Asterisk auf Debian 6 mittels Fail2Ban schützen
Mittels Fail2Ban kann man ziemlich schnell und einfach BAN-Regeln mit Linux Bortmitteln realisieren!
Mit diesem Script können Logfiles von zB Asterisk, SSH, FTP, MAIL ect. automatisiert durchsucht werden, findet Fail2Ban dort das gesuchte (zBsp. Wrong password) wird er mitzählen und den Hacker nach x Versuchen für x Minuten bannen.
Los gehts mit dem HOWTO:
1. Schritt: Installation
apt-get install fail2ban iptables
..installiert die benötigte Pakete.
2. Schritt: Fail2Ban Konfigurieren
cd /etc/fail2ban
nano filter.d/asterisk.conf
für Asterisk ab 1.8:
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#
#---asterisk 1.8
failregex = NOTICE.* .*: Registration from '.*' failed for '(:[0-9]{1,5})?' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '(:[0-9]{1,5})?' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '(:[0-9]{1,5})?' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '(:[0-9]{1,5})?' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '(:[0-9]{1,5})?' - Peer is not supposed to register
NOTICE.* failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' \(from \)
NOTICE.* .*: Host failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
ignoreregex =
für Asterisk 1.4 oder 1.6:
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P\S+)
# Values: TEXT
#
#---asterisk 1.6
failregex = NOTICE.* .*: Registration from '.*' failed for '' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '' - Peer is not supposed to register
NOTICE.* .*: Registration from '.*' failed for '' - ACL error (permit/deny)
NOTICE.* .*: Registration from '.*' failed for '' - Device does not match ACL
NOTICE.* failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' \(from \)
NOTICE.* .*: Host failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
3.Schritt: /etc/fail2ban/jail.conf editieren und die folgenden Daten am Ende eintragen:
Beachte! LOGPATH – muss auf ein Logfile zeigen welches WARNINGs ausgibt!
Zu verändernde Zeilen in dem folgenden Text :
LOGPATH=
SENDER=
NAME=
DEST=
[asterisk-iptables]
enabled = true
filter = asterisk
logpath = /var/log/asterisk/fail2ban
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois-lines[name=ASTERISK, dest="deine-mail@dein-provider.com", sender=deine-mail@dein-server.com,logpath=%(logpath)s]
maxretry = 5
bantime = 172800
Am Kopf der Datei findet man einiges was angepasst werden muss:
Zu verändernde Variablen in diesem Text :
IGNOREIP
DESTEMAIL
MTA (bei Bedarf)
ignoreip = 127.0.0.0/8 10.0.0.0/8
destemail =
mta = sendmail / für sendmail oder
mta = mail / für exim (so habe ich es hier
4.Schritt: /etc/asterisk/logger.conf anpassen
[general]
dateformat=%F %T ; ISO 8601 date format
[logfiles]
fail2ban => notice
console => notice,warning,error
messages => notice,warning,error
es werden nun drei Log-Dateien unter /var/log/asterisk/ angelegt und die fail2ban wird vom gleichnamigen Script eingelesen.
5.Schritt: Configs neustarten und einlesen
asterisk -rx "logger reload"
/etc/init.d/fail2ban restart
Nun müsste deine Asterisk-Grundinstallation schon mehr Mehrwert an Sicherheit haben!!
In: Asterisk · Schlagworte: Asterisk, Debian, Fail2Ban, vServer
am 8. Januar 2012 um 00:59
Permalink
[...] Asterisk mittels Fail2Ban schützen Veröffentlicht am 23. Dezember 2011 um 22:50 von anethum · Permalink In: Asterisk, Webhosting · Schlagworte: Asterisk, asterisk 10, Debain 6, Debian Squeeze [...]