<div dir="ltr"><div>Good day Rick.</div><div>I'm not totally sure I understand what you mean correctly, but,<br></div><div>I think that you might misunderstand the concept of producing logs in your scenario a bit.</div><div><br></div><div>First of all, the function 'www_challenge()' doesn't produce logs on its own, nor 'www_authorize()' does it.</div><div>Functions only can return the code (return code in terms of programming).</div><div><br></div><div>For e.g. 'www_challenge()' function returns -1 when it <span class="gmail-pl-c">tries to challenge a user (to let it send credentials using WWW-Authorize header) and <br></span></div><div><span class="gmail-pl-c">eventually fails to do that due to certain reasons (for e.g. <span class="gmail-pl-s"><span class="gmail-pl-pds"></span>failed to generate nonce, or failed to send out a 401 response etc.).</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Otherwise if everything is good, it returns 0 - which means everything is due to a plan,</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">401 challenge is sent out and we wait for a re-sending of REGISTER with credentials encrypted (using nonce, and a list of other parameters and md5 algorithm).</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">'www_authorize()' function in its turn has a list of return codes, which you can find here:<br><a href="https://opensips.org/html/docs/modules/3.1.x/auth_db.html#func_www_authorize">https://opensips.org/html/docs/modules/3.1.x/auth_db.html#func_www_authorize</a></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Basically you are interested in the fact, that a return code is not negative, otherwise something is wrong with an authentication and you should not let this user pass through.<br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">You use the '$rc' (in 2.4 branch was '$retcode') pseudo variable (which is pre-defined) in order to get the last returned code, of the last invoked function.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Here is an example of how dramatically simplified functionality could look like:</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">if (!www_authorize("", "subscriber")) {<br> switch ($rc) {<br> case -1:<br> xlog("L_NOTICE", "Authentication error for $si port:$sp, not found \n");<br> break;<br> case -2:<br> xlog("L_NOTICE", "Authentication error for $si port:$sp, wrong password given \n");<br> break;<br> }<br> www_challenge("", "0");<br> exit;<br>}</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Note please, this is just an example, which shows the basic concept how it works and shouldn't be copy-pasted into any production environment.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">I underline this - just an example which was not even tested, because I have written this on the go while answering you.<br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">So as you can see, the log rows are being produced with a help of xlog() function and not www_authorize()/www_challenge().</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">xlog() does it based on the previously returned code.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Further logic is only restricted with a creativity you can apply to it.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Please note also, that your logs will be produced to the log-file which is correlated with the log facility, which you set by 'log_facility=' parameter.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">For e.g. if you have previously configured (with rsyslog) that log facility 7 produces logs to opensips.log,</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">then you are ought to use it then in the opensips's preprocessor directive like that:</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">'log_facility=LOG_LOCAL7'</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Thus opensips will send logs to log facility 7, which in its turn directs logs to opensips.log. I hope it's clear for understanding.<br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">What relates to Fail2Ban and how it uses these logs then in order to ban someone.<br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">You need to firstly define a jail object for it (in jail.conf), which can look something like that (only an example):</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">[opensips]<br>enabled = true<br>filter = some_name_here<br>action = some_name_here[name=opensips, protocol=all]<br>logpath = /var/log/opensips.log<br>maxretry = 10<br>bantime = 9999999<br>findtime = 500</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">Then you need to let fail2ban know which regular expressions to use for that (syntax for f2b seems to be PCRE), regular expressions definitions are located in 'filter.d' directory.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">You need to place a new file here with some name defined (same as you pointed in the 'filter=' parameter of the jail.conf), you place the regex under the [Definition] section.</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">An example:</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">failregex = ^.*Auth error for '<HOST>'.*, .*$<br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">And also, do not forget to add an actions configuration in the 'action.d' folder, you add a new file here with some name</span></span></div><div><span class="gmail-pl-c"><span class="gmail-pl-s">(which correlates with name pointed in the 'action=' parameter of the jail.conf), try to surf the web to see how the actions configuration is usually configured.</span></span></div><div>Here you can play with that and configure it to act as you want.</div><div>This becomes even more powerful if you use some external functionality written in whatever language (for e.g. python).</div><div><br></div><div>What relates to your question:<br></div><div>>> And when I change the Code like the TO: section above OpenSIPS will not start because it says Error in Config File it cannot load opensips.</div><div><br></div><div>Read the log output in the syslog, or if you log into a different log file, then you use it - in order to see where the syntax error is.</div><div>Usually it's something relatively obvious.<br></div><div><br></div><div>Note however, this is just an example, and you should not copy-paste it into your production configurations.</div><div>I just show a basic concept of how it works. For more details read Wiki of the OpenSIPS project elaborately.</div><div><br></div><div>And no, there is no magic pill which will make everything in your setup working right away.</div><div>It's open-source, and people help here just because they want to facilitate each other.</div><div><br></div><div>Best regards.<br></div><div><div><span class="gmail-pl-c"><span class="gmail-pl-s"><br></span></span></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Feb 13, 2021 at 1:20 PM Rick McGill - ₪ <<a href="mailto:rick@netrovoip.com">rick@netrovoip.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Dear OpenSIPs Community,<br>
<br>
My goal for this topic is to get OpenSIPS 3.1 logging to a new file<br>
OpenSIPs.log and then have Fail2Ban monitoring that log file for failed<br>
login attempts by IP addresses.<br>
I’m running OpenSIPS 3.1 on Debain 10.7<br>
<br>
The Directions in the URL below are valid for OpenSIPS up to version 2.4<br>
But with OpenSIPS 3.1 it is different as they do not use www_challenge("",<br>
"0"); but www_challenge("", "auth"); Instead.<br>
The difference is the '0' in OpenSIPS 2.4 and the 'auth' in OpenSIPS 3.1<br>
<br>
Same like the instructions in URL link below.<br>
<br>
It is obvious that the code in the needs to be tweaked to work with but all<br>
my attempts to make the edits to the /etc/opensips/opensips.cfg only makes<br>
OpenSIPs unable to load because of bad config file.<br>
<br>
My question is... Where can I go for the source to find out what<br>
www_challenge codes I should use for different login results to log?<br>
Or more end result question... How should I change the directions in 2.4<br>
document to work with a OpenSIPS 3.1 opensips.cfg file?<br>
<br>
----------------------------------------------------------------------------<br>
-------------------------------------------<br>
Rick McGill – CEO<br>
Rick@NetroVOIP.com | Rick@NetropolitanWorks.com <br>
Thailand: +66-2105-4262 x1001 | USA: +1-737-237-2030 | Mobile:<br>
+66-85557-3000<br>
Support:: +66-97047-2000 | SKYPE & LINE ID: NetroVOIP |<br>
Support@NetroVOIP.com<br>
₪ <a href="http://www.NetroVOIP.com" rel="noreferrer" target="_blank">www.NetroVOIP.com</a> Telecommunications / Video Consulting & Solutions<br>
Provider<br>
----------------------------------------------------------------------------<br>
---------------------------------------------- <br>
<br>
<a href="https://www.opensips.org/Documentation/Tutorials" rel="noreferrer" target="_blank">https://www.opensips.org/Documentation/Tutorials</a> <br>
<br>
Document 28. OpenSIPS and fail2ban (Direction for OpenSIPS ver 2.4)<br>
This is a small tutorial so you can use fail2ban together with opensips to<br>
block via firewall the attackers that are using wrong authentication<br>
credentials<br>
<br>
<a href="https://www.opensips.org/Documentation/Tutorials-Fail2Ban" rel="noreferrer" target="_blank">https://www.opensips.org/Documentation/Tutorials-Fail2Ban</a> <br>
<br>
The is what is in the link above:<br>
<br>
-------<br>
from:<br>
----------------------------------------------------------------------------<br>
------<br>
<br>
if (!www_authorize("", "subscriber")) {<br>
www_challenge("", "0");<br>
exit;<br>
}<br>
----------------------------------------------------------------------------<br>
----<br>
<br>
----<br>
To:<br>
----------------------------------------------------------------------------<br>
-----<br>
<br>
$var(auth_code) = www_authorize("", "subscriber");<br>
if ( $var(auth_code) == -1 || $var(auth_code) == -2 ) {<br>
xlog("L_NOTICE","Auth error for $fU@$fd from $si cause<br>
$var(auth_code)");<br>
}<br>
if ( $var(auth_code) < 0 ) {<br>
www_challenge("", "0");<br>
exit;<br>
}<br>
----------------------------------------------------------------------------<br>
----<br>
<br>
The issue is that my new install of OpenSIP has code a bit different.<br>
Instead of "0" it has "AUTH".<br>
And when I change the Code like the TO: section above OpenSIPS will not<br>
start because it says Error in Config File it cannot load opensips.<br>
<br>
------------<br>
This is what the default code looks like in the opensips.cfg for OpenSIPS<br>
3.1 after a new fresh install like I have: Notice that www_challenger is<br>
"auth" and not "0" I have tried to enter it as '0" as per the instructions<br>
in URL link above but that is when it then causes OpenSIPS to not be able to<br>
restart.<br>
----------------------------------------------------------------------------<br>
----<br>
if (is_method("REGISTER")) {<br>
# authenticate the REGISTER requests<br>
if (!www_authorize("", "subscriber")) {<br>
www_challenge("", "auth");<br>
exit;<br>
}<br>
----------------------------------------------------------------------------<br>
----<br>
<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr"><font style="background-color:rgb(255,255,255)" color="#0b5394">Best regards,<br></font></div><div dir="ltr"><font style="background-color:rgb(255,255,255)" color="#0b5394">Donat Zenichev<br><br></font></div></div></div></div></div></div></div></div>