diff --git a/ChangeLog b/ChangeLog index c092037a..d4dae353 100644 --- a/ChangeLog +++ b/ChangeLog @@ -53,6 +53,8 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - Add filter for apache-modsecurity - filter.d/nsd.conf -- also amended Unix date template to match nsd format - Added filter.d/openwebmail filter thanks Ivo Truxa. Closes gh-543 + - Added filter for freeswitch. Thanks Jim and editors and authors of + http://wiki.freeswitch.org/wiki/Fail2ban - Enhancements: - loglines now also report "[PID]" after the name portion diff --git a/config/filter.d/freeswitch.conf b/config/filter.d/freeswitch.conf new file mode 100644 index 00000000..3835c5ad --- /dev/null +++ b/config/filter.d/freeswitch.conf @@ -0,0 +1,14 @@ +# Fail2Ban configuration file +# +# In freeswitch configuration: +# + +[Definition] + +failregex = ^\.\d+ \[WARNING\] sofia_reg.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip + +ignoreregex = + +# Author: Rupa SChomaker, soapee01, Daniel Black +# http://wiki.freeswitch.org/wiki/Fail2ban +# diff --git a/config/jail.conf b/config/jail.conf index e9441416..3f660d2c 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -382,6 +382,18 @@ action = iptables-multiport[name=asterisk-tcp, port="5060,5061", protocol=tcp] logpath = /var/log/asterisk/messages maxretry = 10 + +[freeswitch] + +enabled = false +port = 5060,5061,5080,5081 +filter = freeswitch +logpath = /var/log/freeswitch.log +maxretry = 10 +action = iptables-multiport[name=freeswitch-tcp, port="5060,5061,5080,5081", protocol=tcp] + iptables-multiport[name=freeswitch-udp, port="5060,5061,5080,5081", protocol=udp] + + # Historical support (before https://github.com/fail2ban/fail2ban/issues/37 was fixed ) # use [asterisk] for new jails [asterisk-tcp] diff --git a/testcases/files/logs/freeswitch b/testcases/files/logs/freeswitch new file mode 100644 index 00000000..96e2b1cf --- /dev/null +++ b/testcases/files/logs/freeswitch @@ -0,0 +1,2 @@ +# failJSON: { "time": "2013-12-31T17:39:54", "match": true, "host": "81.94.202.251" } +2013-12-31 17:39:54.767815 [WARNING] sofia_reg.c:1533 SIP auth challenge (INVITE) on sofia profile 'internal' for [011448708752617@192.168.2.51] from ip 81.94.202.251