Asterisk 11: Detect device auth failures

Sebastian Arcus to fail2ban-users:

Just some more log variations I noticed today slipping through the cracks unnoticed by current asterisk.conf filter from git. Asterisk version is 11.4.0. Here are the lines from the log:

[2013-07-25 07:26:43] NOTICE[26015][C-000006b2] chan_sip.c: Failed to authenticate device 101<sip:101@92.28.85.72>;tag=65d997a4

<snip>

Running tests
=============

Use regex line : Failed to authenticate (user|device) [^@]+@<HOST>\S*$
Use single line: [2013-07-25 07:26:43] NOTICE[26015][C-000006b2] ch...


Results
=======

Failregex: 1 total
|- #) [# of hits] regular expression
|  1) [1] Failed to authenticate (user|device) [^@]+@<HOST>\S*$
`-

Ignoreregex: 0 total

Summary
=======

Addresses found:
[1]
    92.28.85.72 (Thu Jul 25 07:26:43 2013)

Date template hits:
2 hit(s): Year-Month-Day Hour:Minute:Second

Success, the total number of match is 1