good afternoon, please, I’ve tried everything, but even with the ip blocked, the logs in the system continue
2022-06-15 15:26:59.803692 93.50% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile ‘default’ for [4823@35.198.12.135] from ip 212.102.48.27
2022-06-15 15:27:00.043718 93.50% [WARNING] sofia_reg.c:3223 Can’t find user [4823@10.158.0.27] from 212.102.48.27
You must define a domain called ‘10.158.0.27’ in your directory and add a user with the id=“4823” attribute
and you must configure your device to use the proper domain in its authentication credentials.
2022-06-15 15:27:00.043718 93.50% [WARNING] sofia_reg.c:1806 SIP auth failure (REGISTER) on sofia profile ‘default’ for [4823@35.198.12.135] from ip 212.102.48.27
2022-06-15 15:27:03.463711 91.60% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile ‘default’ for [197@35.198.12.135] from ip 188.95.54.29
2022-06-15 15:27:03.863700 91.60% [WARNING] sofia_reg.c:3223 Can’t find user [197@10.158.0.27] from 188.95.54.29
You must define a domain called ‘10.158.0.27’ in your directory and add a user with the id=“197” attribute
and you must configure your device to use the proper domain in its authentication credentials.
2022-06-15 15:27:03.863700 91.60% [WARNING] sofia_reg.c:1806 SIP auth failure (REGISTER) on sofia profile ‘default’ for [197@35.198.12.135] from ip 188.95.54.29
2022-06-15 15:27:36.403708 93.67% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile ‘default’ for [3685@35.198.12.135] from ip 146.70.21.180
2022-06-15 15:27:48.243694 93.90% [WARNING] sofia_reg.c:1861 SIP auth challenge (REGISTER) on sofia profile ‘default’ for [1794@35.198.12.135] from ip 194.169.169.6
freeswitch@billing-astpp> /exit
You have new mail in /var/spool/mail/root
[root@billing-astpp ~]# fail2ban-client status freeswitch-udp
Status for the jail: freeswitch-udp
|- Filter
| |- Currently failed: 0
| |- Total failed: 945
| - File list: /var/log/freeswitch/freeswitch.log - Actions
|- Currently banned: 56
|- Total banned: 57
- Banned IP list: 45.136.155.91 188.240.57.102 180.149.231.46 91.205.230.143 129.227.219.15 ip 212.102.55.80 89.37.173.52 156.146.45.194 194.169.171.6 80.246.31.75 185.217.71.54 87.101.93.172 103.192.80.132 87.98.246.178 212.102.42.202 89.45.7.20 194.169.169.4 193.218.35.4 45.134.213.250 209.216.92.221 185.166.84.62 213.152.165.98 194.169.168.4 87.239.255.112 185.76.8.216 146.70.123.62 194.41.112.29 146.70.22.6 143.244.42.104 143.244.42.103 143.244.42.102 185.217.71.20 138.199.57.38 89.187.163.193 89.37.173.20 0.0.0.0 143.244.46.242 107.175.104.85 37.19.200.109 217.138.216.244 212.102.46.52 45.133.193.198 195.158.249.53 89.187.162.185 169.150.197.59 91.206.168.6 212.102.40.87 185.102.217.197 146.70.21.182 138.199.60.166 146.70.111.84 45.40.54.5 51.77.132.94 89.46.223.168 185.244.139.6 [root@billing-astpp ~]# fail2ban-client status freeswitch-tcp Status for the jail: freeswitch-tcp |- Filter | |- Currently failed: 0 | |- Total failed: 1086 | - File list: /var/log/freeswitch/freeswitch.log
- Actions |- Currently banned: 56 |- Total banned: 57 - Banned IP list: 45.136.155.91 188.240.57.102 180.149.231.46 91.205.230.143 129.227.219.15 ip 212.102.55.80 89.37.173.52 156.146.45.194 194.169.171.6 80.246.31.75 185.217.71.54 87.101.93.172 103.192.80.132 87.98.246.178 212.102.42.202 89.45.7.20 194.169.169.4 193.218.35.4 45.134.213.250 209.216.92.221 185.166.84.62 213.152.165.98 194.169.168.4 87.239.255.112 185.76.8.216 146.70.123.62 194.41.112.29 146.70.22.6 143.244.42.104 143.244.42.103 143.244.42.102 185.217.71.20 138.199.57.38 89.187.163.193 89.37.173.20 0.0.0.0 143.244.46.242 107.175.104.85 37.19.200.109 217.138.216.244 212.102.46.52 45.133.193.198 195.158.249.53 89.187.162.185 169.150.197.59 91.206.168.6 212.102.40.87 185.102.217.197 146.70.21.182 138.199.60.166 146.70.111.84 45.40.54.5 51.77.132.94 89.46.223.168 185.244.139.6
[root@billing-astpp ~]#
@maxxsolutions Can you please check fail2ban logs in the path /var/log/fail2ban.log.
You may find something.
/etc/fail2ban/jail.conf
[freeswitch]
enabled = true
port = 5060,5061,5080,5081
filter = freeswitch
logpath = /var/log/freeswitch/freeswitch.log
maxretry = 10
action = iptables-allports[name=freeswitch, protocol=all]
[freeswitch-dos]
enabled = true
port = 5060,5061,5080,5081
filter = freeswitch-dos
logpath = /var/log/freeswitch/freeswitch.log
action = iptables-allports[name=freeswitch-dos, protocol=all]
maxretry = 50
findtime = 30
bantime = 6000
/etc/fail2ban/filter.d/freeswitch.conf
Fail2Ban configuration file
Author: Rupa SChomaker
[Definition]
Option: failregex
Notes.: regex to match the password failures messages in the logfile. The
host must be matched by a group named “host”. The tag “” can
be used for standard IP/hostname matching and is only an alias for
(?:::f{4,6}:)?(?P[\w-.^_]+)
Values: TEXT
failregex = [WARNING] sofia_reg.c:\d+ SIP auth failure (REGISTER) on sofia profile '[^']+' for [.] from ip
[WARNING] sofia_reg.c:\d+ SIP auth failure (INVITE) on sofia profile '[^']+' for [.] from ip
Option: ignoreregex
Notes.: regex to ignore. If this regex matches, the line is ignored.
Values: TEXT
ignoreregex =
datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:.%%f)?
{^LN-BEG}
/etc/fail2ban/filter.d/freeswitch-dos.conf
Fail2Ban configuration file
Author: soapee01
[Definition]
Option: failregex
Notes.: regex to match the password failures messages in the logfile. The
host must be matched by a group named “host”. The tag “” can
be used for standard IP/hostname matching and is only an alias for
(?:::f{4,6}:)?(?P[\w-.^_]+)
Values: TEXT
failregex = [WARNING] sofia_reg.c:\d+ SIP auth challenge (REGISTER) on sofia profile '[^']+' for [.*] from ip
Option: ignoreregex
Notes.: regex to ignore. If this regex matches, the line is ignored.
Values: TEXT
ignoreregex =
datepattern = ^(?:%%Y-)?%%m-%%d[ T]%%H:%%M:%%S(?:.%%f)?
{^LN-BEG}
sorry for the delay in response, I fixed it by adding these files in the default install of fail2ban