sinologicnet/sipcheckMonitora logs de autenticação do Asterisk e bane automaticamente IPs com repetidas tentativas de login falhadas usando iptables, com limites configuráveis e lista negra persistente.
SIPCheck é uma ferramenta que monitora a autenticação de usuários do Asterisk e bane automaticamente se algum usuário (ou bot) tentar registrar ou fazer chamadas usando senhas erradas.
Ao contrário do Fail2Ban, o SIPCheck gerencia não apenas o atacante, mas também os clientes em que você confia, então se você possui usuários SIP que demonstraram ser confiáveis, ele não os banirá, mesmo que receba senhas erradas, porque isso significaria que muitos clientes SIP atrás desse IP também poderiam ser banidos.
Por esse motivo, redesenhamos esta aplicação do zero com vários recursos em relação às versões anteriores.
sipcheck.conf, você pode controlar o número de tentativas antes de banir o acesso, o tempo que os atacantes ficarão no firewall e o tempo que os usuários suspeitos ficarão sob vigilância.O SIPCheck requer ser executado no mesmo sistema onde o Asterisk roda. (pode rodar em outro sistema, mas o firewall será usado no mesmo sistema onde ele roda). O SIPCheck precisa de privilégios de root para poder inserir e remover regras no firewall.
O SIPCheck 3 funciona usando Python 3 e as bibliotecas definidas em requirements.txt
/etc/asterisk/manager.conf deve ter algum usuário de gerenciamento como este (altere as variáveis de usuário e senha):
Você deve criar um novo usuário da Interface de Gerenciamento do Asterisk.
[CHANGETHISUSER]
secret = CHANGETHISPASSWORD
deny = 0.0.0.0/0.0.0.0
permit = 127.0.0.1/255.255.255.255
read = security
write = system
Uma vez criado/modificado este usuário, você precisa recarregar a configuração do gerenciador:
asterisk -rx 'manager reload'
# Download do repositório github
git clone https://github.com/sinologicnet/sipcheck.git /opt/sipcheck
cd /opt/sipcheck
# Atualizar repositórios
apt-get update
# Instalar PIP para Python3
apt-get install python3-pip
# Instalar as bibliotecas necessárias
pip3 install -r requirements.txt
# Copiar o exemplo de arquivo de configuração para o arquivo de configuração oficial
cp sipcheck.conf.sample sipcheck.conf
# Editar este arquivo para configurar o SIPCheck
nano sipcheck.conf
# Tornar o sipcheck.py executável
chmod 777 sipcheck.py
# Inserir o script no systemd
cp /opt/sipcheck/sipcheck.service /etc/systemd/system/
systemctl enable sipcheck
# Iniciar a aplicação
systemctl start sipcheck
# Verificar se tudo está funcionando corretamente
tail -f /var/log/sipcheck.log
2020-03-14 19:25:51,309 INFO: -----------------------------------------------------
2020-03-14 19:25:51,309 INFO: Starting SIPCheck 3 ...
2020-03-14 19:25:51,309 INFO: + Added 185.53.88.49,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,309 INFO: BL: Detected attack from IP: '185.53.88.49' (Banning address)
2020-03-14 19:25:51,312 INFO: + Added 195.154.28.205,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,312 INFO: BL: Detected attack from IP: '195.154.28.205' (Banning address)
2020-03-14 19:25:51,313 INFO: + Added 92.246.85.154,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,313 INFO: BL: Detected attack from IP: '92.246.85.154' (Banning address)
2020-03-14 19:25:51,315 INFO: + Added 113.141.67.163,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,315 INFO: BL: Detected attack from IP: '113.141.67.163' (Banning address)
2020-03-14 19:25:51,317 INFO: + Added 192.227.132.19,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,317 INFO: BL: Detected attack from IP: '192.227.132.19' (Banning address)
2020-03-14 19:25:51,319 INFO: + Added 45.143.220.240,1584140431 into blacklist again from the time: 1584140431
2020-03-14 19:25:51,319 INFO: BL: Detected attack from IP: '45.143.220.240' (Banning address)
2020-03-14 19:25:51,321 INFO: + Added 45.143.221.59,1584200178 into blacklist again from the time: 1584200178
2020-03-14 19:25:51,321 INFO: BL: Detected attack from IP: '45.143.221.59' (Banning address)
2020-03-14 19:25:51,322 INFO: + Added 192.3.140.204,1584200178 into blacklist again from the time: 1584200178
2020-03-14 19:25:51,322 INFO: BL: Detected attack from IP: '192.3.140.204' (Banning address)
2020-03-14 19:25:51,324 INFO: + Added 185.221.135.138,1584200178 into blacklist again from the time: 1584200178
2020-03-14 19:25:51,324 INFO: BL: Detected attack from IP: '185.221.135.138' (Banning address)
2020-03-14 19:25:51,326 INFO: + Added 45.143.220.25,1584200178 into blacklist again from the time: 1584200178
2020-03-14 19:25:51,326 INFO: BL: Detected attack from IP: '45.143.220.25' (Banning address)
2020-03-14 19:25:51,331 INFO: + Added 10.10.10.10 into whitelist during one year
2020-03-14 19:25:51,332 INFO: + Added 10.10.12.12 into whitelist during one year
2020-03-14 19:25:51,341 INFO: protocol version: '5.0.0'
2020-03-14 19:25:51,342 INFO: Sending awaiting actions
2020-03-14 19:47:09,842 WARNING: Received anonymous INVITE from IP 91.212.38.210
2020-03-14 20:47:14,776 INFO: TL: Expired time for 91.212.38.210
2020-03-14 21:14:17,786 WARNING: Received wrong password for user Administrator from IP 45.234.152.38
2020-03-14 21:50:28,963 WARNING: Received wrong password for user administrator from IP 45.234.152.38
2020-03-14 22:07:02,806 WARNING: Received wrong password for user 10 from IP 45.234.152.38
2020-03-14 22:14:18,490 INFO: TL: Expired time for 45.234.152.38
2020-03-14 22:24:22,969 WARNING: Received anonymous INVITE from IP 45.143.220.220
2020-03-14 22:43:22,100 WARNING: Received wrong password for user 11 from IP 45.234.152.38
2020-03-14 23:19:42,874 WARNING: Received wrong password for user 100 from IP 45.234.152.38
2020-03-14 23:24:26,489 INFO: TL: Expired time for 45.143.220.220
2020-03-14 23:27:28,488 WARNING: Received anonymous INVITE from IP 45.143.220.214