前回の投稿でfai2banで不正アクセス対策をした後にも、しつこくアクセス元を変えたり、以下のように fail2ban のフィルターに検出されないような手段でアクセスを試みている様子。
Failed to authenticate device 111<sip:111@NNN.NN.NNN.NNN>;tag=649747a9
voip-info.jp の SIP-Fail2ban の投稿記事を参考に SIP のブルートフォース攻撃を抑止するパッチを Asterisk 13.8.2 用に作成し、適用しました。
chan_sip.c の修正パッチ：
--- chan_sip.c.20160512 2016-05-12 10:55:25.221687414 +0900
+++ chan_sip.c 2016-05-12 11:09:13.753796299 +0900
@@ -19347,7 +19347,7 @@
return;
}
if (res < 0) { /* Something failed in authentication */
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
return;
@@ -25340,7 +25340,7 @@
return 0;
}
if (res < 0) { /* Something failed in authentication */
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
return 0;
@@ -26122,7 +26122,7 @@
goto request_invite_cleanup;
}
if (res < 0) { /* Something failed in authentication */
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response_reliable(p, "403 Forbidden", req);
p->invitestate = INV_COMPLETED;
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
@@ -27842,7 +27842,7 @@
p->lastinvite = seqno;
return 0;
} else if (auth_result < 0) {
- ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From"));
+ ast_log(LOG_NOTICE, "Failed to authenticate device %s (%s)\n", sip_get_header(req, "From"), ast_sockaddr_stringify(addr));
transmit_response(p, "403 Forbidden", req);
sip_scheddestroy(p, DEFAULT_TRANS_TIMEOUT);
ast_string_field_set(p, theirtag, NULL);
上記の変更を行い再ビルドした Asterisk を再起動してログを確認。パッチ適用後のログのように行末へ不正アクセス元のIPアドレスが表示されるようになりました。
※NNN.NN.NNN.NNN はサーバーのIPアドレス
パッチ適用前：
[2016-05-12 11:13:24] NOTICE[30781][C-0000002a]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 111<sip:111@NNN.NN.NNN.NNN>;tag=649747a9 [2016-05-12 11:13:26] NOTICE[30781][C-0000002b]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 111<sip:111@NNN.NN.NNN.NNN>;tag=f39f5f63 [2016-05-12 11:13:27] NOTICE[30781][C-0000002c]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 111<sip:111@NNN.NN.NNN.NNN>;tag=8e066fe2 [2016-05-12 11:13:28] NOTICE[30781][C-0000002d]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 111<sip:111@NNN.NN.NNN.NNN>;tag=6af3aa52
パッチ適用後：
[2016-05-12 11:21:07] NOTICE[8958][C-00000000]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 333<sip:333@NNN.NN.NNN.NNN>;tag=1b248211 (xxx.42.218.186:5076) [2016-05-12 11:21:08] NOTICE[8958][C-00000001]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 333<sip:333@NNN.NN.NNN.NNN>;tag=4323ab38 (xxx.42.218.186:5074) [2016-05-12 11:21:09] NOTICE[8958][C-00000002]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 333<sip:333@NNN.NN.NNN.NNN>;tag=ba356309 (xxx.42.218.186:5082) [2016-05-12 11:21:11] NOTICE[8958][C-00000003]: chan_sip.c:26125 handle_request_invite: Failed to authenticate device 333<sip:333@NNN.NN.NNN.NNN>;tag=7e32110c (xxx.42.218.186:5076)
voip-info.jp の投稿記事にありますように、Fail2ban のフィルターに以下のルールを適用すればこの手の不正アクセスを抑止することができるようになります。
NOTICE.* .*: Failed to authenticate user .* \(<HOST>:.*\)