SOLVED continuous attacks from one IP 185.147.215.13

[PJPMontreal]

Hi Guys,
I see on Log Viewer a continuous intents to register from this IP 185.147.215.13 which apparently is in Germany.
This IP have nothing to do with my configuration...
Is this something I have to be worry?
How to stop these intents or definitely block this IP in my FusionPBX server.

 

[ad5ou]

I suggest you give the docs a read regarding Fail2ban.
https://docs.fusionpbx.com/en/latest/firewall/fail2ban.html
If you are using domain based registrations, you can enable the Freeswitch-ip and auth-challenge-ip rules to cut down on the repeat offenders.

 

[PJPMontreal]

I suggest you give the docs a read regarding Fail2ban.
https://docs.fusionpbx.com/en/latest/firewall/fail2ban.html
If you are using domain based registrations, you can enable the Freeswitch-ip and auth-challenge-ip rules to cut down on the repeat offenders.

Thanks ad5ou, Would you please point me step by step how to enable Freeswitch-ip and auth-challenge-ip?
Where exactly I can do that... I did read the Fail2ban and still don't get it....
Is on Putty when logged into the root? then which command?
or is something we can do on the FusionPBX menu web interface?
or maybe editing some files on /etc/fail2ban/jail or something using the WinSCP ??

 

[krooney]

The link provided by @ad5ou explains exactly what to do to enable it
ssh in your pbx and you must edit nano /etc/fail2ban/jail.local

 

[PJPMontreal]

Sorry Krooney, but I'm still lost.... in my /etc/fail2ban/jail.local file I can't see any Freeswitch-ip or auth-challenge-ip there to enable
Apologies for my inexperience!

 

[PJPMontreal]

Thanks Guys... Thanks for pushing me ... I finally got it.
Amazing thing this nano stuff to edit files inside the SSH connection
Maybe you can close this post as Solved