SOLVED fail2ban - freeswitch.conf not catching "SIP auth challenge"

Status
Not open for further replies.

ponch9

New Member
Nov 27, 2019
8
0
1
53
Does this apply for Debian 10 and FusionPBX 4.5.11 as well?
Code:
failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile 'internal' for \[.*@\d+.\d+.\d+.\d+\] from ip <HOST>$
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[.*@\d+\.\d+\.\d+\.\d+\] from <HOST>$

It seems my freeswitch-ip.conf has this code and format already inserted
Code:
failregex = \[WARNING\] sofia_reg.c:\d+ Can't find user \[.*@\d+.\d+.\d+.\d+\] from <HOST>

How can I see if it works or not? In logviewer I still see this. I haven't setup any extensions, nor connected any phones to this system yet. Therefore, the IP 208.115.198.2 is someone trying to connect, right? Do I need to restart fail2ban or iptables after the insertion of your code?

Code:
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [NOTICE] switch_channel.c:1118 New Channel sofia/internal/3001@MY-SERVER-IP [a65f62c1-0053-423f-bc10-2478363b335f]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_NEW (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] sofia.c:10255 sofia/internal/3001@MY-SERVER-IP receiving invite from 208.115.198.2:5080 version: 1.10.2 -release-13-f7bdd3845a 64bit
2020-02-01 10:05:51.193938 [DEBUG] sofia.c:10349 verifying acl "domains" for ip/port 208.115.198.2:0.
2020-02-01 10:05:51.193938 [DEBUG] sofia.c:2434 detaching session a65f62c1-0053-423f-bc10-2478363b335f
2020-02-01 10:05:51.193938 [WARNING] sofia_reg.c:1793 SIP auth challenge (INVITE) on sofia profile 'internal' for [918653508049@MY-SERVER-IP] from ip 208.115.198.2
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:05:51.193938 [DEBUG] switch_core_state_machine.c:604 (sofia/internal/3001@MY-SERVER-IP) State NEW
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [WARNING] switch_core_state_machine.c:688 a65f62c1-0053-423f-bc10-2478363b335f sofia/internal/3001@MY-SERVER-IP Abandoned
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_state_machine.c:691 Hangup sofia/internal/3001@MY-SERVER-IP [CS_NEW] [WRONG_CALL_STATE]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_HANGUP (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:848 (sofia/internal/3001@MY-SERVER-IP) Callstate Change DOWN -> HANGUP
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:850 (sofia/internal/3001@MY-SERVER-IP) State HANGUP
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] mod_sofia.c:453 Channel sofia/internal/3001@MY-SERVER-IP hanging up, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:60 sofia/internal/3001@MY-SERVER-IP Standard HANGUP, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:850 (sofia/internal/3001@MY-SERVER-IP) State HANGUP going to sleep
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:620 (sofia/internal/3001@MY-SERVER-IP) State Change CS_HANGUP -> CS_REPORTING
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:585 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_REPORTING (Cur 1 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:936 (sofia/internal/3001@MY-SERVER-IP) State REPORTING
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:174 sofia/internal/3001@MY-SERVER-IP Standard REPORTING, cause: WRONG_CALL_STATE
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:936 (sofia/internal/3001@MY-SERVER-IP) State REPORTING going to sleep
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:611 (sofia/internal/3001@MY-SERVER-IP) State Change CS_REPORTING -> CS_DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_session.c:1726 Session 171 (sofia/internal/3001@MY-SERVER-IP) Locked, Waiting on external entities
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_session.c:1744 Session 171 (sofia/internal/3001@MY-SERVER-IP) Ended
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [NOTICE] switch_core_session.c:1748 Close Channel sofia/internal/3001@MY-SERVER-IP [CS_DESTROY]
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:739 (sofia/internal/3001@MY-SERVER-IP) Running State Change CS_DESTROY (Cur 0 Tot 171)
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:749 (sofia/internal/3001@MY-SERVER-IP) State DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] mod_sofia.c:364 sofia/internal/3001@MY-SERVER-IP SOFIA DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:181 sofia/internal/3001@MY-SERVER-IP Standard DESTROY
a65f62c1-0053-423f-bc10-2478363b335f 2020-02-01 10:06:01.233972 [DEBUG] switch_core_state_machine.c:749 (sofia/internal/3001@MY-SERVER-IP) State DESTROY going to sleep
 

DigitalDaz

Administrator
Staff member
Sep 29, 2016
3,038
556
113
By default it is not enabled, have you checked that in your jail.conf?
 

ponch9

New Member
Nov 27, 2019
8
0
1
53
You mean jail.local?

If so, I changed this from "false" to "true"

Code:
[freeswitch-ip]
enabled  = true
port     = 5060:5091
protocol = all
filter   = freeswitch-ip
logpath  = /var/log/freeswitch/freeswitch.log
#logpath  = /usr/local/freeswitch/log/freeswitch.log
action   = iptables-allports[name=freeswitch-ip, protocol=all]
maxretry = 1
findtime = 30
bantime  = 86400
 

dev

New Member
Sep 12, 2021
15
0
1
41
hello

i enabled auth-challenge-ip in jail.local but when i check iptables -L -n, I am not able to see the filter? what can be the reason?
 
Status
Not open for further replies.