Vulnerability Update and Fail2Ban

[Bifur]

Hi everyone,

I updated my system the other day and I believe fail2ban is no longer working. I saw the thread from back in November where Freeswitch now includes the CPU% at the beginning of the line. From what I understood, adding ^ to the beginning of the regex should make it match again. However, I cannot seem to get myself banned. I registered 2 devices and constantly failed to register, but no ban happens. My ip is not listed under any ignoreip as my DHCP Internet IP changed recently.

Was this already fixed by the time I updated? There was no ^ in the config files so I assume not? I guess I can change it back and see if it bans me. I saw one post saying adding the ^ did not help, but the default worked as it was suppose too.

Any insight would be great.

Thank you!

 

[Bifur]

Changing it back to what it was - without the ^ at the beginning definitely banned me. So was this addressed already? Do I need to look anywhere else? Just worried if fail2ban is not working as it should. I am no regex ninja either!

 

[markjcrane]

You are right the ^ does mean the beginning of the line. The fail2ban filter files are located here and used as part of the install script.
- https://github.com/fusionpbx/fusionpbx-install.sh/tree/master/debian/resources/fail2ban

I didn't see a ^ in the beginning of any of the FreeSWITCH filters.

 

[Bifur]

Hi Mark,

Thanks for taking the time to respond. I was looking back at prior posts and came across this:

Upgrade to 1.10.7

Hi Guys, so i have been reading about the issues in 1.10.6 and wonder if it may be a good time to upgrade, i did it on a test vm and the upgrade went ok to be honest and freeswitch started fine, however i noticed that fail2ban filters for freeswitch have stopped working, this obviously cant be...

www.pbxforums.com

Having just upgraded my server because of the vulnerabilities I was concerned I missed something and had to make adjustments.

I reverted back to the original config and was able to block myself with failed registrations so it appears it is working fine. Just seeing the other comments through me off.

Also thanks for the link for that information. I was looking for it but couldn't stumble upon it.