fail2ban/config/filter.d/asterisk.conf

# Fail2Ban configuration file
#
# Author: Xavier Devlamynck
#
#


[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile.
# Values:  TEXT
#
failregex = ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
            ^\[\]\s*NOTICE%(__pid_re)s\[\S+\] \S+: Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed to authenticate as '[^']*'$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: No registration for peer '[^']*' \(from <HOST>\)$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
            ^\[\]\s*NOTICE%(__pid_re)s \S+: Failed to authenticate user [^@]+@<HOST>\S*$
            ^\[\]\s*SECURITY%(__pid_re)s \S+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =
Add asterisk support 2012-01-11 15:35:40 +00:00			`# Fail2Ban configuration file`
			`#`
			`# Author: Xavier Devlamynck`
			`#`
			`#`

Add the INCLUDE section to use __pid_re feature 2012-02-28 16:28:06 +00:00
			`[INCLUDES]`

			`# Read common prefixes. If any customizations available -- read them from`
			`# common.local`
			`before = common.conf`

Add asterisk support 2012-01-11 15:35:40 +00:00			`[Definition]`

			`# Option: failregex`
ENH: anchor a bit mor. Use \d and \w where possible. Escape a literal . 2013-06-13 22:41:50 +00:00			`# Notes.: regex to match the password failures messages in the logfile.`
Add asterisk support 2012-01-11 15:35:40 +00:00			`# Values: TEXT`
			`#`
ENH: asterisk -- use \S instead of [^:] + prefix failregex with ^\[ detected date portion is stripped from the string to be matched, so it is not only the right ] is left, but also the left one ;-) 2013-06-13 22:58:13 +00:00			`failregex = ^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - Wrong password$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - No matching peer found$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - Device does not match ACL$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Registration from '[^']' failed for '<HOST>(:\d+)?' - Not a local domain$`
			`^\[\]\sNOTICE%(__pid_re)s\[\S+\] \S+: Call from '[^']' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Host <HOST> failed to authenticate as '[^']'$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: No registration for peer '[^']' \(from <HOST>\)$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Host <HOST> failed MD5 authentication for '[^']' \([^)]+\)$`
			`^\[\]\sNOTICE%(__pid_re)s \S+: Failed to authenticate user [^@]+@<HOST>\S$`
			`^\[\]\s*SECURITY%(__pid_re)s \S+: SecurityEvent="InvalidAccountID",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD\|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD\|TC)P/<HOST>/\d+"$`
Add asterisk support 2012-01-11 15:35:40 +00:00
			`# Option: ignoreregex`
			`# Notes.: regex to ignore. If this regex matches, the line is ignored.`
			`# Values: TEXT`
			`#`
			`ignoreregex =`
Update asterisk.conf Para ficar compatível com asterisk 11 2013-05-14 11:04:11 +00:00