Fix: usedns=no in fail2ban, exact quoted host regex for asterisk, and timeout 2 on all fail2ban-client calls

install.sh

@@ -361,7 +361,7 @@ cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
 before = common.conf
 
 [Definition]
-failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?<HOST>(?::\d+)?'?
+failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'<HOST>'(?::\d+)?
             ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
 ignoreregex =
 EOF
@@ -380,6 +380,7 @@ cat << 'EOF' > /etc/fail2ban/jail.local
 bantime = 3600
 findtime = 600
 maxretry = 3
+usedns = no
 ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
 
 [asterisk]

scripts/fix.sh

@@ -34,7 +34,7 @@ cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
 before = common.conf
 
 [Definition]
-failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?<HOST>(?::\d+)?'?
+failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'<HOST>'(?::\d+)?
             ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
 ignoreregex =
 EOF
@@ -47,6 +47,41 @@ ignoreregex =
 EOF
 chmod 0644 /etc/fail2ban/filter.d/nexus-web.conf
 
+cat << 'EOF' > /etc/fail2ban/jail.local
+[DEFAULT]
+bantime = 3600
+findtime = 600
+maxretry = 3
+usedns = no
+ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+
+[asterisk]
+enabled = true
+port = 5060,5061
+protocol = udp
+filter = asterisk
+logpath = /var/log/asterisk/messages
+action = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+maxretry = 3
+bantime = 3600
+
+[nginx-http-auth]
+enabled = true
+port = http,https,8443
+logpath = /var/log/nginx/*error.log
+maxretry = 5
+bantime = 3600
+
+[nexus-web]
+enabled = true
+port = http,https,8443
+filter = nexus-web
+logpath = /var/log/nexus_security.log
+maxretry = 3
+findtime = 600
+bantime = 3600
+EOF
+
 echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..."
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true

src/FirewallManager.php

@@ -73,8 +73,8 @@ class FirewallManager
 
         $settings = self::getSettings();
 
-        // 1. Détection service Fail2ban
+        // 1. Détection service Fail2ban (avec timeout strict de 2s anti-blocage)
-        exec('sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
+        exec('timeout 2 sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
         $isRunning = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
 
         $jails = [];
@@ -82,7 +82,7 @@ class FirewallManager
         $totalBannedCount = 0;
 
         if ($isRunning) {
-            exec('sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
+            exec('timeout 2 sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
             $statStr = implode("\n", $statOut);
 
             // Extraction des prisons actives
@@ -138,7 +138,7 @@ class FirewallManager
         $unbannedFrom = [];
 
         if ($jail !== '' && $jail !== 'all') {
-            $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
+            $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
             exec($cmd, $out, $code);
             if ($code === 0) {
                 $unbannedFrom[] = $jail;
@@ -146,7 +146,7 @@ class FirewallManager
         } else {
             // Débannir de toutes les prisons connues
             foreach (['asterisk', 'nexus-web', 'sshd'] as $j) {
-                $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
+                $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
                 exec($cmd, $out, $code);
                 if ($code === 0) {
                     $unbannedFrom[] = $j;
@@ -175,7 +175,7 @@ class FirewallManager
         }
 
         $jail = trim($jail) ?: 'asterisk';
-        $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
+        $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
         exec($cmd, $out, $code);
         @unlink('/tmp/nexus_fw_status_cache.json');
 
@@ -253,8 +253,8 @@ class FirewallManager
             $adminPort
         );
 
-        // 3. Rechargement de Fail2ban
+        // 3. Rechargement de Fail2ban (timeout 3s)
-        exec('sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
+        exec('timeout 3 sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
 
         // 4. Mise à jour de la configuration Nginx
         self::applyNginxConfig($adminPort, $strictPort80);
@@ -291,6 +291,7 @@ ignoreip = {$whitelist}
 findtime = {$sipFindTime}
 bantime = {$sipBanTime}
 maxretry = {$sipMaxRetry}
+usedns = no
 
 [sshd]
 enabled = true
@@ -492,7 +493,7 @@ EOF;
 
     private static function getJailDetails(string $jail): array
     {
-        exec('sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
+        exec('timeout 2 sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
         $str = implode("\n", $out);
 
         $currentlyFailed = 0;