From 6772c05e83154fdd7ba90b39da67b56b9d48f38b Mon Sep 17 00:00:00 2001
From: sorcier <sorcier@sorcier-research.com>
Date: Mon, 2 Nov 2026 04:27:33 +0100
Subject: [PATCH] Fix: add [INCLUDES] before = common.conf to fail2ban asterisk
 filter

---
 install.sh     |  3 +++
 scripts/fix.sh | 14 +++++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/install.sh b/install.sh
index 8df4922..72b205d 100755
--- a/install.sh
+++ b/install.sh
@@ -344,6 +344,9 @@ App\FirewallManager::applyNginxConfig((int)($st["admin_https_port"] ?? 8443), (i
 
 # Filtre Fail2ban Asterisk & Nexus-Web
 cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
+[INCLUDES]
+before = common.conf
+
 [Definition]
 failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?<HOST>(?::\d+)?'?
             ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
diff --git a/scripts/fix.sh b/scripts/fix.sh
index a712026..e0eda30 100755
--- a/scripts/fix.sh
+++ b/scripts/fix.sh
@@ -28,7 +28,18 @@ chmod 0664 /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null
 chown www-data:asterisk /var/log/nexus_security.log 2>/dev/null || true
 chmod 0664 /var/log/nexus_security.log 2>/dev/null || true
 
-echo "-> Filtre Fail2ban Nexus-Web..."
+echo "-> Filtres Fail2ban Asterisk & Nexus-Web..."
+cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
+[INCLUDES]
+before = common.conf
+
+[Definition]
+failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?<HOST>(?::\d+)?'?
+            ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
+ignoreregex =
+EOF
+chmod 0644 /etc/fail2ban/filter.d/asterisk.conf
+
 cat << 'EOF' > /etc/fail2ban/filter.d/nexus-web.conf
 [Definition]
 failregex = ^.*\[NEXUS-WEB-AUTH-FAIL\]:\s*<HOST>.*$
@@ -95,3 +106,4 @@ echo "=========================================================="
 echo " [OK] Réparation terminée ! Toutes les permissions sont actives."
 echo "=========================================================="
 /var/www/nexus-pbx/scripts/nexus-banner.sh --force || true
+