https://erudinsky.com/categories/asterisk---asterisk/Recent content in Asterisk - Asterisk on DevOps and application security enthusiast's notesHugo -- gohugo.ioen-usTue, 22 Dec 2015 07:00:00 +0100https://erudinsky.com/2015/12/22/fail2ban-with-asterisk-13/Tue, 22 Dec 2015 07:00:00 +0100https://erudinsky.com/2015/12/22/fail2ban-with-asterisk-13/<p>Even having fresh AWS EC2 instance with either fixed or not IP, I start seeing constant attempts to get access to my SIP server. Brute force attacks are very famous and now I&rsquo;m going to change this in my server by setting Fail2Ban in place.</p> <h2 id="prepare-asterisk-loggerconf">Prepare Asterisk (logger.conf) <a class="heading-anchor" href="#prepare-asterisk-loggerconf" aria-label="Link to this section">#</a></h2><p>Uncomment the following in your <code>/etc/asterisk/logger.conf</code></p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;display:grid;"><code class="language-markdown" data-lang="markdown"><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1</span><span>[general] </span></span><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2</span><span>dateformat = %F %T </span></span><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3</span><span>... </span></span><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4</span><span>[logfiles] </span></span><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">5</span><span>security = security </span></span></code></pre></div><h2 id="installing-and-configuring-fail2ban-using-apt-get-manager">Installing and configuring fail2ban using apt-get manager <a class="heading-anchor" href="#installing-and-configuring-fail2ban-using-apt-get-manager" aria-label="Link to this section">#</a></h2><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;display:grid;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">1</span><span>sudo apt-get update </span></span><span style="display:flex;"><span style="white-space:pre;-webkit-user-select:none;user-select:none;margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2</span><span>apt-get install fail2ban </span></span></code></pre></div><p>Once finished, let&rsquo;s add the following to the end of <code>/etc/fail2ban/jail.conf</code>. Feel free to change numbers (they are self-explained).</p>