使用fail2ban+iptables防范VOIP攻击

FreeSWITCHVOIP攻击防范说明1■总体说明使用fail2ban+iptables相结合，防范VOIP攻击。2.Fail2ban安装与配置安装Fail2banA、 安装yum。（略）B、 安装EPEL源#rpm-ivhhttp://downl/pub/epel/5/i386/epel-release-5-4.noarch.rpmC、 安装fail2ban#yuminstallfail2ban配置Fail2ban2・2・1配置日志级别及路径文件：/etc/fail2ban/fail2ban.conf[Dezinition]1Opti口d;logictMotes.™Setthelogleveloutput„#1-ERROR2=WARN3-INFO*专=DEBUGtValuess*NUM[>2：fault! 3loglevel=3fCpticnslogtarget1Efores・；；secLneloaLargel・Halscouldi>earilePsyslog,stderrorstdout・tOelLva-nelogtargetcanbespecified.#Values:tSTD01DTSTDERR3Y3L0GfileDc£a.ult;/var/lag/failSbaxi・loy1口gtai口亡匕-1-fvar/logffaiL2ba口・1og默认fail2ban.conf里面就三个参数，而且都有注释。#默认日志的级别loglevel=3#日志的存放路径logtarget=/var/log/fail2ban.log#socket的位置socket=/tmp/fail2ban.sock我们主要修改日志的存放路径，修改为/var/log/fail2ban.log2・2・2Fail2ban全局配置文件：/etc/fail2ban/jail.conf[DEFAULT]"ignoreip"canbeanIPaddress^aCIDRnaskoraDNShost・Fail2banwillnotba^ahostwhichmatchesanaddressidthislist・Severaladdressescanbedefinedusingspaceseparacoz-.ignoreip—127・O・D・1mba口tine11isthenurnberofsecondsthat且hostist＞且nned.bantime=600IAhostxsbannedifithasgeneratedITniaii?eti?ym，dixringthelastwfiind.uinie"aecands・rindLime=&ooRmawi?亡ticyEisthenumberoffailurssbeforeahostgetbanned・Ttiaxretry=3|#vi/etc/fail2ban/jail.conf#忽略IP的范围如果有二组以上用空白做为间隔ignoreip=#设定IP被封锁的时间（秒），如果值为-1,代表永远封锁bantime=600#设定在多少时间内达到maxretry的次数就封锁findtime=600#设定在多少时间内达到maxretry的次数就封锁maxretry=3#允许尝试的次数上面设置的意思是如果在findtime内达到maxretry，则进行封锁，封锁时间是bantime。即十分钟内重试3天都失败的话，客户端所在的IP会被封锁10分钟。3.FreeSWITCH配置使用fail2ban时，需要开启freeswitch的注册错误日志，以便进行跟踪：文件：/usr/local/uswitch/conf/sip_profiles/internal.xml将下面的属性设置为true，如下所示：吒二&二亡二^arr.亡=''工口口一邑mtl一工凰iJ.nr■亡s"vaLj.±="true">4.防火墙iptables配置开启防火墙使用以下命令开启防火墙：#chkconfigiptableson注：如果需要关闭防火墙的话，使用命令chkconfigiptablesoff即可。开放SIP相关端口A、修改防火墙配置文件：/etc/sysconfig/iptables-config将下面两个圈出来的属性修改为yes，如下所示:Savecmrrentfirewallrulesonstop・Value:yesIdefault:noSavesallfirewallrulesto/etc/aysconfig/iptablesiffirewallgetsstopped，巳・g・onsystemshutdown)^IPTAELES_SS^EjC^_STOP=ny^3nSavscurrentfirewall工ulesonrestart・Value:yes|nordefault:notSavssallfirewallrulesto/etc/sconfig/iptatolesiffirewallgetsr^scaru已C・IPTABLES5AVEONRE5TMtT=wyesnB、 重启防火墙#serviceiptablesrestartC、 增加开放的SIP端口文件：/etc/sysconfig/iptables在iptables中添加如下的语句：#FreeSwith-ARH-Firewall-1-INPUT-mudp-pudp--dport1719-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport1720-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport3478-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport3479-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5002-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport5003-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport5060-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5060-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp--dport5070-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5070-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp--dport5080-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5080-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp-mmultiport--dports16384:32768-jACCEPT#endofFreeSwitch注：上面的规则在防火墙中添加了SIP和RTP端口。D、重启防火墙需要重启防火墙，使上面的配置生效：#serviceiptablesrestart5.Fail2ban防范攻击配置5.1 防范SIP注册失败攻击该攻击是由攻击方短时间内大量发起SIP注册消息，导致服务器瘫痪。5.1.1增加规则匹配文件#vi/etc/fail2ban/filter.d/freeswitch.conf在/etc/fail2ban/filter.d下新建freeswitch.conf文件，内容如下：Fail2Banconfigurationfile#Author:RupaSChomaker#[Definition]Option:failregexNotes.:regextomatchthepasswordfailuresmessagesinthelogfile.Thehostmustbematchedbyagroupnamed"host".Thetag"<HOST>"canbeusedforstandardIP/hostnamematchingandisonlyanaliasfor(?:::f{4,6}:)?(?P<host>[\w\-.A_]+)Values:TEXT#failregex='[WARNING、]sofia_reg.c:\d+SIPauthfailure'(REGISTER、)onsofiaprofile\'\w+\'for\[.*\]fromip<HOST>\[WARNING\]sofia_reg.c:\d+SIPauthfailure\(INVITE\)onsofiaprofile\'\w+\'for\[.*\]fromip<HOST>Option:ignoreregexNotes.:regextoignore.Ifthisregexmatches,thelineisignored.Values:TEXT#ignoreregex=修改jail.conf文件#vi/etc/fail2ban/jail.conf在文件的最后添加上如下的内容：[freeswitch-tcp]enabled=trueport=5060,5061,5080,5081protocol=tcpfilter=freeswitchlogpath=/usr/local/freeswitch/log/freeswitch.logaction=iptables-allports[name=freeswitch-tcp,protocol=all]sendmail-whois[name=FreeSwitch,dest=root,sender=][freeswitch-udp]enabled=trueport=5060,5061,5080,5081protocol=udpfilter=freeswitchlogpath=/usr/local/freeswitch/log/freeswitch.logaction=iptables-allports[name=freeswitch-udp,protocol=all]sendmail-whois[name=FreeSwitch,dest=root,sender=]5・1・3重启fail2ban#/etc/init.d/fail2banrestart5.1.4检查规则是否被加载进iptables中iptables-Lfail2ban-freeswitch-udpiptables-Lfail2ban-freeswitch-tcp如果出现如下结果，则证明配置正确:[roo七屜1.口匚且IIipw七failSban] :1严七Ables-Lfai12ba.n.-fz-eeswitoh-udpChainfail2ban-fxeeswi七di-ticip references)target pxotoptsauxce ti-estina.tion.RETURN all一一anyvheze re[xaatSlacalliast #Iptables-LIail2b-a.n.~fx-eeswitcli-tcpChainfail2ban-freeswitch-1cp(1referenc亡b)targ亡匸 protoptsoutge <i-estin.a.tion.RETURN all一一anywhere anywhere[roQteiocaltiostfail2ban]#5・1・5测试是否有效使用easytalk，连续多次用错误的密码进行登录。

超过三次后就会提示服务器无法连接，说明该IP已被服务器封锁。5.2 防范SIPDOS攻击当freeswitch的日志中连续大量出现相同号码的日志信息时，说明已被DOS攻击:±roiD.i.E：109fromip103ironiid109irone,ip103163-63■:弓2165.63・二4=163±roiD.i.E：109fromip103ironiid109irone,ip103163-63■:弓2165.63・二4=163曲・16^.63-142SIE auth. challenge (REGISTER) cn pro■丄总 1xr.terr.a.111 ±oz [q>7ert^123010・2・E2・G[5IE auth challerg^ (REGISTER) cn szzic profile 1ir.t"=二匚a.1p foi ■qr^erty22S@L0・2・dEL弓]■ 5IE autA challenge (REGISTER) cn 弓二二九且 protzle ■zlexeztc注1■ roz [qx皂兰匸空二匸3也二口在这种情况下，需要在fail2ban中增加新的规则，以避免该攻击:5・2・1增加规则匹配文件#vi/etc/fail2ban/filter.d/freeswitch-dos.conf在/etc/fail2ban/filter.d下新建freeswitch-dos.conf文件，内容如下:Fail2Banconfigurationfile#Author:soapee01#[Definition]#Option:failregex#Notes.:regextomatchthepasswordfailuresmessagesinthelogfile.The#can##hostmustbematchedbyagroupnamed"host".Thetag"<HOST>"beusedforstandardIP/hostnamematchingandisonlyanaliasfor(?:::f{4,6}:)?(?Pvhost>[\w\」」+)Values:#TEXTfailregex