Fail2ban: unknow sip login not banned (asterisk)

[stephdl]

Steps to reproduce

run an asterisk server
some attempt to unknow sip login are not banned

Rejecting unknown SIP connection from 158.69.55.234:52420

Expected behavior

I expect that the attempts are banned

Actual behavior

the attempts are not banned because fail2ban regex doesn't expect a port number ends the line in logs

Components

nethserver-fail2ban-1.1.7-1.ns7.noarch

See also

https://community.nethserver.org/t/fail2ban-again-not-catching-some-asterisk-log-strings/13411/1

---

thank @matthieu

[nethbot]

in 7.7.1908/testing:

• nethserver-fail2ban-1.1.10-1.6.g7771945.ns7.noarch.rpm x86_64 armhfp aarch64

[stephdl]

QA

• install nethserver-fail2ban from testing
• after update check fail2ban is running
• verify the regex is well catching your log

fail2ban-regex /var/log/asterisk/full /etc/fail2ban/filter.d/asterisk_nethserver.conf --print-all-matched

the failed attempt must be listed by fail2ban-regex : Rejecting unknown SIP connection from 158.69.55.234:52420

[pagaille]

Tested and ok, thanks

[nethbot]

in 7.7.1908/updates:

• nethserver-fail2ban-1.2.0-1.ns7.noarch.rpm x86_64 armhfp aarch64