Hacker in Asterisk - fail2ban fails to ban

[beowulf]

Hey!

Seit gestern versucht ein lustiger Zeitgenosse, sich bei meinem Asterisk Server zu registrieren - ohne Erfolg, aber es geht mir auf den Keks.

Hier ein Auszug aus meinem Asterisk Logfile:

[2011-04-17 10:33:00] NOTICE[17724] chan_sip.c: Registration from '"1993" <sip:[email protected]>' failed for '50.56.120.19' - No matching peer found
[2011-04-17 10:33:00] NOTICE[17724] chan_sip.c: Registration from '"1993" <sip:[email protected]>' failed for '50.56.120.19' - No matching peer found
[2011-04-17 10:33:00] NOTICE[17724] chan_sip.c: Registration from '"1993" <sip:[email protected]>' failed for '50.56.120.19' - No matching peer found
[2011-04-17 10:33:01] NOTICE[17724] chan_sip.c: Registration from '"1993" <sip:[email protected]>' failed for '50.56.120.19' - No matching peer found
[2011-04-17 10:33:01] NOTICE[17724] chan_sip.c: Registration from '"1993" <sip:[email protected]>' failed for '50.56.120.19' - No matching peer found

Ich habe hier einiges über fail2ban gelesen und die letzte Version v0.8.4 auf meinem vServer installiert.

Meine filter.d/asterisk.conf sieht so aus:

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#

failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
            NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - No matching peer found
            NOTICE.* <HOST> failed to authenticate as '.*'$
            NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
            NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
            NOTICE[[][0-9]*] chan_sip.c:.* Registration from '.*' failed for [']<HOST>['] - No matching peer found


# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

In der jail.conf habe ich die "Guten" definiert:

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host
ignoreip = 10.10.101.0/255.0.0.0
bantime  = 600
maxretry = 4

In der jail.local habe ich das Asterisk jail definiert:

[asterisk-iptables]

enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=XX, sender=fail2ban@localhost]
logpath  = /var/log/asterisk/fail2ban
maxretry = 5
bantime  = 600

Und wenn ich Fail2Ban starte, dann macht es das auch ohne Fehlermedung

2011-04-17 16:43:03,451 fail2ban.server : INFO   Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.4
2011-04-17 16:43:03,451 fail2ban.jail   : INFO   Creating new jail 'asterisk-iptables'
2011-04-17 16:43:03,451 fail2ban.jail   : INFO   Jail 'asterisk-iptables' uses poller
2011-04-17 16:43:03,463 fail2ban.filter : INFO   Added logfile = /var/log/asterisk/fail2ban
2011-04-17 16:43:03,464 fail2ban.filter : INFO   Set maxRetry = 5
2011-04-17 16:43:03,465 fail2ban.filter : INFO   Set findtime = 600
2011-04-17 16:43:03,466 fail2ban.actions: INFO   Set banTime = 600
2011-04-17 16:43:03,573 fail2ban.jail   : INFO   Jail 'asterisk-iptables' started

Auch ein iptable -L -V zeigt, daß das Asterisk-Jail da ist

Chain INPUT (policy ACCEPT 6437K packets, 1166M bytes)
 pkts bytes target     prot opt in     out     source               destination 
 1441  470K fail2ban-ASTERISK  all  --  any    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 7237K packets, 1608M bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain fail2ban-ASTERISK (1 references)
 pkts bytes target     prot opt in     out     source               destination 
 1441  470K RETURN     all  --  any    any     anywhere             anywhere

Und ja, in der Asterisk logger.conf habe ich auch das Datumsformat geändert und die fail2ban log-Datei spezifiziert.

[general]
dateformat=%F %T

[logfiles]
fail2ban => notice

Es sollte also alles laufen, aber die Registry Attempts kommen und kommen und fail2ban greift nicht ein. Igendwas mache ich also falsch.

Für sachdienliche Hinweise bin ich sehr dankbar.

Niko

 

[rmh]

EDIT: Hast du mal überprüft, ob die entsprechenden notice-Einträge, die fail2ban auswerten soll, auch wirklich in der logdatei /var/log/asterisk/fail2ban landen?


Gruß
R.