en filter.d/asterisk.conf tengo esto:
Fail2Ban configuration file
#
Read common prefixes. If any customizations available -- read them from
common.local
#before = common.conf
#_daemon = asterisk
Option: failregex
Notes.: regex to match the password failures messages in the logfile. The
host must be matched by a group named "host". The tag "<HOST>" can
be used for standard IP/hostname matching and is only an alias for
(?:::f{4,6}🙂?(?P<host>\S+)
Values: TEXT
#
failregex = NOTICE.* .: Registration from '.' failed for '<HOST>(:[0-9]{1,5})?' - Wrong password
NOTICE.* .: Registration from '.' failed for '<HOST>(:[0-9]{1,5})?' - No matching peer found
NOTICE.* .: Registration from '.' failed for '<HOST>(:[0-9]{1,5})?' - Username/auth name mismatch
NOTICE.* .: Registration from '.' failed for '<HOST>(:[0-9]{1,5})?' - Device does not match ACL
NOTICE.* .: Registration from '.' failed for '<HOST>(:[0-9]{1,5})?' - Peer is not supposed to register
NOTICE.* .: <HOST> failed to authenticate as '.'$
NOTICE.* .: No registration for peer '.' (from <HOST>)
NOTICE.* .: Host <HOST> failed MD5 authentication for '.' (.)
NOTICE. .: Failed to authenticate user .@<HOST>.*
NOTICE.* .: Sending fake auth rejection for device .@<HOST>.*
Option: ignoreregex
Notes.: regex to ignore. If this regex matches, the line is ignored.
Values: TEXT
#
ignoreregex =
No logro ver nada en el CLI cuando reinicio fail2ban
Versión de Asterisk 1.8.23.1
