Skip to content

Latest commit

 

History

History
64 lines (52 loc) · 2.18 KB

README.md

File metadata and controls

64 lines (52 loc) · 2.18 KB
Raw

Asterisk security

External Asterisk security monitor for fail2ban

Configuring extsecurity.py

  • Place extsecurity.py to /var/lib/asterisk/security/extsecurity.py
  • Edit /var/lib/asterisk/security/extsecurity.py (if required)
settings = {
    "logfile_path": "/var/log/asterisk/inbound_extsecurity.log",
    "default_sleep_protection_time_sec": 2,
    "alert_if_callerid_num_is_not_numeric": True,
    "alert_if_dialed_exten_is_not_numeric": True,
    "alert_if_dialed_exten_lenghts_less_than": 10,
    "alert_if_dialed_exten_lenghts_more_than": 14,
    "automatic_block_attempts_to_extensions": [
        ur"\d{1,3}",
    ],
}
  • Give +x permissions to /var/lib/asterisk/security/extsecurity.py

Configuring asterisk

  • Place to inbound (default) dialplan the following lines:
[default]
exten => s,1,System(/var/lib/asterisk/security/extsecurity.py '{"ip": "${CHANNEL(peerip)}", "callerid_num": "${CALLERID(num)}", "callerid_num": "${CALLERID(name)}", "dest_exten": "${EXTEN}", "user_agent": "${CHANNEL(useragent)}", "peer_name": "${CHANNEL(peername)}"}')
exten => _X.,1,System(/var/lib/asterisk/security/extsecurity.py '{"ip": "${CHANNEL(peerip)}", "callerid_num": "${CALLERID(num)}", "callerid_num": "${CALLERID(name)}", "dest_exten": "${EXTEN}", "user_agent":"${CHANNEL(useragent)}", "peer_name": "${CHANNEL(peername)}"}')
exten => _+X.,1,System(/var/lib/asterisk/security/extsecurity.py '{"ip": "${CHANNEL(peerip)}", "callerid_num": "${CALLERID(num)}", "callerid_num": "${CALLERID(name)}", "dest_exten": "${EXTEN}", "user_agent":"${CHANNEL(useragent)}", "peer_name": "${CHANNEL(peername)}"}')
  • Reload dialplan

Configuring fail2ban

  • Add to /etc/fail2ban/jail.conf
[ast-inb-extsec]
enabled = true
port    = 5060
protocol = udp
filter  = asterisk-inbound-extsecurity
maxretry = 1
logpath = /var/log/asterisk/inbound_extsecurity.log
bantime = 86400
findtime = 3600
action  = iptables-allports[name=ASTERISK, protocol=all]
  • Create file /etc/fail2ban/filter.d/asterisk-inbound-extsecurity.conf
  • Add to file /etc/fail2ban/filter.d/asterisk-inbound-extsecurity.conf
[INCLUDES]
#before = common.conf

[Definition]
failregex = ERROR ip=<HOST> reason=.*
ignoreregex =
  • Restart fail2ban