fail2ban

jail.conf and jail.local 

backend =  systemd

# JAILS

#

[asterisk-udp]

enabled  = true

filter   = asterisk

port     = 5060,5061

protocol = udp

#logpath  = /var/log/asterisk/full

logpath  = /var/log/asterisk/fail2ban2

action   = iptables-allports[name=recidive, protocol=all]

[ssh-iptables]

enabled  = true

filter   = sshd

action   = iptables[name=SSH, port=ssh, protocol=tcp]

           sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]

logpath  = /var/log/messages

maxretry = 5

//////////////////////////

filter.d/asterisk.conf file for Asterisk 1.8:

# Fail2Ban configuration file
#
#
# $Revision: 251 $
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf


[Definition]

#_daemon = asterisk

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)
# Values:  TEXT
#
# Asterisk 1.8 uses Host:Port format which is reflected here

failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Peer is not supposed to register
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - ACL error (permit/deny)
            NOTICE.* .*: Registration from '.*' failed for '<HOST>:.*' - Device does not match ACL
            NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - No matching peer found
            NOTICE.* .*: Registration from '\".*\".*' failed for '<HOST>:.*' - Wrong password
            NOTICE.* <HOST> failed to authenticate as '.*'$
            NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)
            NOTICE.* .*: Failed to authenticate user .*@<HOST>.*
            NOTICE.* .*: <HOST> failed to authenticate as '.*'
            NOTICE.* .*: <HOST> tried  to authenticate with nonexistent user '.*'
            VERBOSE.*SIP/<HOST>-.*Received incoming SIP connection from unknown peer
   
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

add to  nano  /etc/asterisk/logger.conf

asterisk -x " core reload"

fail2ban2 => security,notice,warning,error

Verify  file exist

 ls /var/log/asterisk/fail2ban2

 systemctl restart fail2ban


 systemctl status fail2ban

iptables  -L -n

Chain f2b-SSH (1 references)

target     prot opt source               destination

REJECT     all  --  192.184.14.100       0.0.0.0/0            reject-with icmp-port-unreachable

RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Chain f2b-recidive (1 references)

target     prot opt source               destination

REJECT     all  --  20.191.79.63         0.0.0.0/0            reject-with icmp-port-unreachable