fail2ban/fail2ban — pull request #305 by Jamyn (2013-07-25 12:45:25+00:00)
Title: fail2ban-users: Sebastian Arcus - Detect device auth failures on Asteris...

Sebastian Arcus to fail2ban-users:

Just some more log variations I noticed today slipping through the cracks unnoticed by current asterisk.conf filter from git. Asterisk version is 11.4.0. Here are the lines from the log:

[2013-07-25 07:26:43] NOTICE[26015][C-000006b2] chan_sip.c: Failed to authenticate device 101;tag=65d997a4

Running tests
=============

Use regex line : Failed to authenticate (user|device) [^@]+@\S*$
Use single line: [2013-07-25 07:26:43] NOTICE[26015][C-000006b2] ch...

Results
=======

Failregex: 1 total
|- #) [# of hits] regular expression
| 1) [1] Failed to authenticate (user|device) [^@]+@\S*$
`-

Ignoreregex: 0 total

Summary
=======

Addresses found:
[1]
92.28.85.72 (Thu Jul 25 07:26:43 2013)

Date template hits:
2 hit(s): Year-Month-Day Hour:Minute:Second

Success, the total number of match is 1