SOLVED fail2ban - freeswitch.conf not catching "SIP auth challenge"

Status
Not open for further replies.
P

ponch9

New Member
Nov 27, 2019
8
0
1
54
Does this apply for Debian 10 and FusionPBX 4.5.11 as well?
Code: 
failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile 'internal' for \[.*@\d+.\d+.\d+.\d+\] from ip <HOST>$
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[.*@\d+\.\d+\.\d+\.\d+\] from <HOST>$

It seems my freeswitch-ip.conf has this code and format already inserted
Code: 
failregex = \[WARNING\] sofia_reg.c:\d+ Can't find user \[.*@\d+.\d+.\d+.\d+\] from <HOST>

How can I see if it works or not? In logviewer I still see this. I haven't setup any extensions, nor connected any phones to this system yet. Therefore, the IP 208.115.198.2 is someone trying to connect, right? Do I need to restart fail2ban or iptables after the insertion of your code?

Code: 
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [NOTICE] switch_channel.c:1118 New Channel sofia/internal/3001@MY-SERVER-IP [a65f62c1-0053-423f-bc10-2478363b335f]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_NEW (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] sofia.c:10255 sofia/internal/3001@MY-SERVER-IP receiving invite from 208.115.198.2:5080 version: 1.10.2 -release-13-f7bdd3845a 64bit
2020-02-01 10:05:51.193938 [DEBUG] sofia.c:10349 verifying acl "domains" for ip/port 208.115.198.2:0.
2020-02-01 10:05:51.193938 [DEBUG] sofia.c:2434 detaching session a65f62c1-0053-423f-bc10-2478363b335f
2020-02-01 10:05:51.193938 [WARNING] sofia_reg.c:1793 SIP auth challenge (INVITE) on sofia profile 'internal' for [918653508049@MY-SERVER-IP] from ip 208.115.198.2
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] switch_core_state_machine.c:604 (sofia/internal/3001@MY-SERVER-IP) State NEW
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [WARNING] switch_core_state_machine.c:688 a65f62c1-0053-423f-bc10-2478363b335f sofia/internal/3001@MY-SERVER-IP Abandoned
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_state_machine.c:691 Hangup sofia/internal/3001@MY-SERVER-IP [CS_NEW] [WRONG_CALL_STATE]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_HANGUP (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:848 (sofia/internal/3001@MY-SERVER-IP) Callstate Change DOWN -> HANGUP
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:850 (sofia/internal/3001@MY-SERVER-IP) State HANGUP
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] mod_sofia.c:453 Channel sofia/internal/3001@MY-SERVER-IP hanging up, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:60 sofia/internal/3001@MY-SERVER-IP Standard HANGUP, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:850 (sofia/internal/3001@MY-SERVER-IP) State HANGUP going to sleep
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:620 (sofia/internal/3001@MY-SERVER-IP) State Change CS_HANGUP -> CS_REPORTING
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_REPORTING (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:936 (sofia/internal/3001@MY-SERVER-IP) State REPORTING
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:174 sofia/internal/3001@MY-SERVER-IP Standard REPORTING, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:936 (sofia/internal/3001@MY-SERVER-IP) State REPORTING going to sleep
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:611 (sofia/internal/3001@MY-SERVER-IP) State Change CS_REPORTING -> CS_DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_session.c:1726 Session 171 (sofia/internal/3001@MY-SERVER-IP) Locked, Waiting on external entities
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_session.c:1744 Session 171 (sofia/internal/3001@MY-SERVER-IP) Ended
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_session.c:1748 Close Channel sofia/internal/3001@MY-SERVER-IP [CS_DESTROY]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:739 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_DESTROY (Cur 0 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:749 (sofia/internal/3001@MY-SERVER-IP) State DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] mod_sofia.c:364 sofia/internal/3001@MY-SERVER-IP SOFIA DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:181 sofia/internal/3001@MY-SERVER-IP Standard DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:749 (sofia/internal/3001@MY-SERVER-IP) State DESTROY going to sleep
 
DigitalDaz

DigitalDaz

Administrator
Staff member
Sep 29, 2016
3,070
577
113
By default it is not enabled, have you checked that in your jail.conf?
 
P

ponch9

New Member
Nov 27, 2019
8
0
1
54
You mean jail.local?

If so, I changed this from "false" to "true"

Code: 
[freeswitch-ip]
enabled  = true
port     = 5060:5091
protocol = all
filter   = freeswitch-ip
logpath  = /var/log/freeswitch/freeswitch.log
#logpath  = /usr/local/freeswitch/log/freeswitch.log
action   = iptables-allports[name=freeswitch-ip, protocol=all]
maxretry = 1
findtime = 30
bantime  = 86400
 
D

dev

New Member
Sep 12, 2021
15
0
1
42
hello

i enabled auth-challenge-ip in jail.local but when i check iptables -L -n, I am not able to see the filter? what can be the reason?
 
Status
Not open for further replies.
Top Bottom