Fail2Ban et PJsip

[Nicolas56]

Bonjour,

J’ai essayé de configurer mon fail2ban avec pleins d’options mais j’ai quand même pleins d’attaques.

J’ai des logs du genre : res_pjsip/pjsip_distributor.c:676 log_failed_request: Request ‘REGISTER’ from ‘sip:512@XXX.XXX.XXX.XXX’ failed for ‘185.147.212.8:54728’ (callid: 870761872-524459635-2136584037) - Failed to authenticate

J’ai l’impression que la programmation que j’ai fais n’est as faite pour le Pjsip mais plutot Sip clasique.

Pourriez vous me donner des informations sur comment je pourrais faire pour bien régler Fail2ban s’il vous plait?

J’ai suivis cela :
https://www.blog-des-telecoms.com/configuration-de-fail2ban-selon-les-differentes-versions-asterisk/
https://www.provya.net/?d=2019/05/14/15/14/04-asterisk-securiser-efficacement-et-simplement-son-serveur-avec-iptables-et-fail2ban
Fail2Ban Guide for servers on the internet

Merci.

[Sven]

Hello,
I dont understand french, but I wrote a guide for fail2ban and if you have questions, please let me know.

Fail2Ban Guide for servers on the internet

Hey Wazo Enthusiast, why do attackers have interest to attack your PBX? Making money is the biggest I guess, dialing expensive foreign country or service numbers etc. They try to find out which extensions are enabled with spamming INVITEs. When I started off and accessed the asterisk console (asterisk -rvc, pjsip set logger on), I got several malicious invites per second. My first ban attempts got me lists of 50+ IP addresses on ban. The attackers also try different methods. I did a lot of r…

[Nicolas56]

Hello,

Thank you for your reply.

I followed your post but I must have missed something because I still have so much attack.