Blocking Brute Force Hacking attacks on your FreePBX machine

[PitzKey (Itzik)]

@fxpro

However, the problem is, Fail2ban does NOT block ALL of the hacking attempts as you can check it yourself if you monitor your asterisk log file. You will see hundreds if not thousands of hack attempts from the SAME IP Address which should have been blocked by Fail2Ban but in reality it didn’t block them all.

Then you have fail2ban misconfigured.

fail2ban literally does exactly what your script is doing.

@fxpro

I was running fail2ban, with the Guest (advanced settings) set to OFF, before I used the script and I still got hacked within 24 hours of installing FreePBX on a network that was behind a firewall.

Show us your fail2ban settings.

If you want to block known attackers, use APIBAN, it works great.

Integrating apiban.org with FreePBX

The last few Open Source Lounge sessions have seen conversation around apiban.org, with last night’s session getting a detailed presentation by Fred Posner on how it all works. The apiban.org project is a SIP blacklist compiled from honeypots with a simple API that allows you to dynamically update iptables rules with known current attackers. Generally I’m not a fan of blacklists on principle, but there are obviously situations where whitelisting won’t work. If one is working with this constraint…