centos配置Fail2Ban防止sip攻击`FreeSWITCH`

听馨發表於 2020-9-8 14:40:00

centos配置Fail2Ban防止sip攻击`FreeSWITCH`

<div class="cnblogs_code">
<pre># 使用`Fail2Ban`防止sip攻击`FreeSWITCH`

`FreeSWITCH`在公网运行容易遭受sip攻击，解决的办法有很多种，而`Fail2Ban`安装配置以及调试比较简单，不失为一种好的选择。

`Fail2Ban`版本很多，配置方式略有差别。

本次测试是基于`Fail2Ban 0.9.6`版本，其他相关信息如下：

- Debian9

- FreeSWITCH 1.10.3，`base_dir`是`/usr/local/freeswitch`

## 安装`Fail2Ban`

```shell
cd /usr/src; git clone https://github.com/fail2ban/fail2ban.git -b 0.9.6
cd /usr/src/fail2ban; python3 setup.py install
#配置成服务
cp files/debian-initd /etc/init.d/fail2ban #centos cp files/redhat-initd /etc/init.d/fail2ban</pre>
<pre>https://github.com/fail2ban/fail2ban/blob/0.11/files/redhat-initd
update-rc.d fail2ban defaults
service fail2ban start
```

## 配置`iptables`

```shell
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 5066 -j ACCEPT
iptables -A INPUT -p tcp --dport 7443 -j ACCEPT
iptables -A INPUT -p tcp --dport 5060:5061 -j ACCEPT
iptables -A INPUT -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -p tcp --dport 5080 -j ACCEPT
iptables -A INPUT -p udp --dport 5080 -j ACCEPT
iptables -A INPUT -p udp --dport 16384:32768 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
```

## 配置 `FreeSWITCH`

1. sip_profiles/internal.xml

```
<param name="log-auth-failures" value="true"/>
```

2. autoload_configs/switch.conf.xml 要修改一个配置项目

```
<param name="threaded-system-exec" value="true"/>
```

## 配置 fail2ban

### 配置 freeswitch jail

找到 `/etc/fail2ban/jail.conf` 的 freeswitch 段，修改成下面这样：

```

enabled = true
port = 5060,5061,5080
action = iptables-allports
logpath= /usr/local/freeswitch/log/freeswitch.log
filter = freeswitch
maxretry = 5
bantime= -1
findtime = 3600
ignoreip = 127.0.0.1/8 192.168.0.0/16 10.0.0.0/8 172.16.0.0/16
```

其中：

* port = 5060,5061,5080 # sip profile 的端口
* action = iptables-allports# 这里不用改动
* logpath= /usr/local/freeswitch/log/freeswitch.log # freeswitch.log的全路径
* filter = freeswitch #这里不用改动
* maxretry = 5 # 尝试次数
* bantime= -1 # -1 永久 ban(禁止)
* findtime = 3600 # 发现的时间，这几个参数合起来的意思就是，如果 1 小时内检查到哪个 IP 地址，做了 5 次尝试，那么永久禁止他
* ignoreip = 127.0.0.1/8 192.168.0.0/16 10.0.0.0/8 172.16.0.0/16# ip 白名单

### 配置 freeswitch filter

修改`/etc/fail2ban/filter.d/freeswitch.conf`，改成下面这样：

```
# Fail2Ban configuration file
#
# Enable "log-auth-failures" on each Sofia profile to monitor
# <param name="log-auth-failures" value="true"/>
# -- this requires a high enough loglevel on your logs to save these messages.
#
# In the fail2ban jail.local file for this filter set ignoreip to the internal
# IP addresses on your LAN.
#

#failregex = ^\.\d+ \ sofia_reg\.c:\d+ SIP auth (failure|challenge) $(REGISTER|INVITE)$ on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
# ^\.\d+ \ sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$

failregex = ^\.\d+ \ sofia_reg\.c:\d+ SIP auth failure $(REGISTER|INVITE)$ on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
 ^\.\d+ \ sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$

ignoreregex =

# Author: Rupa SChomaker, soapee01, Daniel Black
# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
# Thanks to Jim on mailing list of samples and guidance
#
# No need to match the following. Its a duplicate of the SIP auth regex.
#^\.\d+ \ sofia\.c:\d+ IP <HOST> Rejected by acl "\S+"\. Falling back to Digest auth\.$

```

现在运行`systemctl restart fail2ban`重启服务

再运行 `fail2ban-client status`，输出如下：

```
Status
|- Number of jail: 1
`- Jail list: freeswitch
```

运行`fail2ban-client status freeswitch`，输出如下：

```
Status for the jail: freeswitch
|- Filter
||- Currently failed: 0
||- Total failed: 0
|`- File list: /usr/local/freeswitch/log/freeswitch.log
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
```

现在试着ban一个ip，执行这个命令：

```
fail2ban-client set freeswitch banip 113.113.113.113
```

然后用`fail2ban-client status freeswitch`查看

```
Status for the jail: freeswitch
|- Filter
||- Currently failed: 0
||- Total failed: 0
|`- File list: /usr/local/freeswitch/log/freeswitch.log
`- Actions
|- Currently banned: 1
|- Total banned: 3
`- Banned IP list: 113.113.113.113
```

可以看到， `113.113.113.113` 这个地址已经被ban

执行这个命令`iptables -nvL --line-numbers`

输出如下：

```
Chain INPUT (policy DROP 9 packets, 2952 bytes)
num pkts bytes target prot opt in out source destination
1 1057132K f2b-freeswitchall--* * 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT all--lo * 0.0.0.0/0 0.0.0.0/0
3 13 808 ACCEPT all--* * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
5 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
6 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
7 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5066
8 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:7443
9 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpts:5060:5061
10 0 0 ACCEPT udp--* * 0.0.0.0/0 0.0.0.0/0 udp dpt:5060
11 0 0 ACCEPT tcp--* * 0.0.0.0/0 0.0.0.0/0 tcp dpt:5080
12 0 0 ACCEPT udp--* * 0.0.0.0/0 0.0.0.0/0 udp dpt:5080
13 0 0 ACCEPT udp--* * 0.0.0.0/0 0.0.0.0/0 udp dpts:16384:32768
14 0 0 ACCEPT icmp --* * 0.0.0.0/0 0.0.0.0/0 icmptype 8

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 6 packets, 496 bytes)
num pkts bytes target prot opt in out source destination

Chain f2b-freeswitch (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all--* * 113.113.113.113 0.0.0.0/0 reject-with icmp-port-unreachable
2 1057132K RETURN all--* * 0.0.0.0/0 0.0.0.0/0

```

用这个命令解除，`fail2ban-client set freeswitch unbanip 113.113.113.113`

## 把 FreeSWITCH 运行起来，运行`tail -f /var/log/fail2ban.log`进行观察，再结合`/usr/local/freeswitch/log/freeswitch.log`的日志内容，进行调试，不断优化。

## fail2ban.lua

一般情况下`Fail2Ban`工作的很好，但还是有特殊的呼叫流程`Fail2Ban`抓不到。为此，笔者写了个`fail2ban.lua`，弥补`Fail2Ban`的不足

1. 修改`lua.conf.xml`，增加下面俩个配置项目：

```
<hook event="CUSTOM" subclass="sofia::wrong_call_state" script="fail2ban.lua"/>
<hook event="CUSTOM" subclass="sofia::register_failure" script="fail2ban.lua"/>
```

下面是`fail2ban.lua`的内容（代码比较简单，不再解释了）：

```
function OnEvent(e)
local subclass = e:getHeader("Event-Subclass") or ""
if string.find(subclass, "sofia::") ~= 1 then return end

local ip = e:getHeader("network_ip") or e:getHeader("network-ip")
if not ip then return end
local ua = e:getHeader("user-agent") or ""
local to_user = e:getHeader("to-user") or ""
local from_user = e:getHeader("from-user") or ""
local auth_result = e:getHeader("auth-result") or ""
local registration_type = e:getHeader("registration-type") or ""

local s = string.format("*** %s, ip = %s, ua = %s, to = %s, from = %s, result = %s, type = %s\n", subclass, ip, ua, to_user, from_user, auth_result, registration_type)
freeswitch.consoleLog("NOTICE", s)

if subclass == "sofia::wrong_call_state" or subclass == "sofia::register_failure" then
 local cmd = "fail2ban-client set freeswitch banip " .. ip
 freeswitch.consoleLog("ERR", cmd .. "\n")
 os.execute(cmd)
end
end

freeswitch.consoleLog("INFO", "fail2ban.lua, ===\n" .. event:serialize() .. "===\n")
OnEvent(event)
```

## 参考资料：

<https://docs.fusionpbx.com/en/latest/firewall/fail2ban.html>

<https://docs.fusionpbx.com/en/latest/firewall/iptables.html>

<https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban> </pre>
<pre>https://blog.csdn.net/weixin_43103905/article/details/95060220</pre>
<pre>注意： 如果遇到报错“no directory /var/run/fail2ban to contain the socket file /var/run/fail2ban/fail2ban.sock”, 请手动创建相关文件夹: mkdir /var/run/fail2ban</pre>
</div>
#开机启动 
$ systemctl enable fail2ban $ systemctl start fail2ban
<pre>redhat-initd </pre> 
来源：https://www.cnblogs.com/jasonzeng/p/13632444.html

頁: [1]

琼殿技术论坛's Archiver

centos配置Fail2Ban防止sip攻击`FreeSWITCH`