Displaying 9 results from an estimated 9 matches for "failedacl".
2015 Sep 13
4
Fail2ban
...o
authenticate (user|device) [^@]+@<HOST>\S*$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s
(?:handle_request_subscribe: )?Sending fake auth rejection for
(device|user) \d*<sip:[^@]+@<HOST>>;tag=$
^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s
SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",S$
^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])?
)Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
ignoreregex =
# Author: Xavier Devlamynck / Dani...
2017 Mar 01
3
fail2ban Asterisk 13.13.1
...'[^']*' \([^)]+\)$
^%(__prefix_line)s%(log_prefix)s Failed to authenticate
(user|device) [^@]+@<HOST>\S*$
^%(__prefix_line)s%(log_prefix)s hacking attempt detected
'<HOST>'$
^%(__prefix_line)s%(log_prefix)s
SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPa
ssword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",Eve
ntVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV
[46]/(UDP|TCP|WS)/...
2015 Jan 08
4
SEMI OFF-TOPIC - Fail2ban
...\([^)]+\)$
^%(log_prefix)s Failed to authenticate (user|device)
[^@]+@<HOST>\S*$
^%(log_prefix)s (?:handle_request_subscribe: )?Sending
fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*
$
^%(log_prefix)s
SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severit
y="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",Rem
ot...
2015 Sep 14
2
Fail2ban
...> ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s
>> (?:handle_request_subscribe: )?Sending fake auth rejection for
>> (device|user) \d*<sip:[^@]+@<HOST>>;tag=$
>> ^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s
>>
>> SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",S$
>>
>> ^(%(__prefix_line)s|\[\]\s*WARNING%(__pid_re)s:?(?:\[C-[\da-f]*\])?
>> )Ext\. s: "Rejecting unknown SIP connection from <HOST>"$
>>
>> ignoreregex =
>...
2018 May 17
2
Decoding SIP register hack
I need some help understanding SIP dialog. Some actor is trying to
access my server, but I can't figure out what he's trying to do ,or how.
I'm getting a lot of these warnings.
[May 17 10:08:08] WARNING[1532]: chan_sip.c:4068 retrans_pkt:
Retransmission timeout reached on transmission
_zIr9tDtBxeTVTY5F7z8kD7R.. for seqno 101
With SIP DEBUG I tracked the Call-ID to this INVITE :
2015 Jan 09
0
SEMI OFF-TOPIC - Fail2ban
...\([^)]+\)$
^%(log_prefix)s Failed to authenticate (user|device)
[^@]+@<HOST>\S*$
^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth
rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S* $
^%(log_prefix)s
SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPa
ssword)",EventTV="[\d-]+",Severit
y="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\
da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",Rem...
2017 Mar 02
3
fail2ban Asterisk 13.13.1
...'[^']*' \([^)]+\)$
^%(__prefix_line)s%(log_prefix)s Failed to authenticate
(user|device) [^@]+@<HOST>\S*$
^%(__prefix_line)s%(log_prefix)s hacking attempt detected
'<HOST>'$
^%(__prefix_line)s%(log_prefix)s
SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPa
ssword)",EventTV="([\d-]+|%(iso8601)s)",Severity="[\w]+",Service="[\w]+",Eve
ntVersion="\d+",AccountID="(\d*|<unknown>)",SessionID=".+",LocalAddress="IPV
[46]/(UDP|TCP|WS)/...
2018 May 17
3
Decoding SIP register hack
...ss to register peer
> '.*'
> ???????? SECURITY.* .*:
> SecurityEvent="InvalidAccountID".*,Severity="Error",Service="SIP".*,Rem
> oteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"
> ???????? SECURITY.* .*:
> SecurityEvent="FailedACL".*,Severity="Error",Service="SIP".*,RemoteAddr
> ess="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"
> ???????? SECURITY.* .*:
> SecurityEvent="InvalidPassword".*,Severity="Error",Service="SIP".*,Remo
> teAddress="IPV[46...
2019 Jun 06
2
Fail2ban for asterisk 16 PJSIP
Hello
Anyone have a working copy of Fail2ban asterisk filter asterisk.conf
for Asterisk 16 running PJSIP.
I have tried 10 different filters but none of them show any matches when testing with
fail2ban-regex
I see date template hits but no matches....
My log
[2019-06-06 15:37:20] NOTICE[18081] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"2405" <sip:2405 at