Bug 1047363 - fail2ban [asterisk] jail doesn't create both tcp and udp iptables rules
Summary: fail2ban [asterisk] jail doesn't create both tcp and udp iptables rules
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: fail2ban
Version: el6
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Orion Poplawski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-30 16:56 UTC by Greg Bailey
Modified: 2016-03-09 21:40 UTC (History)
3 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2016-03-09 21:40:41 UTC


Attachments (Terms of Use)

Description Greg Bailey 2013-12-30 16:56:57 UTC
Description of problem:

I run asterisk 1.8.20.0 on a CentOS 6.5 system with the EPEL repository.  After upgrading to fail2ban-0.8.11-2.el6, I enabled the following jail in /etc/fail2ban/jail.local as suggested by comments in the /etc/fail2ban/jail.conf file:

# cat jail.local 
[asterisk]
enabled = true

After restarting fail2ban, I see the chain "fail2ban-asterisk-udp" created, but not the expected "fail2ban-asterisk-tcp" chain.  There is the expected rule added in the INPUT chain to direct UDP packets on ports 5060 and 5061 to the newly created "fail2ban-asterisk-udp" chain, but again, no corresponding INPUT chain rule to redirect TCP packets on ports 5060 and 5061 to the missing "fail2ban-asterisk-tcp" chain.

Version-Release number of selected component (if applicable):

fail2ban-0.8.11-2.el6

How reproducible:

Always

Steps to Reproduce:
1.  Add [asterisk] jail to /etc/fail2ban/jail.local
2.  Restart fail2ban
3.  Observe via iptables -L that no chain was created to catch TCP connections

Actual results:

No filtering of TCP connections to ports 5060,5061 to fail2ban chains

Expected results:

Either the INPUT rule would pass both TCP *and* UDP traffic on ports 5060,5061 to one fail2ban created chain, or separate TCP and UDP chains and rules would be created.

Additional info:

iptables -L output:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-asterisk-udp  udp  --  anywhere             anywhere            multiport dports sip,sip-tls 
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:sip 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:sip 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-asterisk-udp (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere

Comment 1 Fedora Update System 2014-07-21 23:07:24 UTC
fail2ban-0.8.13-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/fail2ban-0.8.13-1.el6

Comment 2 Fedora Update System 2014-07-22 18:09:39 UTC
Package fail2ban-0.8.13-1.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-1.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-1.el6
then log in and leave karma (feedback).

Comment 3 Greg Bailey 2014-07-27 13:24:32 UTC
After upgrading to fail2ban-0.8.13-1.el6.noarch from the epel-testing repo, I still see the same behavior as described in the original report.

If I just define [asterisk] in jail.local, only the "fail2ban-asterisk-udp" chain is created, and not the additional expected "fail2ban-asterisk-tcp" chain.

Comment 4 Fedora Update System 2014-07-30 19:34:55 UTC
Package fail2ban-0.8.13-2.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing fail2ban-0.8.13-2.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-1985/fail2ban-0.8.13-2.el6
then log in and leave karma (feedback).

Comment 5 Greg Bailey 2014-09-03 00:36:20 UTC
Upstream issue filed at:
https://github.com/fail2ban/fail2ban/issues/798

Comment 6 Orion Poplawski 2015-04-07 22:03:34 UTC
See https://copr.fedoraproject.org/coprs/orion/fail2ban-el6/ if you'd like to test out 0.9.1.


Note You need to log in before you can comment on or make changes to this bug.