Raspberry Pi + FreeBPX（アスタリスク）+ Mikrotik =ミニPBX

crw-rw---- 1 root dialout 188, 0 27 11:34 ttyUSB0

crw-rw---- 1 root dialout 188, 1 27 11:33 ttyUSB1

crw-rw---- 1 root dialout 188, 2 27 12:37 ttyUSB2

[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not                          
# ban a host which matches an address in this list. Several addresses can be                             
# defined using space separator.
                                                                         
ignoreip = 127.0.0.1/8 ::1

[asterisk]
enabled   = true
filter    = asterisk
action    = iptables-asterisk[name=asterisk]
logpath   = /var/log/asterisk/security_log
bantime   = 31536000
findtime  = 86400
maxretry  = 3

[sshd]
enabled   = true
port      = ssh
filter    = sshd
logpath   = /var/log/auth.log
banaction = iptables-allports
bantime   = 31536000
findtime  = 86400
maxretry  = 3

[freepbx]
enabled   = true
port      = http,https
filter    = freepbx
logpath   = /var/log/asterisk/freepbx_security.log
bantime   = 31536000
findtime  = 86400
maxretry  = 3
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

[INCLUDES]
before = common.conf

[Definition]
datepattern = ^\[%%Y-%%b-%%d %%H:%%M:%%S\]

failregex = \[freepbx_security\.NOTICE\]: Authentication failure for .* from <HOST>
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

# Fail2Ban configuration file
#
#
# $Revision: 251 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

#_daemon = asterisk

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
# Asterisk 1.8 uses Host:Port format which is reflected here

failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
        NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
        NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
        NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
        NOTICE.* <HOST> failed to authenticate as '.*'$
        NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
        NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
        NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
        NOTICE.* .*: <HOST> failed to authenticate as '.*'
        NOTICE.* .*: <HOST> tried  to authenticate with nonexistent user '.*'
        SECURITY.* .*: SecurityEvent="ChallengeSent",.*,.*,Service="(PJ)?SIP",.*,AccountID="<unknown>",.*,.*,RemoteAddress=".*/.*/<HOST>/.*",Challenge=""
        SECURITY.* .*: SecurityEvent="InvalidAccountID",.*,Severity="Error",Service="(PJ)?SIP",.*,.*,.*,.*,RemoteAddress=".*/.*/<HOST>/.*"
        SECURITY.* .*: SecurityEvent="ChallengeResponseFailed",.*,Severity="Error",Service="(PJ)?SIP",.*,.*,.*,.*,RemoteAddress=".*/.*/<HOST>/.*",.*
        SECURITY.* .*: SecurityEvent="InvalidPassword",.*,Severity="Error",Service="(PJ)?SIP",.*,.*,.*,.*,RemoteAddress=".*/.*/<HOST>/.*",.*

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

# Fail2Ban configuration file
#
# Author: Razvan Turtureanu
#
# $Revision$
#

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = iptables -N fail2ban-<name>
          iptables -A fail2ban-<name> -j RETURN
          iptables -I <chain> -p tcp --dport 5061 -j fail2ban-<name>
          iptables -I <chain> -p udp --dport 5060 -j fail2ban-<name>
          iptables -I <chain> -p tcp --dport 5060 -j fail2ban-<name>

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = iptables -D <chain> -p tcp --dport 5061 -j fail2ban-<name>
         iptables -D <chain> -p udp --dport 5060 -j fail2ban-<name>
         iptables -D <chain> -p tcp --dport 5060 -j fail2ban-<name>
         iptables -F fail2ban-<name>
         iptables -X fail2ban-<name>

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP

[Init]

# Defaut name of the chain
#
name = default

# Option:  chain
# Notes    specifies the iptables chain to which the fail2ban rules should be
#          added
# Values:  STRING  Default: INPUT
chain = INPUT
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

security_log => SECURITY,NOTICE
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

/var/log/asterisk/security_log {
        weekly
        missingok
        rotate 4
        size 2000k
        sharedscripts
        create 0664 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/invoke-rc.d asterisk logger-reload > /dev/null 2> /dev/null
        endscript
}
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

/var/log/asterisk/freepbx_security.log {
        weekly
        missingok
        rotate 4
        size 2000k
        sharedscripts
        create 0664 asterisk asterisk
        su asterisk asterisk
        postrotate
                /usr/sbin/invoke-rc.d asterisk logger-reload > /dev/null 2> /dev/null
        endscript
}
      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

File permissions and owner/group information:

/etc/fail2ban/jail.local = rw-r--r-- root root

/etc/fail2ban/filter.d/freepbx.conf = rw-r--r-- root root

/etc/fail2ban/filter.d/asterisk.conf = rw-r--r-- root root

/etc/fail2ban/action.d/iptables-asterisk.conf = rw-r--r-- root root

/etc/asterisk/logger_logfiles_custom.conf = rw-rw-r-- asterisk asterisk

/etc/logrotate.d/asterisk_security = rw-r--r-- root root

Basic Fail2ban commands:

Start Fail2ban = sudo service fail2ban start





Stop Fail2ban = sudo service fail2ban stop





Restart Fail2ban = sudo service fail2ban restart

Get the current status of an individual jail:

FreePBX status = sudo fail2ban-client status freepbx





Asterisk status = sudo fail2ban-client status asterisk





SSHD status = sudo fail2ban-client status sshd

Ban/Unban IP addresses:

Ban IP = sudo fail2ban-client set *YOURJAILNAMEHERE banip IPADDRESSHERE





Unban IP = sudo fail2ban-client set *YOURJAILNAMEHERE unbanip IPADDRESSHERE

*Replace YOURJAILNAMEHERE with freepbx, asterisk or sshd.

*Replace IPADDRESSHERE with the IP address that you want to ban/unban.