- Shipped
- 26 أغسطس 2026 في 10:55 م UTC
- صاحب البلاغ
- Kamo
- Commit
- 4aaa7f4
fail2ban has never started on this PBX. Its asterisk-security jail watches /var/log/asterisk/security, a file Asterisk never created: FreePBX generates logger_logfiles_additional.conf with only `console` and `full`, so the security channel was never declared. fail2ban aborted config with "Have not found any log file for asterisk-security jail" and exited 255 on every boot, silently, leaving 5060/UDP unprotected while scanners ran ~35k failed REGISTERs a day. - startup.sh writes `security => security` to logger_logfiles_custom.conf (the FreePBX-sanctioned override that is #included and never regenerated). - fail2ban now starts AFTER the Asterisk socket is up instead of racing it, and the logpath is pre-created so a cold node cannot lose the race. - Add a logrotate stanza for the new channel; the stock asterisk one names only `full` and `messages.log`, and this box logs scanner failures by the thousand. - Rename the jail's iptables chain to f2b-asterisk-security. The image ships its own [asterisk] jail owning f2b-asterisk; sharing a chain appends duplicate REJECT rules and unbanning removes only one, so an address stays blocked while fail2ban reports it free. - Add ignoreip for the pod/service CIDRs. Browser softphones reach Asterisk over WSS through Traefik and appear as 10.42.0.1, so one ban there would drop every softphone in the company at once. - Delete the duplicate fail2ban-configmap.yaml: same ConfigMap name, so `kubectl apply -f freepbx/` would overwrite the working config with one whose freepbx-web jail points apache-auth at FreePBX's PHP form login. - Apply the ConfigMap from CI; the deployment mounts it but nothing applied it. Verified live: filter matched 42/42 attack events with zero false positives (fail2ban-regex), both jails now hold separate chains, 9 scanner IPs banned within minutes, incremental ban escalation confirmed, and no private address was touched.