48
回編集
差分
→ステータス確認
IAXでのFail2banは'''[[IAX-Fail2ban]]'''を参照してください。
==fail2ban==
ログファイルとiptablesを利用したファイアウォールの一種。Brute Forceアタックの対策に使いやすい。<br>
:http://www.fail2ban.org/
:http://sourceforge.net/projects/fail2ban/
dateformat=%F %T
[INCLUDESasterisk] enabled = truefail2banを起動すると監視が始まります。 ===起動の確認===iptables -Lでiptablesの状態を確認するとfail2banでbanされたIPアドレス等が確認できます。 Chain f2b-asterisk-tcp (1 references) target prot opt source destination REJECT all -- 46.17.42.180 anywhere reject-with icmp-port-unreachable RETURN all -- anywhere anywhere
こちらは Asterisk-1.8.23.0 用です。Asterisk-11.5.1 でもほぼ同じコードが使えます。
--- asterisk-1.8.23.0/channels/chan_sip.c.orig 2013-08-02 11:41:03.233638321 +0900
+++ asterisk-1.8.23.0/channels/chan_sip.c 2013-12-06 14:51:08.698990909 +0900
@@ -22673,7 +22673,7 @@
return 0;
}
if (res < 0) { /* Something failed in authentication */
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
return 0;
@@ -23334,7 +23334,7 @@
goto request_invite_cleanup;
}
if (res < 0) { /* Something failed in authentication */
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response_reliable(p, "403 Forbidden", req);
p->invitestate = INV_COMPLETED;
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
@@ -25164,7 +25164,7 @@
p->lastinvite = seqno;
return 0;
} else if (auth_result < 0) {
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
ast_string_field_set(p, theirtag, NULL);
@@ -25384,7 +25384,7 @@
if (res == AUTH_CHALLENGE_SENT) /* authpeer = NULL here */
return 0;
if (res != AUTH_SUCCESSFUL) {
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
pvt_set_needdestroy(p, "authentication failed"); Asterisk 11.23.1用パッチです。 [Definition]--- channels/chan_sip.c.orig 2016-09-09 01:28:35.000000000 +0900 +++ channels/chan_sip.c 2016-10-28 23:26:38.985774935 +0900 @@ -18751,7 +18751,7 @@ static void receive_message(struct sip_p return; } if (res < 0) { /* Something failed in authentication */ - ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From")); + ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr)); transmit_response(p, "403 Forbidden", req); sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT); return; @@ -24963,7 +24963,7 @@ static int handle_request_options(struct return 0; } if (res < 0) { /* Something failed in authentication */ - ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From")); + ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr)); transmit_response(p, "403 Forbidden", req); sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT); return 0; @@ -25798,7 +25798,7 @@ static int handle_request_invite(struct goto request_invite_cleanup; } if (res < 0) { /* Something failed in authentication */ - ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From")); + ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr)); transmit_response_reliable(p, "403 Forbidden", req); p->invitestate = INV_COMPLETED; sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT); @@ -27788,7 +27788,7 @@ static int handle_request_publish(struct p->lastinvite = seqno; return 0; } else if (auth_result < 0) { - ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From")); + ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr)); transmit_response(p, "403 Forbidden", req); sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT); ast_string_field_set(p, theirtag, NULL); @@ -28003,7 +28003,7 @@ static int handle_request_subscribe(stru if (res == AUTH_CHALLENGE_SENT) /* authpeer = NULL here */ return 0; if (res != AUTH_SUCCESSFUL) { - ast_log(LOG_NOTICE, "Failed to authenticate device %s for SUBSCRIBE\n", sip_get_header(req, "From")); + ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s) for SUBSCRIBE\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr)); transmit_response(p, "403 Forbidden", req);
pvt_set_needdestroy(p, "authentication failed"); パッチを当てて、Asteriskをコンパイルし直し、再起動します。 すると、先ほどの攻撃時のログは以下のように出力されるようになります。 #_daemon Failed to authenticate user "Anonymous" <sip:anonymous@192.168.1.2>;tag=as105e401c (123.45.67.89:5060) ログの( )内に攻撃元の実IPアドレスが表示されるようになり、これを元にfail2banで攻撃を検知することができます。 ===fail2banへ設定を追加=== 修正したログに合わせたフィルタ設定をfail2banに追加します。 /etc/fail2ban/filter.d/asterisk.conf の failregex の項目に以下を追加します。 NOTICE.* .*: Failed to authenticate user .* \(<HOST>:.*\) フィルタ追加後、fail2banを再起動し設定完了です。 ==securityログの設定==/etc/asterisk/logger.confに [logfiles] security = > securityを追加(コメント解除)して、/var/log/asterisk/securityにできるログをfail2banに監視させる方法もあります。 ==ステータス確認==fail2ban-client コマンドで問い合わせるのがいいです。 # コマンド一覧 fail2ban-client
# Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for # (?:::f{4,6}:)?(?P<host>\S+) # Values: TEXT有効なjail一覧 #fail2ban-client status
# Option: ignoreregex手動でban/unban # Notes.: regex to ignorefail2ban-client set asterisk banip 11. If this regex matches, the line is ignored22. # Values: TEXT # ignoreregex =Asterisk 133.6とそれ以前の場合 # Fail2Ban configuration file44 # # # $Revision: 250 $ # [INCLUDES] # Read common prefixes. If any customizations available fail2ban-- read them from # common.local #before = common.conf [Definition] #_daemon = client set asterisk # Option: failregex # Notesunbanip 11.: regex to match the password failures messages in the logfile22. The # host must be matched by a group named "host"33. The tag "<HOST>" can # be used for standard IP/hostname matching and is only an alias for44 # (?:::f{4,6}:)?(?Pbanされてることになっていても、actionが正しく書けていないと実際にはfirewalldやiptablesなどに反映されず、攻撃されっぱなしもあり得るので、挙動確認が大事です。<hostbr>\S+) # Values: TEXT # failregex = Registration from '.*' failed for '<HOST>' fail2ban- Wrong password Registration from '.*' failed for 'server コマンドは直接叩いてはいけないようです。<HOSTbr>' - No matching peer found Registration from '.*' failed for '<HOST>' - Usernameまたは、ログファイル /var/log/auth name mismatch Registration from 'fail2ban.*' failed for '<HOST>' - Device does not match ACLlog を見てもいいです。 Registration from '.*' failed for '<HOST>' - Peer is not supposed to register Registration from '.*' failed for '<HOST>' - Not a local domain # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. # Values: TEXT # ignoreregex =Asterisk 1.8とそれ以前ではログのホスト部分にポート番号を含む、含まないの違いがあるためfailregexの記述を変える必要がありますので注意してください。この部分に合致するメッセージが、ログファイルに現れたならばBAN基準になりますので注意して記述します。これ意外にも、引っかけたいメッセージがある場合にはそれも記述するとよいでしょう。<br>