- Блог пользователя administrator
- Комментировать
- 209312 reads
Метки: Asterisk
чтобы не забыть:)
Linux 2.6.18-308.4.1.el5 #1 SMP Tue Apr 17 17:08:10 EDT 2012 i686 i686 i386 GNU/Linux
[root fail2ban]# cat /etc/redhat-release
CentOS release 5.8 (Final)
[root fail2ban]#
очень хорошая статья.
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
добавить EPEL
sudo rpm -Uvh remi-release-5*.rpm epel-release-5*.rpm
отсюда http://www.rackspace.com/knowledge_center/article/installing-rhel-epel-r...
yum install fail2ban
touch /etc/fail2ban/filter.d/asterisk.conf
# Fail2Ban configuration file
#
#
# $Revision: 250 $
#
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# common.local
#before = common.conf
[Definition]
#_daemon = asterisk
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
#
failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>.*' - Wrong password
NOTICE.* .*: Registration from '.*' failed for '<HOST>.*' - No matching peer found
NOTICE.* .*: Registration from '.*' failed for '<HOST>.*' - Username/auth name mismatch
NOTICE.* .*: Registration from '.*' failed for '<HOST>.*' - Device does not match ACL
NOTICE.* .*: Registration from '.*' failed for '<HOST>.*' - Peer is not supposed to register
NOTICE.* <HOST>.* failed to authenticate as '.*'$
NOTICE.* .*: No registration for peer '.*' \(from <HOST>.*\)
NOTICE.* .*: Host <HOST>.* failed MD5 authentication for '.*' (.*)
NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - No matching peer found
NOTICE.* .*: Sending fake auth rejection for device .*\<sip:.*\@<HOST>.*\>;tag=.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
[root fail2ban]# nano /etc/fail2ban/jail.conf
добавляем в него:
enabled = true
filter = asterisk
action = iptables-allports[name=ASTERISK, protocol=all]
sendmail-whois[name=ASTERISK, dest=your@arrd.com, sender=root]
logpath = /var/log/asterisk/full
maxretry = 5
bantime = 259200
[general]
dateformat=%F %T;
; Logging Configuration
;
; In this file, you configure logging to files or to
; the syslog system.
;
; For each file, specify what to log.
;
; For console logging, you set options at start of
; Asterisk with -v for verbose and -d for debug
; See 'asterisk -h' for more information.
;
; Directory for log files is configures in asterisk.conf
; option astlogdir
;
[logfiles]
;
; Format is "filename" and then "levels" of debugging to be included:
; debug
; notice
; warning
; error
; verbose
;
; Special filename "console" represents the system console
;
;debug => debug
; The DTMF log is very handy if you have issues with IVR's
;dtmf => dtmf
;console => notice,warning,error
;console => notice,warning,error,debug
messages => notice,warning,error
full => notice,warning,error,debug,verbose
;syslog keyword : This special keyword logs to syslog facility
;
;syslog.local0 => notice,warning,error
;
Sending fake auth rejection for device:
исходники берем тут:
http://packages.asterisk.org/rhel/5/asterisk-1.8-certified/SRPMS/
извлекаем:
rpm2cpio aster***.rpm | cpio --extract --make-directories --verbose
yum install openssl devel
находим chan_sip.c
меняем:
ast_log(LOG_NOTICE, "Sending fake auth rejection for device %s\n", get_header(req, "From"));
на:
ast_log(LOG_NOTICE, "Sending fake auth rejection for device %s [IP: %s]\n", get_header(req, "From"), ast_sockaddr_stringify(addr));
делаем ./configure
make menuselect
ищем там chan_sip со значком *, если нет смотрите зависимости и ставьте их.
make
ищем chan_sip.so и копируем в папку с астериском, если астер не подгрузит его, пользуемся этим решением http://sibsvt.blogspot.ru/2011/08/asterisk.html
кратко:
открываем любой модуль который грузится и ищем в нем AST_BUILDOPT_SUM, копируем данные 19 символов, идем в исходники include/asterisk/buildopts.h меняем в нем на то что надо, пересобираем.
asterisk*CLI> module load chan_sip.so
или amportal restart
далее в конфигу fail2ban добавляем.меняем строку:
NOTICE.* .*: Sending fake auth rejection for device .*\;tag=.* \[IP: :.*\]
всего 5 строк
суперская программа для проверки звонков без регистрации http://www.zoiper.com/download_intermediate.php?os=Windows&ap=z2&locatio...
в настройках снимите галку register on startup...