Asterisk 19服务器遭攻击，求适配的Fail2Ban正则表达式

我的Asterisk 19服务器正遭受攻击，虽已配置针对Asterisk日志的Fail2Ban jail，但当前配置无法识别以下攻击场景：

[2023-07-27 11:25:57] NOTICE[152571] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"213" <sip:213@54.36.115.125>' failed for '185.210.157.40:5977' (callid: 1048704493) - Failed to authenticate
[2023-07-27 11:25:57] NOTICE[152571] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"322" <sip:322@54.36.115.125>' failed for '185.210.157.40:5803' (callid: 522785130) - No matching endpoint found after 35 tries in 0.182 ms
[2023-07-27 11:25:57] NOTICE[152571] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"322" <sip:322@54.36.115.125>' failed for '185.210.157.40:5803' (callid: 522785130) - Failed to authenticate
[2023-07-27 11:25:57] NOTICE[152570] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"322" <sip:322@54.36.115.125>' failed for '185.210.157.40:5803' (callid: 1616436563) - No matching endpoint found after 36 tries in 0.187 ms
[2023-07-27 11:25:57] NOTICE[152570] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"322" <sip:322@54.36.115.125>' failed for '185.210.157.40:5803' (callid: 1616436563) - Failed to authenticate
[2023-07-27 11:25:57] NOTICE[152570] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"213" <sip:213@54.36.115.125>' failed for '185.210.157.40:5977' (callid: 2926631629) - No matching endpoint found after 37 tries in 0.199 ms
[2023-07-27 11:25:57] NOTICE[152570] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"213" <sip:213@54.36.115.125>' failed for '185.210.157.40:5977' (callid: 2926631629) - Failed to authenticate
[2023-07-27 11:25:57] NOTICE[152571] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"212" <sip:212@54.36.115.125>' failed for '185.210.157.40:5677' (callid: 2397138656) - No matching endpoint found after 38 tries in 0.200 ms
[2023-07-27 11:25:57] NOTICE[152571] res_pjsip/pjsip_distributor.c: Request 'REGISTER' from '"212" <sip:212@54.36.115.125>' failed for '185.210.157.40:5677' (callid: 2397138656) - Failed to authenticate

当前的/etc/fail2ban/asterisk-security.conf配置如下：

[INCLUDES]

[Definition]

failregex = SECURITY.* SecurityEvent="FailedACL".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="InvalidAccountID".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="ChallengeResponseFailed".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="InvalidPassword".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*

ignoreregex =

对正则表达式了解有限，恳请帮忙修改failregex规则以检测此类攻击！

解决方案 #

在现有failregex规则基础上，添加针对PJSIP注册失败日志的匹配规则即可。修改后的完整配置如下：

[INCLUDES]

[Definition]

failregex = SECURITY.* SecurityEvent="FailedACL".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="InvalidAccountID".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="ChallengeResponseFailed".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            SECURITY.* SecurityEvent="InvalidPassword".*RemoteAddress="[^"]*/[^"]*/(<HOST>)/[^"]*".*
            NOTICE.* res_pjsip/pjsip_distributor.c: Request 'REGISTER'.*failed for '<HOST>:[0-9]+'.* - Failed to authenticate
            NOTICE.* res_pjsip/pjsip_distributor.c: Request 'REGISTER'.*failed for '<HOST>:[0-9]+'.* - No matching endpoint found

ignoreregex =

规则说明 #

• 新增的第一条规则：匹配认证失败的REGISTER请求日志，精准提取攻击源IP
• 新增的第二条规则：匹配找不到对应端点的REGISTER请求日志，覆盖日志中两种典型攻击场景

验证与生效步骤 #

1. 测试规则匹配情况，执行命令：

fail2ban-regex /var/log/asterisk/messages /etc/fail2ban/asterisk-security.conf

输出中若显示成功匹配到目标日志条目，说明规则有效。

2. 重启Fail2Ban服务使配置生效：

systemctl restart fail2ban

内容的提问来源于stack exchange，提问作者Fabianus