rules?
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121694.ht... Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121730.ht... I've also had success with contacting the originating network and request their customer to stop the traffic to me. Here's the abuse form for online.net: https://console.online.net/en/account/abuses/search By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly. -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
Just want to update everyone that the registration attempts have almost stopped 100% since blocking the sniffers and setting a 4 hour block time after three failed registrations. Good day! On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/ 2016-August/121694.html
Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/ 2016-August/121730.html
I've also had success with contacting the originating network and request their customer to stop the traffic to me.
Here's the abuse form for online.net: https://console.online.net/en/account/abuses/search
By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
Hi Don, Could you please share your final settings since it works. Thanks, George
On Sep 10, 2016, at 5:49 PM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Just want to update everyone that the registration attempts have almost stopped 100% since blocking the sniffers and setting a 4 hour block time after three failed registrations.
Good day!
On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com <mailto:jungleboogie0@gmail.com>> wrote: On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com <mailto:hawkins@hawkinsegroup.com>> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121694.ht... <http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121694.html>
Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121730.ht... <http://lists.freeswitch.org/pipermail/freeswitch-users/2016-August/121730.html>
I've also had success with contacting the originating network and request their customer to stop the traffic to me.
Here's the abuse form for online.net <http://online.net/>: https://console.online.net/en/account/abuses/search <https://console.online.net/en/account/abuses/search>
By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info <mailto:jungleboogie@sip2sip.info>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com <http://hawkinsegroup.com/> Zello PTT <http://zello.com/>: push2don P: 469-214-5044 <>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
No problem, I need to take notes anyway. Here they are... *A.* /etc/fail2ban/filter.d/freeswitch.conf needs the following text: https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/freeswitch.... NOTE: Internal and Public sofia profiles need: <param name="log-auth-failures" value="true"/> *B.* /etc/fail2ban/jail.conf and in /etc/fail2ban/jail.local (not sure which one is working, I had to create jail.local) [freeswitch] enabled = true port = 5060,5061,5080,5081,5076 5074 5071 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 3 *C.* Drop these rules into iptables to block the scanners on ports 5060 and 5080 iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli" --algo bm *D.* Change SSH port from 22 to a custom number vi /etc/ssh/sshd_config *E.* Update SSH jail in /etc/fail2ban/jail.conf to custom port number. [ssh] enabled = true port = 9898,22 filter = sshd logpath = /var/log/auth.log maxretry = 6 *F.* I also have additional security using CDR records (curl). If a call comes in that does not have an 'account number' set (a custom variable we set for all incoming and outgoing calls from our customers) then we execute a shell command to block that IP without delay because they obviously aren't one of our customers. We are using mod_httapi and all calls start that way for us, so it's easy to set the variable as all calls start with <continue>. iptables -A INPUT -s 65.55.44.100 -j DROP Where 65.55.44.100 is the ip to block. Don On Sat, Sep 10, 2016 at 7:58 PM, George Assaad <gassaad@emassembly.com> wrote:
Hi Don, Could you please share your final settings since it works.
Thanks,
George
On Sep 10, 2016, at 5:49 PM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Just want to update everyone that the registration attempts have almost stopped 100% since blocking the sniffers and setting a 4 hour block time after three failed registrations.
Good day!
On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121694.html
Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121730.html
I've also had success with contacting the originating network and request their customer to stop the traffic to me.
Here's the abuse form for online.net: https://console.online.net/en/account/abuses/search
By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com/>: push2don P: 469-214-5044 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
Make sure you have blocktype = DROP in your iptables-blocktype.conf. It is always better to drop then to reject the packets, gives attacker timeout and makes one less packet for you to send :D On Sun, Sep 11, 2016 at 3:18 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
No problem, I need to take notes anyway. Here they are...
*A.* /etc/fail2ban/filter.d/freeswitch.conf needs the following text:
https://github.com/fail2ban/fail2ban/blob/master/config/ filter.d/freeswitch.conf
NOTE: Internal and Public sofia profiles need: <param name="log-auth-failures" value="true"/>
*B.* /etc/fail2ban/jail.conf and in /etc/fail2ban/jail.local (not sure which one is working, I had to create jail.local)
[freeswitch] enabled = true port = 5060,5061,5080,5081,5076 5074 5071 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 3
*C.* Drop these rules into iptables to block the scanners on ports 5060 and 5080
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli" --algo bm
*D.* Change SSH port from 22 to a custom number
vi /etc/ssh/sshd_config
*E.* Update SSH jail in /etc/fail2ban/jail.conf to custom port number.
[ssh]
enabled = true port = 9898,22 filter = sshd logpath = /var/log/auth.log maxretry = 6
*F.* I also have additional security using CDR records (curl). If a call comes in that does not have an 'account number' set (a custom variable we set for all incoming and outgoing calls from our customers) then we execute a shell command to block that IP without delay because they obviously aren't one of our customers. We are using mod_httapi and all calls start that way for us, so it's easy to set the variable as all calls start with <continue>.
iptables -A INPUT -s 65.55.44.100 -j DROP
Where 65.55.44.100 is the ip to block.
Don
On Sat, Sep 10, 2016 at 7:58 PM, George Assaad <gassaad@emassembly.com> wrote:
Hi Don, Could you please share your final settings since it works.
Thanks,
George
On Sep 10, 2016, at 5:49 PM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Just want to update everyone that the registration attempts have almost stopped 100% since blocking the sniffers and setting a 4 hour block time after three failed registrations.
Good day!
On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121694.html
Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121730.html
I've also had success with contacting the originating network and request their customer to stop the traffic to me.
Here's the abuse form for online.net: https://console.online.net/en/account/abuses/search
By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com/>: push2don P: 469-214-5044 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
I'm actually starting to notice a problem with fail2ban, maybe someone can help me. I have a SIP account registered on my wireless phone, when I switch between WiFi and cellular DATA the IP changes and the SIP app authenticates again with FS to re-register. On FreeSwitch it looks like this:
From the cell network: 2016-09-12 16:01:32.716663 [WARNING] sofia_reg.c:1787 SIP auth challenge (REGISTER) on sofia profile 'internal' for [donscellphone@sipaddress.com] from ip 66.87.96.898 2016-09-12 16:01:33.116669 [WARNING] sofia_reg.c:1787 SIP auth challenge (REGISTER) on sofia profile 'internal' for [donscellphone@sipaddress.com] from ip 66.87.96.898
Then once I get back on Wifi: 2016-09-12 16:01:56.716679 [WARNING] sofia_reg.c:1787 SIP auth challenge (REGISTER) on sofia profile 'internal' for [donscellphone@sipaddress.com] from ip 173.58.58.333 2016-09-12 16:01:56.976677 [WARNING] sofia_reg.c:1787 SIP auth challenge (REGISTER) on sofia profile 'internal' for [donscellphone@sipaddress.com] from ip 173.58.58.333 This is fine and all except the regex in the file /etc/fail2ban/filter.d/freeswitch.conf it specifically blocks these SIP auth challenges so my IP address ends up being blocked after X attempts. Obviously I could add my IP to the allow list BUT what about other users (our customers) ?? Thanks for the input! On Mon, Sep 12, 2016 at 8:27 AM, Mirko Brankovic <mirkobrankovic@gmail.com> wrote:
Make sure you have blocktype = DROP in your iptables-blocktype.conf.
It is always better to drop then to reject the packets, gives attacker timeout and makes one less packet for you to send :D
On Sun, Sep 11, 2016 at 3:18 AM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
No problem, I need to take notes anyway. Here they are...
*A.* /etc/fail2ban/filter.d/freeswitch.conf needs the following text:
https://github.com/fail2ban/fail2ban/blob/master/config/filt er.d/freeswitch.conf
NOTE: Internal and Public sofia profiles need: <param name="log-auth-failures" value="true"/>
*B.* /etc/fail2ban/jail.conf and in /etc/fail2ban/jail.local (not sure which one is working, I had to create jail.local)
[freeswitch] enabled = true port = 5060,5061,5080,5081,5076 5074 5071 filter = freeswitch logpath = /var/log/freeswitch/freeswitch.log maxretry = 3
*C.* Drop these rules into iptables to block the scanners on ports 5060 and 5080
iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "sipcli" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "VaxSIPUserAgent" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "friendly-scanner" --algo bm iptables -I INPUT -j DROP -p udp --dport 5080 -m string --string "sipcli" --algo bm
*D.* Change SSH port from 22 to a custom number
vi /etc/ssh/sshd_config
*E.* Update SSH jail in /etc/fail2ban/jail.conf to custom port number.
[ssh]
enabled = true port = 9898,22 filter = sshd logpath = /var/log/auth.log maxretry = 6
*F.* I also have additional security using CDR records (curl). If a call comes in that does not have an 'account number' set (a custom variable we set for all incoming and outgoing calls from our customers) then we execute a shell command to block that IP without delay because they obviously aren't one of our customers. We are using mod_httapi and all calls start that way for us, so it's easy to set the variable as all calls start with <continue>.
iptables -A INPUT -s 65.55.44.100 -j DROP
Where 65.55.44.100 is the ip to block.
Don
On Sat, Sep 10, 2016 at 7:58 PM, George Assaad <gassaad@emassembly.com> wrote:
Hi Don, Could you please share your final settings since it works.
Thanks,
George
On Sep 10, 2016, at 5:49 PM, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Just want to update everyone that the registration attempts have almost stopped 100% since blocking the sniffers and setting a 4 hour block time after three failed registrations.
Good day!
On Thu, Sep 8, 2016 at 4:21 PM, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 8 September 2016 at 12:54, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Can someone share with me how to block all ports except the important ones?
I had the same question about a month ago: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121694.html
Colin gives good advice here: http://lists.freeswitch.org/pipermail/freeswitch-users/2016- August/121730.html
I've also had success with contacting the originating network and request their customer to stop the traffic to me.
Here's the abuse form for online.net: https://console.online.net/en/account/abuses/search
By the way, if the fail2ban page on confluence needs updating, please update it or list what's wrong with it. I do see it indicates to create the jail.local and that's what you were missing for yours to work properly.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/free switch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com/>: push2don P: 469-214-5044 ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Mirko
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Don Hawkins CEO Hawkins Enterprise Group LLC http://hawkinsegroup.com Zello PTT <http://zello.com>: push2don P: 469-214-5044
On 12 September 2016 at 09:09, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
I'm actually starting to notice a problem with fail2ban, maybe someone can help me.
Not really a problem as fail2ban is working as expected--just not in a very friendly way. ;) I've seen this happen and usually I delete the line from fail2ban, but I don't know how folks manage it for customers. A few weeks back, I came across this issue on fail2ban's github page: https://github.com/fail2ban/fail2ban/issues/1500 That pretty much explains your problem. -- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
We don't include the challenge in the regex, just the failure, so we only ban on multiple failures. The challenge is normal registration behaviour. For genuine customers the challenges won't fail and they won't get banned. On 13 September 2016 at 02:33, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 12 September 2016 at 09:09, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
I'm actually starting to notice a problem with fail2ban, maybe someone can help me.
Not really a problem as fail2ban is working as expected--just not in a very friendly way. ;)
I've seen this happen and usually I delete the line from fail2ban, but I don't know how folks manage it for customers.
A few weeks back, I came across this issue on fail2ban's github page: https://github.com/fail2ban/fail2ban/issues/1500
That pretty much explains your problem.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- David Witham Senior Voice/Systems Engineer Netsip pty ltd – An Over the Wire Company Level 1, 24 Little Edward St, Spring Hill QLD 4000 t +61 1300 638 747 e david.witham@netsip.com.au www.netsip.com.au <https://macowa.netsip.com.au/owa/redir.aspx?C=95eec4d12cf0400796940d56513ed0f7&URL=http%3a%2f%2fwww.netsip.com.au> <https://macowa.netsip.com.au/owa/redir.aspx?C=95eec4d12cf0400796940d56513ed0f7&URL=http%3a%2f%2fwww.netsip.com.au>
Hello, In the case above, challenge is included in the regexp (challenge|failure) 011-02-07 12:23:28.490029 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1002 at 10.10.16.161] from ip 10.10.16.161 If, as is suggested in the issue report, what is being sought is to prevent flooding, i guess there's a maxretry param somewhere? Thanks! David (davidcsi) On Tue, Sep 13, 2016 at 2:00 AM David Witham <david.witham@netsip.com.au> wrote:
We don't include the challenge in the regex, just the failure, so we only ban on multiple failures. The challenge is normal registration behaviour. For genuine customers the challenges won't fail and they won't get banned.
On 13 September 2016 at 02:33, jungle Boogie <jungleboogie0@gmail.com> wrote:
On 12 September 2016 at 09:09, Don Hawkins <hawkins@hawkinsegroup.com> wrote:
I'm actually starting to notice a problem with fail2ban, maybe someone can help me.
Not really a problem as fail2ban is working as expected--just not in a very friendly way. ;)
I've seen this happen and usually I delete the line from fail2ban, but I don't know how folks manage it for customers.
A few weeks back, I came across this issue on fail2ban's github page: https://github.com/fail2ban/fail2ban/issues/1500
That pretty much explains your problem.
-- ------- inum: 883510009027723 sip: jungleboogie@sip2sip.info
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- David Witham Senior Voice/Systems Engineer
Netsip pty ltd – An Over the Wire Company Level 1, 24 Little Edward St, Spring Hill QLD 4000
t +61 1300 638 747 e david.witham@netsip.com.au www.netsip.com.au <https://macowa.netsip.com.au/owa/redir.aspx?C=95eec4d12cf0400796940d56513ed0f7&URL=http%3a%2f%2fwww.netsip.com.au>
<https://macowa.netsip.com.au/owa/redir.aspx?C=95eec4d12cf0400796940d56513ed0f7&URL=http%3a%2f%2fwww.netsip.com.au> _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (7)
-
David Villasmil
-
David Witham
-
Don Hawkins
-
George Assaad
-
jungle Boogie
-
Jurijs Ivolga
-
Mirko Brankovic