使用fail2ban+iptables防范VOIP攻擊

FreeSWITCHVOIP攻擊防范說明1■總體說明使用fail2ban+iptables相結(jié)合，防范VOIP攻擊。2.Fail2ban安裝與配置安裝Fail2banA、 安裝yum。（略）B、 安裝EPEL源#rpm-ivhhttp://downl/pub/epel/5/i386/epel-release-5-4.noarch.rpmC、 安裝fail2ban#yuminstallfail2ban配置Fail2ban2?2?1配置日志級(jí)別及路徑文件：/etc/fail2ban/fail2ban.conf[Dezinition]1Opti口d;logictMotes.?Setthelogleveloutput?#1-ERROR2=WARN3-INFO*專=DEBUGtValuess*NUM[>2：fault! 3loglevel=3fCpticnslogtarget1Efores?；；secLneloaLargel?Halscouldi>earilePsyslog,stderrorstdout?tOelLva-nelogtargetcanbespecified.#Values:tSTD01DTSTDERR3Y3L0GfileDc￡a.ult;/var/lag/failSbaxi?loy1口gtai口亡匕-1-fvar/logffaiL2ba口?1og默認(rèn)fail2ban.conf里面就三個(gè)參數(shù)，而且都有注釋。#默認(rèn)日志的級(jí)別loglevel=3#日志的存放路徑logtarget=/var/log/fail2ban.log#socket的位置socket=/tmp/fail2ban.sock我們主要修改日志的存放路徑，修改為/var/log/fail2ban.log2?2?2Fail2ban全局配置文件：/etc/fail2ban/jail.conf[DEFAULT]"ignoreip"canbeanIPaddress^aCIDRnaskoraDNShost?Fail2banwillnotba^ahostwhichmatchesanaddressidthislist?Severaladdressescanbedefinedusingspaceseparacoz-.ignoreip—127?O?D?1mba口tine11isthenurnberofsecondsthat且hostist＞且nned.bantime=600IAhostxsbannedifithasgeneratedITniaii?eti?ym，dixringthelastwfiind.uinie"aecands?rindLime=&ooRmawi?亡ticyEisthenumberoffailurssbeforeahostgetbanned?Ttiaxretry=3|#vi/etc/fail2ban/jail.conf#忽略IP的范圍如果有二組以上用空白做為間隔ignoreip=#設(shè)定IP被封鎖的時(shí)間（秒），如果值為-1,代表永遠(yuǎn)封鎖bantime=600#設(shè)定在多少時(shí)間內(nèi)達(dá)到maxretry的次數(shù)就封鎖findtime=600#設(shè)定在多少時(shí)間內(nèi)達(dá)到maxretry的次數(shù)就封鎖maxretry=3#允許嘗試的次數(shù)上面設(shè)置的意思是如果在findtime內(nèi)達(dá)到maxretry，則進(jìn)行封鎖，封鎖時(shí)間是bantime。即十分鐘內(nèi)重試3天都失敗的話，客戶端所在的IP會(huì)被封鎖10分鐘。3.FreeSWITCH配置使用fail2ban時(shí)，需要開啟freeswitch的注冊錯(cuò)誤日志，以便進(jìn)行跟蹤：文件：/usr/local/uswitch/conf/sip_profiles/internal.xml將下面的屬性設(shè)置為true，如下所示：吒二&二亡二^arr.亡=''工口口一邑mtl一工凰iJ.nr■亡s"vaLj.±="true">4.防火墻iptables配置開啟防火墻使用以下命令開啟防火墻：#chkconfigiptableson注：如果需要關(guān)閉防火墻的話，使用命令chkconfigiptablesoff即可。開放SIP相關(guān)端口A、修改防火墻配置文件：/etc/sysconfig/iptables-config將下面兩個(gè)圈出來的屬性修改為yes，如下所示:Savecmrrentfirewallrulesonstop?Value:yesIdefault:noSavesallfirewallrulesto/etc/aysconfig/iptablesiffirewallgetsstopped，巳?g?onsystemshutdown)^IPTAELES_SS^EjC^_STOP=ny^3nSavscurrentfirewall工ulesonrestart?Value:yes|nordefault:notSavssallfirewallrulesto/etc/sconfig/iptatolesiffirewallgetsr^scaru已C?IPTABLES5AVEONRE5TMtT=wyesnB、 重啟防火墻#serviceiptablesrestartC、 增加開放的SIP端口文件：/etc/sysconfig/iptables在iptables中添加如下的語句：#FreeSwith-ARH-Firewall-1-INPUT-mudp-pudp--dport1719-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport1720-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport3478-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport3479-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5002-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport5003-jACCEPT-ARH-Firewall-1-INPUT-mudp -pudp --dport5060-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5060-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp--dport5070-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5070-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp--dport5080-jACCEPT-ARH-Firewall-1-INPUT-mstate--stateNEW-mtcp-ptcp--dport5080-jACCEPT-ARH-Firewall-1-INPUT-mudp-pudp-mmultiport--dports16384:32768-jACCEPT#endofFreeSwitch注：上面的規(guī)則在防火墻中添加了SIP和RTP端口。D、重啟防火墻需要重啟防火墻，使上面的配置生效：#serviceiptablesrestart5.Fail2ban防范攻擊配置5.1 防范SIP注冊失敗攻擊該攻擊是由攻擊方短時(shí)間內(nèi)大量發(fā)起SIP注冊消息，導(dǎo)致服務(wù)器癱瘓。5.1.1增加規(guī)則匹配文件#vi/etc/fail2ban/filter.d/freeswitch.conf在/etc/fail2ban/filter.d下新建freeswitch.conf文件，內(nèi)容如下：Fail2Banconfigurationfile#Author:RupaSChomaker#[Definition]Option:failregexNotes.:regextomatchthepasswordfailuresmessagesinthelogfile.Thehostmustbematchedbyagroupnamed"host".Thetag"<HOST>"canbeusedforstandardIP/hostnamematchingandisonlyanaliasfor(?:::f{4,6}:)?(?P<host>[\w\-.A_]+)Values:TEXT#failregex='[WARNING、]sofia_reg.c:\d+SIPauthfailure'(REGISTER、)onsofiaprofile\'\w+\'for\[.*\]fromip<HOST>\[WARNING\]sofia_reg.c:\d+SIPauthfailure\(INVITE\)onsofiaprofile\'\w+\'for\[.*\]fromip<HOST>Option:ignoreregexNotes.:regextoignore.Ifthisregexmatches,thelineisignored.Values:TEXT#ignoreregex=修改jail.conf文件#vi/etc/fail2ban/jail.conf在文件的最后添加上如下的內(nèi)容：[freeswitch-tcp]enabled=trueport=5060,5061,5080,5081protocol=tcpfilter=freeswitchlogpath=/usr/local/freeswitch/log/freeswitch.logaction=iptables-allports[name=freeswitch-tcp,protocol=all]sendmail-whois[name=FreeSwitch,dest=root,sender=][freeswitch-udp]enabled=trueport=5060,5061,5080,5081protocol=udpfilter=freeswitchlogpath=/usr/local/freeswitch/log/freeswitch.logaction=iptables-allports[name=freeswitch-udp,protocol=all]sendmail-whois[name=FreeSwitch,dest=root,sender=]5?1?3重啟fail2ban#/etc/init.d/fail2banrestart5.1.4檢查規(guī)則是否被加載進(jìn)iptables中iptables-Lfail2ban-freeswitch-udpiptables-Lfail2ban-freeswitch-tcp如果出現(xiàn)如下結(jié)果，則證明配置正確:[roo七屜1.口匚且IIipw七failSban] :1嚴(yán)七Ables-Lfai12ba.n.-fz-eeswitoh-udpChainfail2ban-fxeeswi七di-ticip references)target pxotoptsauxce ti-estina.tion.RETURN all一一anyvheze re[xaatSlacalliast #Iptables-LIail2b-a.n.~fx-eeswitcli-tcpChainfail2ban-freeswitch-1cp(1referenc亡b)targ亡匸 protoptsoutge <i-estin.a.tion.RETURN all一一anywhere anywhere[roQteiocaltiostfail2ban]#5?1?5測試是否有效使用easytalk，連續(xù)多次用錯(cuò)誤的密碼進(jìn)行登錄。

超過三次后就會(huì)提示服務(wù)器無法連接，說明該IP已被服務(wù)器封鎖。5.2 防范SIPDOS攻擊當(dāng)freeswitch的日志中連續(xù)大量出現(xiàn)相同號(hào)碼的日志信息時(shí)，說明已被DOS攻擊:±roiD.i.E：109fromip103ironiid109irone,ip103163-63■:弓2165.63?二4=163±roiD.i.E：109fromip103ironiid109irone,ip103163-63■:弓2165.63?二4=163曲?16^.63-142SIE auth. challenge (REGISTER) cn pro■丄總 1xr.terr.a.111 ±oz [q>7ert^123010?2?E2?G[5IE auth challerg^ (REGISTER) cn szzic profile 1ir.t"=二匚a.1p foi ■qr^erty22S@L0?2?dEL弓]■ 5IE autA challenge (REGISTER) cn 弓二二九且 protzle ■zlexeztc注1■ roz [qx皂蘭匸空二匸3也二口在這種情況下，需要在fail2ban中增加新的規(guī)則，以避免該攻擊:5?2?1增加規(guī)則匹配文件#vi/etc/fail2ban/filter.d/freeswitch-dos.conf在/etc/fail2ban/filter.d下新建freeswitch-dos.conf文件，內(nèi)容如下:Fail2Banconfigurationfile#Author:soapee01#[Definition]#Option:failregex#Notes.:regextomatchthepasswordfailuresmessagesinthelogfile.The#can##hostmustbematchedbyagroupnamed"host".Thetag"<HOST>"beusedforstandardIP/hostnamematchingandisonlyanaliasfor(?:::f{4,6}:)?(?Pvhost>[\w\」」+)Values:#TEXTfailregex