Gustavo, vc tem aí as msgs da CLI no momento do ataque?<br><br><div class="gmail_quote">On 20 April 2012 10:36, Gustavo Fernandes <span dir="ltr"><<a href="mailto:gustavocearasc@hotmail.com">gustavocearasc@hotmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div dir="ltr">
Srs,<br><br>Instalei o Fail2ban para bloquear ataques no asterisk. Problema que o mesmo não esta bloqueando os ataques. Segue abaixo meus arquivos de configuração:<br><br>jail.conf<br><br>[asterisk-iptables]<br><br>enabled = true<br>
filter = asterisk<br>action = iptables-allports[name=ASTERISK, protocol=all]<br> sendmail-whois[name=ASTERISK, dest=root, sender=<a href="mailto:gustavo.fernandes@tbmtextil.com.br" target="_blank">gustavo.fernandes@tbmtextil.com.br</a>]<br>
logpath = /var/log/asterisk/full<br>maxretry = 5<br>bantime = 259200<br><br><br>/etc/fail2ban/filter.d/asterisk.conf<br><br>[Definition]<br><br>#_daemon = asterisk<br><br># Option: failregex<br># Notes.: regex to match the password failures messages in the logfile. The<br>
# host must be matched by a group named "host". The tag "<HOST>" can<br># be used for standard IP/hostname matching and is only an alias for<br># (?:::f{4,6}:)?(?P<host>\S+)<br>
# Values: TEXT<br>#<br><br>failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password<br> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found<br>
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch<br> NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL<br>
NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Peer is not supposed to register<br> NOTICE.* <HOST> failed to authenticate as '.*'$<br> NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)<br>
NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)<br> NOTICE.* .*: Failed to authenticate user .*@<HOST>.*<br> NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - No matching peer found<br>
NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>' - Wrong password<br># Option: ignoreregex<br># Notes.: regex to ignore. If this regex matches, the line is ignored.<br>
# Values: TEXT<br>#<br>ignoreregex =<br><br>ALGUMA DICA?<br><br><br><br> </div></div>
<br>_______________________________________________<br>
KHOMP Inovação: External Board Series<br>
Módulos de 1/2 rack e 1U para todas as interfaces e soluções Asterisk e FreeSWITCH.<br>
Tenha a External Series Experience na sua aplicação. Visite <a href="http://www.khomp.com" target="_blank">www.khomp.com</a><br>
_______________________________________________<br>
DIGIVOICE Fabricante de Placas de Voz e Channel Bank<br>
20 anos de experiência com E1(R2/ISDN), FXS, FXO e GSM<br>
Contato <a href="tel:%2811%29%203016-5200" value="+551130165200">(11) 3016-5200</a> – Site <a href="http://www.digivoice.com.br" target="_blank">www.digivoice.com.br</a><br>
________<br>
YEALINK: Telefones IP e VídeoPhones IP com o melhor custo/benefício do mercado.<br>
email: <a href="mailto:yealink@commlogik.com.br">yealink@commlogik.com.br</a> | <a href="http://www.commlogik.com.br" target="_blank">www.commlogik.com.br</a> | <a href="tel:%2811%29%205503-1011" value="+551155031011">(11) 5503-1011</a><br>
______________________________________________<br>
Para remover seu email desta lista, basta enviar um email em branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br></blockquote></div>
<br><br clear="all"><br>-- <br><b>Jony do Vale</b><br><div>+55 85 99447159<br></div><div>+55 85 97489412 </div><div><a href="mailto:GTalk%3Ajonydovale.jh@gmail.com" target="_blank">GTalk:jonydovale.jh@gmail.com</a></div><div>
MSN: <a href="mailto:jonydovale@hotmail.com" target="_blank">jonydovale@hotmail.com</a></div><br>