Fail2ban + logger.conf configurable

[Bethaaca]

I'm trying to make fail2ban works with Asterisk, but it's needed to add security log and to change the dateformat to "%F %T" in the logger.conf.

https://www.fail2ban.org/wiki/index.php/Asterisk

[TECH7Fox]

Currently logger.conf get's overwritten by the config. But I think we didn't add fail2ban because it required extra permissions for the add-on. @felipecrs probably knows more about this.

[felipecrs]

I don't recall. Sorry. :(

[TECH7Fox]

Wow quick. Yeah it was a while ago. if I remember correctly Fabio asked for fail2ban then. Anyways, not sure if it is possible in a add-on because it needs to access firewall settings right? And we would also need to stop setting the logger.conf.

[felipecrs]

Honestly I don't understand what's the purpose of fail2ban in this context.

[TECH7Fox]

Probably to ban bots right? @Bethaaca for now I suggest changing your ports to a non-default port, use some secure passwords and youre probably fine.

[felipecrs]

Well... is there anyone doing or planning to expose Asterisk running as Home Assistant add-on on external network/internet? Is that because of the WSS port? If so, we should focus on this instead:

• Access WSS interface directly from within HA asterisk-hass-integration#45

[TECH7Fox]

Ah, so the integration would also proxy wss trough the HA frontend? That fixes wss, but the SIP port would still be exposed to bots.

[felipecrs]

Ah, so the integration would also proxy wss trough the HA frontend?

Yeah, like the Frigate Integration does for the Frigate APIs.

but the SIP port would still be exposed to bots.

Only if you forwarded the port in the router. Then my question remains, is there someone doing this or planning on doing it? If there's none, then I would say "why should we bother".

[TECH7Fox]

True. For the SIP port it's probably fine as it is for now. The WSS proxy would be nice though.

[felipecrs]

Yes, that would also solve the case for people using Home Assistant Cloud.

[Bethaaca]

@TECH7Fox I thought of using the Add-on standalone fail2ban. fail2ban needs to read the log generated by Asterisk, but it only reads it in a certain format. Therefore, we would not mess with the security of the Add-on. Home Assistant itself produces log in the format required by fail2ban:

Asterisk:

if it is possible to do this with the Add-on, we could have one more layer of security when we use fail2ban.

[felipecrs]

• This is somewhat duplicated with Add fail2ban & iptables #51

[TECH7Fox]

This is somewhat duplicated with #51

Yes, but that was to add fail2ban itself into the add-on. This is just changing the format to support it.
If we just need to change the format to support fail2ban, sounds fine to me to make it the default. Only need to change the logger.conf template.

And might be nice to get the same format the rest of HA uses anyways.

[felipecrs]

Oh, now I understand. Yes, I totally agree!

[felipecrs]

@Bethaaca just so you know, PRs are accepted to change the log format. :)

[felipecrs]

@Bethaaca, you can now configure logger.conf since 3.0.0.

[Bethaaca]

@Bethaaca, you can now configure logger.conf since 3.0.0.

Nice. I´ll update (version 2.x.x yet) and try to change the dateformat. Thanks.

[Bethaaca]

Trust me, this is enough to use fail2ban. When I suffered the brute force attacks, my console showed every attempt (even without the additional "messages => security, notice, warning, error"), but I couldn't configure fail2ban to read the file. In this format it is already possible. I ended up configuring Asterisk with Linhome (@pergolafabio helped me with this configuration) and closing all ports due to insecurity.

Now I have to re-open the ports and reconfigure Asterisk to test fail2ban.

Nice job, nice job, guys!!!

Edit: I'm new to Asterisk, but I think leaving the editing power in the hands of the user helps to customize Asterisk, just as it originally is. It was a big improvement (3.0.0). Congrats.

[felipecrs]

I don't quite understand... does it mean we don't need #201?

If so, please close this issue and also the PR.

[felipecrs]

Thank you @Bethaaca. Let me just make sure I understand.

You are saying that even with the default configuration you can already setup fail2ban?

Or, if you changed something in logger.conf, can you please paste your customizations here, so that other people who try to make the same configuration can have it as a reference?

[Bethaaca]

Yes, off course.

Logger.conf:

[general]
dateformat=%F %T
[logfiles]
console => verbose(1),notice,warning,error

With this small change fail2ban can read the log. At the time I mainly used this site to use the Voip Black List and set up fail2ban.

[felipecrs]

Got it. Thank you!