IPTABLES does not save
Submitted by 3vian on Mon, 09/29/2008 - 6:33pm.
I need to secure my trixbox, so I wanted to use iptables to do this, but all my rules get wiped every 5 minutes. I guess this is a security feature to prevent you from accidently being locked out. How do I prevent the automatic flushing of my rules? I tried service iptables save and iptables-save, but it doesn't help. I can't seem to figure it out myself and I've search the web for last day without much success. This is urgent as I'm getting thousands of register request per second. Thanks in advance for the help.
3vian
 
I just do mine from in
Mon, 09/29/2008 - 8:07pm
I just do mine from in Webmin, after editing the iptables file or copying a new one accross I simply hit the 'apply configuration' button under linux firewall, does this not work for you ?
 
I usually put my iptables
Mon, 09/29/2008 - 8:27pm
I usually put my iptables rules at /etc/sysconfig/iptables then issue the command service iptables start, I also keep a backup of it on a separate file just in case and as a template for any new systems.
 
When I run iptables-save or
Mon, 09/29/2008 - 8:31pm
When I run iptables-save or service iptables save it is saved to /etc/sysconfig/iptables, but it is rewritten every few minutes. I can't understand it. In terms of Webmin, I would rather like to avoid running it.
 
Cannot find Webmin
Tue, 09/30/2008 - 5:14pm
I still cannot get it to save my rules, so I tried to install Webmin, but I don't see it under Packages and yum cannot find it. Anyone with a suggestion? We can I find the script that might be rewritting it every few minutes? I thought it would be in crontabs, but I don't see it.
Thanks again.
 
you can download the rpm
Tue, 09/30/2008 - 5:58pm
you can download the rpm from the Webmin site and then install it with rpm -i webmin-arch.rpm
 
Put the box behind a
Tue, 09/30/2008 - 8:06pm
Put the box behind a firewall and limit it to only the IP's that should be getting to it. Let some other box do the security and take the load off the PBX.
 
What makes you think it
Wed, 10/01/2008 - 12:15am
What makes you think it isn't behind a firewall.
Lets assume it is and 3vian has a need to have ports open for SIP, IAX or MGCP, lets further assume he has a remote user or device that comes from varying IPs, how is it suggested he protects himself from 'thousands of register request per second' do we all have to 'buy a Cisco and slap a Smartnet on it' is it so unreasonable that some of us wish to use open source methods to protect ourselves.
IPtables and fail2ban are a easy (if you can get it working :p) way to solve this growing problem, why the resistance, it seems like such a good solution for a large percentage of users, I don't get why theres so little interest, the time to act is now not after thousands have suffered.
 
Why have two firewalls
Wed, 10/01/2008 - 8:30am
Why have two firewalls running then? If you have a good firewall in front of the system then you dont need another one on the PBX. You say its easy (if you can get it working) and a lot of people are really struggling with it and we are certainly not experts on it. Any basic firewall is going to be able to block the IP that those requests are coming from and only allow the actual allowed IPs to come through. There are also other solutions like VPN's so that you never have to expose the system to the open internet. For people with softphones, simply use Hamachi and your problems are basically solved. For hardphones you would need a point to point VPN.
If thousands of people are suffering with this why are there only a few that are posting about it? Can we assume that they know how to use a firewall and VPN solutions? No other distro that I know of has firewall setup tools in it because it should a) not be an edge device and b) there are much better firewall tools than IPtables and fail2ban that can be put it front of it.
There is nothing stopping anyone from creating a trixbox ce module that does what you want if its that simple. If someone did that I would certainly consider adding it to the repo for people who want it.
 
I just took another look at
Wed, 10/01/2008 - 8:47am
I just took another look at fail2ban and I fail to see how this solves the registration problem. It will looks at apache, ftp, and ssh logs which is completely useless if the system is behind a firewall of any kind with those ports disabled. I do not see how this solves the registration issue unless I am missing something in what it can do.
 
To 3vian.
I had the same
Wed, 10/01/2008 - 9:50am
To 3vian.
I had the same issues, the OS of trixbox is not hardened to be a that of a firewall so although IP tables do help they may not help you sleep easier at night.
Also, especially if you are running a dynamic environment it is very hard to pinpoint exact IP address incomming changes.
So instead of fiddling with IP tables on a soft OS I downloaded and installed a Linux based firewall and only opened UDP 5060 SIP inbound.
I had a bit of difficulty trying to find a few good firewalls out there that understood SIP but I eventually found one.
I am in no way trying to advertise direct or indirect for any paticular company or product but I found Endian worked the charm.
Hope this helps.
 
Kerry,
You hit the nail on
Wed, 10/01/2008 - 9:52am
Kerry,
You hit the nail on the head. Fail2ban does not solve the sip registration issue.
The problem is folks want to enable remote connections but they don't want to do the work (securing it properly). Forget the other open source projects, what commercial or enterprise PBX allows for connections to the Internet without a firewall or Proxy?
If you have a SIP connection to a provider you should only have the IP addresses allowed for their servers. If you are allowing anonymous SIP you need a Session Border Controller, which performs the admission control function. If you look at the SIP protocol admission control is not a peer function.
The entire idea of exposing the management interface to the web is so ludicrous it does not deserve the discussion it gets. With Hamachi as a 5 minute job to setup with the provided scripts there is no excuse for not protecting access to the management interface.
Any time I mention applying Enterprise security practices all I get is grief and excuses so I have stopped.
--
Scott
aka "Skyking"
 
Off topic
Wed, 10/01/2008 - 11:41am
I think we are getting a little off-topic. I figured out my problem, it was to do with APF and BFD flushing iptables, so I removed them and their cron jobs. I would normally have a IPSec VPN hardware router in front of my trixbox server, but this a VPS and the virtualization software does not currently support IPSec yet. I'm considering getting rid of the VPS and going back to an on-site hardware solution because of these security issues.
A VPN solution also removes any NAT issues, which I'm currently having with my Cisco 7970s and 60s. I think my solution will be to build a low-power hardware solution and put it behind my hardware VPN. I already have hardware VPNs for each of my 4 remote locations so this should work well.
 
Kerry I didn't say thousands
Wed, 10/01/2008 - 8:13pm
Kerry I didn't say thousands are suffering from it, my reference was either to the statement in the OP that he was suffering from thousands of attempts a second, or to the likelihood that this problem will grow until thousands do suffer. To my knowledge there has been 3 threads in the last 3 days, maybe 7 or 8 in the last month, this isn't something that will just go away, it will get worse. Who knows how many are being or have been attacked while blissfully unaware.
fail2ban works fairly simply, it looks through various logs looking for failed attempts, sure it comes with templates for apache, ftp, and ssh amongst others, you need to edit a few files telling it to look in /var/log/asterisk/full for Wrong password|Username/auth name mismatch or whatever comes up after a failed login.
Remember a lot of Trixbox installs are ending up in SOHO environments, not in fortune 500 companies, sure you can talk about the ideal setup but I'm talking about reality here. Whats right doesn't always fit well into the plans of a 4 person business. I'm simply saying why not offer some protection to these people, often the ones with the least knowledge, the ones who have no place for and no idea how to set up session border controls or whatever.
Don't take such a narrow view, plenty allow anonymous SIP for Enum amongst other reasons, some have a need or desire for remote access without using a VPN, some just don't have a firewall that gives them the flexibility you would choose. Instead of telling people they need to buy a Cisco, they need to change providers, they can't use their wifi enabled mobiles etc. why not let them have a little freedom but also a little safety and hey its free too.
(dont be distracted by IPtables I couldn't really care less about it, fail2ban looking for SIP logins is what makes sense to me.)
Sorry 3vian.
 
Everyone seems to forget
Wed, 10/01/2008 - 8:50pm
Everyone seems to forget that this is a community project. If this is so feature is so important than why doesn't someone get it to work and contribute the configuration? I am sure that Fonality would be glad to include it in the distribution.
I take a simple view, the logo on top of the page says "The Open Platform for Business Telephone" (emphasis added). It is assumed businesses know how to secure application servers.
For me it's that basic.
So far none of of the professional integrators have had a problem with compromised systems. I don't look to other people to solve my problems for me. There is an entire kit of tools at your disposal, not using them is a choice of the user and they suffer the consequences.
Harsh, probably.....
--
Scott
aka "Skyking"
 
As soon as I get it working
Wed, 10/01/2008 - 11:08pm
As soon as I get it working I will share it, its not for the want of trying I can assure you.
I did make a thread the other day
http://64.233.183.104/search?q=cache:hytDcwdwTTAJ:www.trixbox.org...
but pulled it when I realised it was wrong and I was unlikely to get any help, so don't accuse me of not trying.
 
hacked
Thu, 10/02/2008 - 2:36am
Scott,
--------->>>So far none of of the professional integrators have had a problem with compromised systems
Um..well I spent three days last week setting up new boxes from bare metal from one such "professional integrator" he has over 30 customers
we found three of his boxes where "hacked", it was easy as he had given "public" access to FOP so half the battle was lost before he got out of the gate.
He was sure it was a flaw in trixbox, until I showed him how easy it is to "guess" his pin numbers for the extens in FOP, it took maybe 10 mins to get into freepbx.
This is someone who KNEW better, if his boxes where windows he would have been more careful, but he had that mindset "Hey it is linux, no one can hack it".
In his 10 years in telco biz he said no one hacked any of his PBX / KSU boxes and he never expected it to happen.
I installed Hamachi on all his builds now and he is talking to his customer base about how they select passwords / pin numbers
He got a VERY expensive lesson in common sense, he not only had to pay me a ton of money to work 20 hrs a day but he still has not gotten the total mins used together (over 50,000 on two boxes, some to the gulf area... OUCH...)
He is afraid that if he tells the FEDS he will get popped for non-calea compat. and the news hits the street and all his customers will be hollering for his head.
just a little hint for all you out there swapping 1's for I and 3 for E's for a common word / phase IS NOT a secure password, and using your exten even if it is backwards, well you guessed it...it is just DUMB....
 
I don't know fail2ban but it
Thu, 10/02/2008 - 6:35am
I don't know fail2ban but it would probably help if someone posted a rule for sip registrations. Here is what happens in the /var/log/asterisk/full file when a bad password is attempted:
[Oct 2 06:33:22] NOTICE[2607] chan_sip.c: Registration from '
 
fail2ban
Thu, 10/02/2008 - 8:23am
From the sound of it, fail2ban would seem like a very useful tool. I'm personally going to look into it, but I don't think I have the skills necessary to help the community with integration.
I currently have my SIP port open because of remote phones and to allow anonymous calls via ENUM and because my DID simply forwards the calls to a specified SIP address.
 
Bubba -
Interesting
Thu, 10/02/2008 - 8:24am
Bubba -
Interesting statement, however you said yourself he was not following best practices.
The bottom line is you showed him how simple it is to keep a 'culture' of security in a small shop.
Sounds like everyone won in this case.
--
Scott
aka "Skyking"
 
security
Thu, 10/02/2008 - 8:50am
I just got off the line with his "network admin" which some guy who built his computers; turns out that EVERY box (windos and Linux) in his office network is also infected in some way.
he has been fighting the email SPAM blacklisting for the past few weeks..his email server was sending out over 20,000 email messages each day, (small 20 person office) his windows boxes all have movie files on them, we assume they are out there for downloading.
His bandwidth bill was way over his limit last month, first time in three years...many things which should have had them looking at the logs, but instead they just pushed it aside. LAZY network admin comes to mind....
So his question is did they come in via Windos or did they come in via linux???? Did it spread via his office network to the DC or from DC to his office network.
As someone in the office has used the windows server to surf the web and had installed VNC with a VERY weak password without a RCkey it will hard to track down the entry point (s) it could very well be one of the warez downloads started the whole mess
Anyone want over 60 gigs of movies??? he has the "Hunk" and "Ironman" rips....
I am joking here folks..I have already deleted the files
And Scott I know I made out on this one for $ure...got another good 20 ~25 hrs of billable time coming and it will be easy money...
;~)
He will be adding $ 50,000.00 grand to his IT budget to hire a REAL network admin.
You can never really be secure, you can have that feeling of being secure, but if you can get out, someone can get in.
You must lock every door and check it each day to make sure it is still locked.
 
What a stroke of luck,
Thu, 10/02/2008 - 8:57am
What a stroke of luck, someones put details up
http://voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
 
That is useful for those who
Thu, 10/02/2008 - 9:24am
That is useful for those who have to open SIP up to the Internet. Not as cool using OpenSBC the correct RFC compliant method for doing session control.
--
Scott
aka "Skyking"
 
Success
Thu, 10/02/2008 - 11:02pm
Quote:
Hi,
The IP 192.168.1.22 has just been banned by Fail2Ban after
5 attempts against ASTERISK.
But for some reason the instructions to edit the time stamp don't work, I had to move the monitored log to /var/log/messages which does work but it has a nasty habbit of saying
Oct 3 06:44:06 local asterisk[2217]: NOTICE .....failed for '192.168.1.22' - Wrong password
Oct 3 06:44:41 local last message repeated 3 times
Oct 3 06:45:59 local last message repeated 3 times
anyone else tried it ?
 
BFD Rule
Thu, 10/02/2008 - 4:46pm
I created a rule that seems to work with BFD/APF. This goes into /usr/local/bfd/rules I called mine asterisk. Be sure to set the TRIG value to something you are comfortable with. Please let me know if there is something other than Wrong password I should capture and I can write more rules. The reason I use APF/BFD over faile2ban is that the APF portion is a pretty good firewall that can do amazing things, add in BFD and you got something that anyone can setup in minutes. For those that do not want to learn iptables, then APF is cake. Again, YMMV.
# failed logins from a single address before ban
# uncomment to override conf.bfd trig value
TRIG="1"
# file must exist for rule to be active
REQ="/usr/sbin/asterisk"
if [ -f "$REQ" ]; then
LP="/var/log/asterisk/full"
TLOG_TF="asterisk"
TMP="/usr/local/bfd/tmp"
## ASTERISK
ARG_VAL=`$TLOG_PATH $LP $TLOG_TF |grep "Wrong password" /var/log/asterisk/full | awk '{NF=NF-3} { print $NF}'| tr -d '\'\' `
fi
Thank you,
Engineer Tim
Trixbox Engineer
http://engineertim.com
 
This is driving me crazy
Wed, 10/08/2008 - 6:08am
This is driving me crazy
var/log/asterisk/full has a date stamp like this [Oct 8 04:46:28] whether I add dateformat=%F %T to logger.conf or not and fail2ban wont read it.
It does read var/log/messages ok though which has the timestamp Oct 8 04:27:46
Does this make sense to anyone
----
We must change how Asterisk does its time stamp for logging. The default format does not work with Fail2Ban because the pattern Fail2Ban uses that would match this format has a beginning of line character (^), and Asterisk puts its date/time inside of []. However the other formats that Fail2Ban supports do not have this character and can be used with Asterisk
To change this format open /etc/asterisk/logger.conf and add the following line under [default] section (You may have to create this before the [logfiles] section). This causes the date and time to be formatted as Year-Month-Day Hour:Minute:Second, [2008-10-01 13:40:04] is an example.
[default]
dateformat=%F %T
---
its not clear to me what he is saying with all this (^), I see my timestamp is nothing like his example, but it reads ok from one log just not the other, is everyones timestamp like mine ?
Did anyone get this working ?
 
Yes, got it to work
Sat, 10/11/2008 - 1:32pm
Yes, got it to work 100%
here is sendmail confirmation and my softphones timeout on registration for the appointed ban period in staging environment.
Lets hope Fonality don't remove python iptables :-) from repository.
"Hi,
The IP 192.168.0.12 has just been banned by Fail2Ban after
3 attempts against ASTERISK.
Here are more information about 192.168.0.12:
Regards,
Fail2Ban"
Read this links carefully and slowly and apply it!
http://voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
 
Ive read that guide until
Wed, 10/15/2008 - 4:32pm
Ive read that guide until its ingrained on my memory, it just doesn't work for me in the 'full' log.
 
If anyone uses IAX they
Wed, 10/15/2008 - 11:41pm
If anyone uses IAX they might want to add this
NOTICE.* .*: Host
to the failedregex.
 
Member Since:
2006-06-30