FOP2 logs

sbasan

Hi,

I want to add the fop2 login attempts to fail2ban.
There are no logs for login attempts under httpd log.
How can I add the login attempts or login failures to fail2ban?

זה בלובינט IP מרכזיות

nicolas

Enable the audit log with the -a command line variable. Edit /etc/sysconfig/fop2 and change the OPTIONS variable to include it, something similar to this:

OPTIONS="-d -a /var/log/fop2_audit.log"

Then you can add that log to fail2ban rules.

Best regards,

avayax

Also trying to accomplish that.
I got this in /etc/sysconfig/fop2:
OPTIONS="-d -a /var/log/fop2_audit.log"

Created fop2_audit.log in /var/log/.
Now nothing gets written into fop2_audit.log, the file stays empty.
What am I missing?

nicolas

Do not create the file, it should be created by fop2.. if you create the file you might do it with incorrect permissions, so it is better to let the software do it for you. Also, are you sure you restarted FOP2? what is the output from

ps uax | grep fop2

?

avayax

Yes. It is working now after a fop2 restart.
Can you verify that this entry in /etc/sysconfig is correct?
Running High Availability and my Ethernet interface is em1.
OPTIONS="-d -i em1 -c /etc/asterisk/fop2 -a /var/log/fop2_audit.log"

nicolas

Seems correct, rough human translation:

daemonize, use interface em1 MAC address for license, use /etc/asterisk/fop2 for configuration directories and generate an audit log in /var/log/fop2_audit.log

avayax

This is working.
Just posting the working config I used for other users who want to do the same. This is for PIAF and FreePBX distro, which come with a preconfigured fail2ban setup.

Create a fop2.conf file in /etc/fail2ban/filter.d/ and put the following content in there:
[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = fop2_server

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = GENERAL\|FAILED LOGIN \(bad password\)\|<HOST>

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =


Then add below content to /etc/fail2ban/jail.conf:
[fop2]
enabled = true
filter = fop2
action = iptables-allports[name=FOP2, protocol=all]
sendmail[name=FOP2, dest="your destination email", sender=root@"hostname"]
logpath = /var/log/fop2_audit.log
bantime = 1800
findtime = 600
maxretry = 8
backend = auto

Adjust the bantime, etc. settings and change the action if you want to block custom ports and not all.
A failed login attempt in /var/log/fop2_audit.log looks like this:

1447099540|8800|GENERAL|FAILED LOGIN (bad password)|192.168.1.254:49379
1447099545|8800|GENERAL|FAILED LOGIN (bad password)|192.168.1.254:49396

Good luck!

nicolas

Thanks for sharing your fail2ban config!

avayax

Adding a slight correction here.
Put that into /etc/fail2ban/filter.d/fop2.conf:
failregex = GENERAL\|FAILED LOGIN \(bad password\)\|<HOST>:\d+
GENERAL\|FAILED LOGIN \(non existant user\)\|<HOST>:\d+

Also don't forget to do service fail2ban restart. Do fail2ban-client status to see if your jail got added.