forked from norman/fusionpbx-install.sh-github-mirror
9f550a3c42
* devuan: pull fail2ban updates from debian installer * devuan: merge updates to postgresql.sh from debian * devuan: pull updated resources/backup scripts from debian * devuan: merge and update php installer scripts * devuan: merged changes to reset_admin_password.sh from debian * devuan: fix release name typo for chimaera * devuan: merge iptables changes from debian * devuan: merge nginx changes from debian * devuan: merge letsencrypt.sh from debian * devuan: merge main install scripts and config from debian * devuan: simplify sngrep install, its in all maintained releases * devuan: merge main install script updates from debian * devuan: finish.sh: use /usr/sbin/service for restart * devuan: postgresql.sh: fix syntax error * devuan: update and unify sysvinit setup there is no sysvinit package available from freeswitch, usethe same init and defaults file for package and source install * devuan: add equvalent debian releasesto environment.sh * devuan: merge changes to switch* from debian * devuan: switch: use os_codenam_debian to add repos * devuan: olny stop ufw if it was installed * devuan: update config.sh defaults * devuan: remove systemd-specifics from switch package installation * devuan: install postgres before freeswitch * devuan: removed libyuv-dev installation, embedded in freeswitch * devuan: fix failing move of freeswitch music * devuan: removed another libyuv-dev installation, embedded in freeswitch * devuan: revert freeswitch script dir setting in /etc/default * devuan: Enable mod_av for the install. (#389) * devuan: merge improved nginx ssl settings (#388)
144 lines
3.6 KiB
Plaintext
Executable File
144 lines
3.6 KiB
Plaintext
Executable File
[ssh]
|
|
enabled = true
|
|
port = 22
|
|
protocol = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
action = iptables-allports[name=sshd, protocol=all]
|
|
maxretry = 6
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[freeswitch]
|
|
enabled = true
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = freeswitch
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=freeswitch, protocol=all]
|
|
maxretry = 10
|
|
findtime = 60
|
|
bantime = 3600
|
|
# sendmail-whois[name=FreeSwitch, dest=root, sender=fail2ban@example.org] #no smtp server installed
|
|
|
|
[freeswitch-acl]
|
|
enabled = true
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = freeswitch-acl
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=freeswitch-acl, protocol=all]
|
|
maxretry = 900
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[freeswitch-ip]
|
|
enabled = false
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = freeswitch-ip
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=freeswitch-ip, protocol=all]
|
|
maxretry = 1
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[auth-challenge-ip]
|
|
enabled = false
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = auth-challenge-ip
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=auth-challenge-ip, protocol=all]
|
|
maxretry = 1
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[sip-auth-challenge]
|
|
enabled = false
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = sip-auth-challenge
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=sip-auth-challenge, protocol=all]
|
|
maxretry = 100
|
|
findtime = 60
|
|
bantime = 7200
|
|
|
|
[sip-auth-failure]
|
|
enabled = true
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = sip-auth-failure
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=sip-auth-failure, protocol=all]
|
|
maxretry = 6
|
|
findtime = 60
|
|
bantime = 7200
|
|
|
|
[fusionpbx-404]
|
|
enabled = false
|
|
port = 5060:5091
|
|
protocol = all
|
|
filter = fusionpbx-404
|
|
logpath = /var/log/freeswitch/freeswitch.log
|
|
#logpath = /usr/local/freeswitch/log/freeswitch.log
|
|
action = iptables-allports[name=fusionpbx-404, protocol=all]
|
|
maxretry = 6
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[fusionpbx]
|
|
enabled = true
|
|
port = 80,443
|
|
protocol = tcp
|
|
filter = fusionpbx
|
|
logpath = /var/log/auth.log
|
|
action = iptables-allports[name=fusionpbx, protocol=all]
|
|
# sendmail-whois[name=fusionpbx, dest=root, sender=fail2ban@example.org] #no smtp server installed
|
|
maxretry = 20
|
|
findtime = 60
|
|
bantime = 3600
|
|
|
|
[fusionpbx-mac]
|
|
enabled = true
|
|
port = 80,443
|
|
protocol = tcp
|
|
filter = fusionpbx-mac
|
|
logpath = /var/log/syslog
|
|
action = iptables-allports[name=fusionpbx-mac, protocol=all]
|
|
# sendmail-whois[name=fusionpbx-mac, dest=root, sender=fail2ban@example.org] #no smtp server installed
|
|
maxretry = 10
|
|
findtime = 60
|
|
bantime = 86400
|
|
|
|
[nginx-404]
|
|
enabled = true
|
|
port = 80,443
|
|
protocol = tcp
|
|
filter = nginx-404
|
|
logpath = /var/log/nginx/access*.log
|
|
action = iptables-allports[name=nginx-404, protocol=all]
|
|
bantime = 3600
|
|
findtime = 60
|
|
maxretry = 300
|
|
|
|
[nginx-dos]
|
|
# Based on apache-badbots but a simple IP check (any IP requesting more than
|
|
# 300 pages in 60 seconds, or 5p/s average, is suspicious)
|
|
enabled = true
|
|
port = 80,443
|
|
protocol = tcp
|
|
filter = nginx-dos
|
|
logpath = /var/log/nginx/access*.log
|
|
action = iptables-allports[name=nginx-dos, protocol=all]
|
|
findtime = 60
|
|
bantime = 86400
|
|
maxretry = 800
|