Fail2ban fix for ASTPP 3.5

[David Morris]

Hi,

We noticed that Fail2ban is installed and the configuration file looks fine with the ASTPP install script - but it fails to run and does not catch any hack attempts.

When trying to manually start fail2ban we see that it does not start:

[user@switch] service fail2ban start
Starting fail2ban (via systemctl):  Job for fail2ban.service failed because the control process exited with error code. See "systemctl status fail2ban.service" and "journalctl -xe" for details.
                                                           [FAILED]

To fix this you need to create a directory at /var/run/fail2ban:

mkdir /var/run/fail2ban

Now start the service:

[user@switch] service fail2ban start
Starting fail2ban (via systemctl):                         [  OK  ]

I hope this helps!

David

[pavyolo]

Thanks, I've tried this but seems the fail2ban service didn't even install, I used the quick setup method in centos 7, I selected yes to the fail2ban install but after install has completed I can't even run "service fail2ban start" as it returns error Failed, unit not found...

I've now manually installed fail2ban, and have run mkdir /var/run/fail2ban

the service starts, but since I manually installed it with yum install fail2ban....what further manual config will I need to tie it into ASTPP??

[Emma]

Thanks

[David Morris]

Hi pavyolo,

You need to make sure that you have the fail2ban rules for freeswitch.

There is a fail2ban manual install and configuration script in the ASTPP github repository:

https://github.com/iNextrix/ASTPP/blob/f280c5aa91bd41732ffa37d74120cc5f0bfa168d/misc/contribution/Fail2ban.sh

Since you have already installed fail2ban yourself, then you could copy that script and delete lines 14 to 40 as these are the lines which download and install fail2ban. 

The rest of the script will add the required configurations to fail2ban to make sure it can pickup and read the freeswitch log file and parse it to kick most hackers off.

I find some hackers now send REGISTER requests at slow intervals. This can't be picked up by fail2ban. Personally we only authenticate by source IP address so no one is able to REGISTER and the hackers cannot brute force.

Thanks,

David

[pavyolo]

Perfect, worked!
thanks David!

[SessionHub]

Hi David
The fix works, but after every reboot, it fails again. How can one make it permanent?

On Friday, November 17, 2017 at 12:31:20 PM UTC+1, David Morris wrote:

[Kavin Chauhan]

Hi,
After reboot what issue you are facing exactly?
Please pass output of below command after reboot server.
1> iptables -L -n
2> systemctl status fail2ban