centos配置Fail2Ban防止sip攻击`FreeSWITCH`

# 使用`Fail2Ban`防止sip攻击`FreeSWITCH`
`FreeSWITCH`在公网运行容易遭受sip攻击，解决的办法有很多种，而`Fail2Ban`安装配置以及调试比较简单，不失为一种好的选择。
`Fail2Ban`版本很多，配置方式略有差别。
本次测试是基于`Fail2Ban 0.9.`版本，其他相关信息如下：
    - Debian9
    - FreeSWITCH 1.10.，`base_dir`是`/usr/local/freeswitch`
## 安装`Fail2Ban`
```shell
cd /usr/src; git clone https://github.com/fail2ban/fail2ban.git -b 0.9.6
cd /usr/src/fail2ban; python3 setup.py install
#配置成服务
cp files/debian-initd /etc/init.d/fail2ban
#centos 

cp files/redhat-initd /etc/init.d/fail2ban

https://github.com/fail2ban/fail2ban/blob/0.11/files/redhat-initd
update-rc.d fail2ban defaults
service fail2ban start
```
## 配置`iptables`
```shell
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport : -j ACCEPT
iptables -A INPUT -p udp --dport  -j ACCEPT
iptables -A INPUT -p tcp --dport  -j ACCEPT
iptables -A INPUT -p udp --dport  -j ACCEPT
iptables -A INPUT -p udp --dport : -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
```
## 配置 `FreeSWITCH`
. sip_profiles/internal.xml
```
<param name="log-auth-failures" value="true"/>
```
. autoload_configs/switch.conf.xml 要修改一个配置项目
```
<param name="threaded-system-exec" value="true"/>
```
## 配置 fail2ban
### 配置 freeswitch jail
找到 `/etc/fail2ban/jail.conf` 的 freeswitch 段，修改成下面这样：
```
[freeswitch]
enabled = true
port     = ,,
action   = iptables-allports[name=freeswitch, protocol=all]
logpath  = /usr/local/freeswitch/log/freeswitch.log
filter   = freeswitch
maxretry = 
bantime  = -
findtime = 
ignoreip = 127.0.0.1/ 192.168.0.0/ 10.0.0.0/ 172.16.0.0/
```
其中：
* port     = ,,    # sip profile 的端口
* action   = iptables-allports[name=freeswitch, protocol=all]  # 这里不用改动
* logpath  = /usr/local/freeswitch/log/freeswitch.log # freeswitch.log的全路径
* filter   = freeswitch    #这里不用改动
* maxretry =              # 尝试次数
* bantime  = -            # - 永久 ban(禁止)
* findtime =           # 发现的时间，这几个参数合起来的意思就是，如果  小时内检查到 哪个 IP 地址，做了  次尝试，那么永久禁止他
* ignoreip = 127.0.0.1/ 192.168.0.0/ 10.0.0.0/ 172.16.0.0/  # ip 白名单
### 配置 freeswitch filter
修改`/etc/fail2ban/filter.d/freeswitch.conf`，改成下面这样：
```
# Fail2Ban configuration file
#
# Enable "log-auth-failures" on each Sofia profile to monitor
# <param name="log-auth-failures" value="true"/>
# -- this requires a high enough loglevel on your logs to save these messages.
#
# In the fail2ban jail.local file for this filter set ignoreip to the internal
# IP addresses on your LAN.
#
[Definition]
#failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
#            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
failregex = ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ SIP auth failure \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for \[.*\] from ip <HOST>$
            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$
ignoreregex =
# Author: Rupa SChomaker, soapee01, Daniel Black
# https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban
# Thanks to Jim on mailing list of samples and guidance
#
# No need to match the following. Its a duplicate of the SIP auth regex.
#  ^\.\d+ \[DEBUG\] sofia\.c:\d+ IP <HOST> Rejected by acl "\S+"\. Falling back to Digest auth\.$
```
现在运行`systemctl restart fail2ban`重启服务
再运行 `fail2ban-client status`，输出如下：
```
Status
|- Number of jail:      
`- Jail list:   freeswitch
```
运行`fail2ban-client status freeswitch`，输出如下：
```
Status for the jail: freeswitch
|- Filter
|  |- Currently failed: 
|  |- Total failed:     
|  `- File list:        /usr/local/freeswitch/log/freeswitch.log
`- Actions
   |- Currently banned: 
   |- Total banned:     
   `- Banned IP list:
```
现在试着ban一个ip，执行这个命令：
```
fail2ban-client set freeswitch banip 113.113.113.113
```
然后用`fail2ban-client status freeswitch`查看
```
Status for the jail: freeswitch
|- Filter
|  |- Currently failed: 
|  |- Total failed:     
|  `- File list:        /usr/local/freeswitch/log/freeswitch.log
`- Actions
   |- Currently banned: 
   |- Total banned:     
   `- Banned IP list:   113.113.113.113
```
可以看到， `113.113.113.113` 这个地址已经被ban
执行这个命令`iptables -nvL --line-numbers`
输出如下：
```
Chain INPUT (policy DROP  packets,  bytes)
num   pkts bytes target     prot opt in     out     source               destination
       132K f2b-freeswitch  all  --  *      *       0.0.0.0/            0.0.0.0/
              ACCEPT     all  --  lo     *       0.0.0.0/            0.0.0.0/
           ACCEPT     all  --  *      *       0.0.0.0/            0.0.0.0/            state RELATED,ESTABLISHED
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
              ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpts::
             ACCEPT     udp  --  *      *       0.0.0.0/            0.0.0.0/            udp dpt:
             ACCEPT     tcp  --  *      *       0.0.0.0/            0.0.0.0/            tcp dpt:
             ACCEPT     udp  --  *      *       0.0.0.0/            0.0.0.0/            udp dpt:
             ACCEPT     udp  --  *      *       0.0.0.0/            0.0.0.0/            udp dpts::
             ACCEPT     icmp --  *      *       0.0.0.0/            0.0.0.0/            icmptype 
Chain FORWARD (policy DROP  packets,  bytes)
num   pkts bytes target     prot opt in     out     source               destination
Chain OUTPUT (policy ACCEPT  packets,  bytes)
num   pkts bytes target     prot opt in     out     source               destination
Chain f2b-freeswitch ( references)
num   pkts bytes target     prot opt in     out     source               destination
              REJECT     all  --  *      *       113.113.113.113      0.0.0.0/            reject-with icmp-port-unreachable
       132K RETURN     all  --  *      *       0.0.0.0/            0.0.0.0/
```
用这个命令解除，`fail2ban-client set freeswitch unbanip 113.113.113.113`
## 把 FreeSWITCH 运行起来，运行`tail -f /var/log/fail2ban.log`进行观察，再结合`/usr/local/freeswitch/log/freeswitch.log`的日志内容，进行调试，不断优化。
## fail2ban.lua
一般情况下`Fail2Ban`工作的很好，但还是有特殊的呼叫流程`Fail2Ban`抓不到。为此，笔者写了个`fail2ban.lua`，弥补`Fail2Ban`的不足
. 修改`lua.conf.xml`，增加下面俩个配置项目：
```
<hook event="CUSTOM" subclass="sofia::wrong_call_state" script="fail2ban.lua"/>
<hook event="CUSTOM" subclass="sofia::register_failure" script="fail2ban.lua"/>
```
下面是`fail2ban.lua`的内容（代码比较简单，不再解释了）：
```
function OnEvent(e)
    local subclass = e:getHeader("Event-Subclass") or ""
    if string.find(subclass, "sofia::") ~=  then return end
    local ip = e:getHeader("network_ip") or e:getHeader("network-ip")
    if not ip then return end
    local ua = e:getHeader("user-agent") or ""
     local to_user = e:getHeader("to-user") or ""
    local from_user = e:getHeader("from-user") or ""
    local auth_result = e:getHeader("auth-result") or ""
    local registration_type = e:getHeader("registration-type") or ""
    local s = string.format("*** %s, ip = %s, ua = %s, to = %s, from = %s, result = %s, type = %s\n", subclass, ip, ua, to_user, from_user, auth_result, registration_type)
    freeswitch.consoleLog("NOTICE", s)
    if subclass == "sofia::wrong_call_state" or subclass == "sofia::register_failure" then
        local cmd = "fail2ban-client set freeswitch banip " .. ip
        freeswitch.consoleLog("ERR", cmd .. "\n")
        os.execute(cmd)
    end
end
freeswitch.consoleLog("INFO", "fail2ban.lua, ===\n" .. event:serialize() .. "===\n")
OnEvent(event)
```
## 参考资料：
<https://docs.fusionpbx.com/en/latest/firewall/fail2ban.html>
<https://docs.fusionpbx.com/en/latest/firewall/iptables.html>
<https://freeswitch.org/confluence/display/FREESWITCH/Fail2Ban>

https://blog.csdn.net/weixin_43103905/article/details/95060220

注意：
如果遇到报错“no directory /var/run/fail2ban to contain the socket file /var/run/fail2ban/fail2ban.sock”, 请手动创建相关文件夹:
mkdir /var/run/fail2ban