TIPS How to get a warm and fuzzy Fail2ban feeling?

[redstonemason]

Is there a simple way to see that fail2ban and iptables are both working harmoniously to block bad stuff?

Never had the urge to look because I had a Hosting Provider Firewall in front of my iPBX's.

But on RackNerd, I gotta take more responsibility.

Mark

 

[wardmundy]

iptables -nL

 

[dicko]

If you don't see UDP/5060 ONLY allowed from 'known hosts/nets' in your iptables rules, it is way to early to feel warm and fuzzy. (of course, if you are already not listening on UDP/5060, you are already way ahead of the game )


Also, be aware that most recent ' penetrations' are not in any way a first derivative of your SIP configuration . . . .

 

[krzykat]

(of course, if you are already not listening on UDP/5060, you are already way ahead of the game )

Good thing you added that, cause I know how you think and I was going to chastise you for that ... what do you mean 5060 ... someone told me NEVER use 5060 LOL.

 

[krzykat]

By the way, @wardmundy has made different firewall options over the years. I think if you know who you're carriers are and if the extensions are on a constant IP, then Whitelist is the best option - then only those that are listed get access to anything. For those that have extensions that roam or change IP's, then the Blacklist combined with Fail2ban is the best option. Just make sure you're doing all you can. As referenced above, changing your SIP port away from 5060 is a good move, changing SSH to something besides 22 is also a good move, and lastly, setting a FQDN to your server and forcing your extensions to use domain=yourFQDN are all best practices IMHO.

 

[dicko]

The problem does not lie in extensions trying to REGISTER or INVITE to the IP of the PBX but that the server is replying to IP requests which is a 'tell' to the bad-guys. Strict SNI is a good starting concept but can't work if you use UDP.

 

[redstonemason]

Sorry about the very late response to all of you that contributed. I did listen to all of you very qualified folks!

SSH by 'key only' and on a port other than 22 is a good thing always.
SIP is still on 5060 which I should reconsider.

By no means (IMHO) is iptables going to be retired in my life time but I am embracing NFTABLES for bulding rulesets.

Why do I like NFTABLES? Easy to see your attack surface and velocity of attacks with some 'counters'. This way I don't need 72 different packages to gather, collect, aggregate, deduplicate and display, alert etc. You get the picture - although you may disagree.

 

[KNERD]

There is also "fail2ban-client" which will show you status of things.

 

[redstonemason]

Found it. Thanks.
It does show some stats for me!
Version is reported as Fail2Ban v0.11.2.
It just uses Python "fail2ban.client.fail2banclient"

 

[wardmundy]

Sorry about the very late response to all of you that contributed. I did listen to all of you very qualified folks!

SSH by 'key only' and on a port other than 22 is a good thing always.
SIP is still on 5060 which I should reconsider.

By no means (IMHO) is iptables going to be retired in my life time but I am embracing NFTABLES for bulding rulesets.

Why do I like NFTABLES? Easy to see your attack surface and velocity of attacks with some 'counters'. This way I don't need 72 different packages to gather, collect, aggregate, deduplicate and display, alert etc. You get the picture - although you may disagree.

Security 101: If it ain't broke...

 

[krzykat]

Security 101: If it ain't broke...

let Sangoma fix it