Difference between revisions of "Telephone system:fail2ban"

From Hackerspace ACKspace
Jump to: navigation, search
m (added reference to perl autoblock script)
(My script failed repeatedly after a while, trying fail2ban with progressive insights)
Line 1: Line 1:
<onlyinclude>If you have a FreeSWITCH instance running on the public net, changes are people will try to exploit it.  Fail2ban tries to mitigate this. Alternatively, check [https://gist.github.com/xopr/9482982786fde3d21fcf5b3ada97a6ee this perl autoblock script] since fail2ban doesn't seem to work reliably.  
+
<onlyinclude>If you have a FreeSWITCH instance running on the public net, changes are people will try to exploit it.  Fail2ban tries to mitigate this.
 +
This is a re-attempt since the alternative [https://gist.github.com/xopr/9482982786fde3d21fcf5b3ada97a6ee perl autoblock script] would freeze/hang.
 
</onlyinclude>
 
</onlyinclude>
  
For the telephone system, apart from the (mild) default fail2ban freeswitch filter, two additional filters are created.
+
Forget the provided configs both of fail2ban and FreeSWITCH itself ([https://github.com/fail2ban/fail2ban/issues/2163 here is a defect] stating more or less the same): try these instead and keep an eye on the logs with <code>tail -f /var/log/fail2ban.log</code> for a while, together with a realtime FS log.
Make sure the logpath is correct.
+
Also, make sure the <code>logpath</code> is correct.
(Source: [http://wiki.freeswitch.org/wiki/Fail2ban http://wiki.freeswitch.org/wiki/Fail2ban]):
 
  
'''/etc/fail2ban/filter.d/freeswitch-dos.conf'''
+
'''/etc/freeswitch/dialplan/public.xml''' before the subsirectory includes:
 
<pre>
 
<pre>
[Definition]
+
<extension name="IP based call">
failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth challenge \(REGISTER\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>
+
  <condition field="${acl(${network_addr} trunks)}" expression="false"/>
ignoreregex =
+
  <condition field="${sip_to_host}" expression="${local_ip_v4}">
 +
    <action application="log" data="WARNING IP based INVITE not from trunk ${network_addr}"/>
 +
    <action application="respond" data="403"/>
 +
  </condition>
 +
</extension>
 +
 
 +
<extension name="Vicious scanners">
 +
  <condition field="${acl(${network_addr} trunks)}" expression="false"/>
 +
  <condition regex="any">
 +
    <regex field="${sip_to_host}" expression="1\.1\.1\.1"/>
 +
    <regex field="${sip_user_agent}" expression="friendly-scanner"/>
 +
    <action application="log" data="WARNING vicious INVITE not from trunk ${network_addr}"/>
 +
    <action application="respond" data="488"/>
 +
  </condition>
 +
</extension>
 
</pre>
 
</pre>
  
'''/etc/fail2ban/filter.d/freeswitch-reg.conf'''
+
 
 +
'''/etc/fail2ban/filter.d/freeswitch.conf'''
 
<pre>
 
<pre>
[Definition]
+
Definition]
failregex = \[WARNING\] sofia_reg\.c:\d+ Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
+
# NOTE: don't trigger on challenge, only failure
 +
failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
 +
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
 
ignoreregex =
 
ignoreregex =
 
</pre>
 
</pre>
Line 23: Line 40:
 
<pre>
 
<pre>
 
[Definition]
 
[Definition]
failregex = \[DEBUG\] sofia_reg\.c:\d+ sofia\/external\/.+@\d+\.\d+\.\d+\.\d+\ receiving invite from <HOST> version
+
# Remote is calling us by IP in stead of name
 +
failregex = ^.*(IP based|vicious) INVITE not from trunk <HOST>$
 
ignoreregex =
 
ignoreregex =
 
</pre>
 
</pre>
Line 34: Line 52:
 
filter  = freeswitch
 
filter  = freeswitch
 
logpath  = /var/log/freeswitch/freeswitch.log
 
logpath  = /var/log/freeswitch/freeswitch.log
maxretry = 10
+
maxretry = 4 ; for a total of five failures
# ban for a week
 
bantime  = 604800
 
action  = iptables-allports[name=freeswitch, protocol=all]
 
 
 
[freeswitch-dos]
 
enabled = true
 
port = 5060,5061,5080,5081
 
filter = freeswitch-dos
 
logpath = /var/log/freeswitch/freeswitch.log
 
action = iptables-allports[name=freeswitch-dos, protocol=all]
 
maxretry = 20
 
findtime = 120
 
# ban for 24 hours
 
bantime  = 86400
 
 
 
[freeswitch-reg]
 
enabled  = true
 
port    = 5060,5061,5080,5081
 
filter  = freeswitch-reg
 
logpath  = /var/log/freeswitch/freeswitch.log
 
findtime = 60
 
maxretry = 3
 
# ban for 10 minutes
 
bantime  = 600
 
action  = iptables-allports[name=freeswitch, protocol=all]
 
 
 
[freeswitch-reg-dos]
 
enabled  = true
 
port    = 5060,5061,5080,5081
 
filter  = freeswitch-reg
 
logpath  = /var/log/freeswitch/freeswitch.log
 
 
findtime = 3600
 
findtime = 3600
maxretry = 10
+
bantime  = 28800 ; 1200=20m, 7200=2h, 28800=8h
# ban for a week
+
action = iptables-allports[name=freeswitch, protocol=all]
bantime  = 604800
 
action   = iptables-allports[name=freeswitch, protocol=all]
 
  
 
[freeswitch-ip]
 
[freeswitch-ip]
enabled  = false
+
enabled  = true
 
port    = 5060,5061,5080,5081
 
port    = 5060,5061,5080,5081
filter  = freeswitch
+
filter  = freeswitch-ip
 
logpath  = /var/log/freeswitch/freeswitch.log
 
logpath  = /var/log/freeswitch/freeswitch.log
maxretry = 2
+
findtime = 300
 +
maxretry = 0
 
# ban for a week
 
# ban for a week
 
bantime  = 604800
 
bantime  = 604800

Revision as of 15:47, 4 December 2019

If you have a FreeSWITCH instance running on the public net, changes are people will try to exploit it. Fail2ban tries to mitigate this. This is a re-attempt since the alternative perl autoblock script would freeze/hang.


Forget the provided configs both of fail2ban and FreeSWITCH itself (here is a defect stating more or less the same): try these instead and keep an eye on the logs with tail -f /var/log/fail2ban.log for a while, together with a realtime FS log. Also, make sure the logpath is correct.

/etc/freeswitch/dialplan/public.xml before the subsirectory includes:

<extension name="IP based call">
  <condition field="${acl(${network_addr} trunks)}" expression="false"/>
  <condition field="${sip_to_host}" expression="${local_ip_v4}">
    <action application="log" data="WARNING IP based INVITE not from trunk ${network_addr}"/>
    <action application="respond" data="403"/>
  </condition>
</extension>

<extension name="Vicious scanners">
  <condition field="${acl(${network_addr} trunks)}" expression="false"/>
  <condition regex="any">
    <regex field="${sip_to_host}" expression="1\.1\.1\.1"/>
    <regex field="${sip_user_agent}" expression="friendly-scanner"/>
    <action application="log" data="WARNING vicious INVITE not from trunk ${network_addr}"/>
    <action application="respond" data="488"/>
  </condition>
</extension>


/etc/fail2ban/filter.d/freeswitch.conf

Definition]
# NOTE: don't trigger on challenge, only failure
failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
ignoreregex =

/etc/fail2ban/filter.d/freeswitch-ip.conf

[Definition]
# Remote is calling us by IP in stead of name
failregex = ^.*(IP based|vicious) INVITE not from trunk <HOST>$
ignoreregex =

/etc/fail2ban/jail.local

[freeswitch]
enabled  = true
port     = 5060,5061,5080,5081
filter   = freeswitch
logpath  = /var/log/freeswitch/freeswitch.log
maxretry = 4 ; for a total of five failures
findtime = 3600
bantime  = 28800 ; 1200=20m, 7200=2h, 28800=8h
action = iptables-allports[name=freeswitch, protocol=all]

[freeswitch-ip]
enabled  = true
port     = 5060,5061,5080,5081
filter   = freeswitch-ip
logpath  = /var/log/freeswitch/freeswitch.log
findtime = 300
maxretry = 0
# ban for a week
bantime  = 604800
action   = iptables-allports[name=freeswitch, protocol=all]

[DEFAULT]
# Considered safe
# kingofdos.eu 185.66.250.17
# kingofdos.eu 91.218.127.87
# kingofdos.eu 164.138.31.26
# sip.speakup.nl 193.169.138.26
# sip.speakup.nl 193.169.139.26
# self: 666.666.666.666
ignoreip = 127.0.0.1/8 185.66.250.17 91.218.127.87 164.138.31.26 193.169.138.26 193.169.139.26 666.666.666.666
bantime  = 600
maxretry = 3