на данный момент файлы выглядят так
/etc/fail2ban/jail.conf
- Код: выделить все
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime = 600
findtime = 600
maxretry = 5
[asterisk]
port = 5060,5061
action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
%(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
logpath = /var/log/asterisk/messages
maxretry = 10
/etc/fail2ban/filter.d/asterisk.conf
- Код: выделить все
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf
[Definition]
_daemon = asterisk
__pid_re = (?:\[\d+\])
iso8601 = \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d+[+-]\d{4}
# All Asterisk log messages begin like this:
log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])? [^:]+:\d*(?:(?: in)? \w+:)?
failregex = ^%(__prefix_line)s%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - (Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
^%(__prefix_line)s%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
^%(__prefix_line)s%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
^%(__prefix_line)s%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
^%(__prefix_line)s%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
^%(__prefix_line)s%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
^%(__prefix_line)s%(log_prefix)s hacking attempt detected '<HOST>'$
^%(__prefix_line)s%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV[46]/(UDP|TCP|WS)/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UDP|TCP|WS)/<HOST>/\d+"(,Challenge="[\w/]+")?(,ReceivedChallenge="\w+")?(,Response="\w+",ExpectedResponse="\w*")?(,ReceivedHash="[\da-f]+")?(,ACLName="\w+")?$
^%(__prefix_line)s%(log_prefix)s "Rejecting unknown SIP connection from <HOST>"$
^%(__prefix_line)s%(log_prefix)s Request (?:'[^']*' )?from '[^']*' failed for '<HOST>(?::\d+)?'\s\(callid: [^\)]*\) - (?:No matching endpoint found|Not match Endpoint(?: Contact)? ACL|(?:Failed|Error) to authenticate)\s*$
ignoreregex =
iptables.rules (IP адреса скрыл маской XXX)
- Код: выделить все
# Generated by iptables-save v1.6.0 on Wed Sep 9 16:34:07 2020
*filter
:INPUT ACCEPT [48:8022]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [46:17707]
:f2b-asterisk-tcp - [0:0]
:f2b-asterisk-udp - [0:0]
:f2b-sshd - [0:0]
-A INPUT -p udp -m multiport --dports 5060,5061 -j f2b-asterisk-udp
-A INPUT -p tcp -m multiport --dports 5060,5061 -j f2b-asterisk-tcp
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A f2b-asterisk-tcp -s 217.24.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-tcp -s 91.203.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-tcp -s 185.108.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-tcp -j RETURN
-A f2b-asterisk-udp -s 217.24.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-udp -s 91.203.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-udp -s 185.108.XXX.XXX/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-asterisk-udp -j RETURN
-A f2b-sshd -j RETURN
COMMIT
# Completed on Wed Sep 9 16:34:07 2020
Выглядит это все как то мало, достаточно ли таких настроек и правил для обеспечения безопасности или нужно требовать от них еще что-то ?
Если есть готовые примеры правильных настроек конфигов, прошу посоветовать.
