{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1328","repository_url":"https://api.github.com/repos/fail2ban/fail2ban","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1328/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1328/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1328/events","html_url":"https://github.com/fail2ban/fail2ban/pull/1328","id":135056936,"number":1328,"title":"Removed silly 'Failed to authenticate <HOST>' line","user":{"login":"shakvaal","id":4275080,"avatar_url":"https://avatars.githubusercontent.com/u/4275080?v=3","gravatar_id":"","url":"https://api.github.com/users/shakvaal","html_url":"https://github.com/shakvaal","followers_url":"https://api.github.com/users/shakvaal/followers","following_url":"https://api.github.com/users/shakvaal/following{/other_user}","gists_url":"https://api.github.com/users/shakvaal/gists{/gist_id}","starred_url":"https://api.github.com/users/shakvaal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shakvaal/subscriptions","organizations_url":"https://api.github.com/users/shakvaal/orgs","repos_url":"https://api.github.com/users/shakvaal/repos","events_url":"https://api.github.com/users/shakvaal/events{/privacy}","received_events_url":"https://api.github.com/users/shakvaal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-02-20T10:03:17Z","updated_at":"2016-02-20T17:59:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/fail2ban/fail2ban/pulls/1328","html_url":"https://github.com/fail2ban/fail2ban/pull/1328","diff_url":"https://github.com/fail2ban/fail2ban/pull/1328.diff","patch_url":"https://github.com/fail2ban/fail2ban/pull/1328.patch"},"body":"'Failed to authenticate <HOST>' regex captures the **attacked** host, not the one **attacking**,\r\nso eventually the ip address of the machine fail2ban runs on is getting banned."},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/186659734","html_url":"https://github.com/fail2ban/fail2ban/pull/1328#issuecomment-186659734","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1328","id":186659734,"user":{"login":"yarikoptic","id":39889,"avatar_url":"https://avatars.githubusercontent.com/u/39889?v=3","gravatar_id":"","url":"https://api.github.com/users/yarikoptic","html_url":"https://github.com/yarikoptic","followers_url":"https://api.github.com/users/yarikoptic/followers","following_url":"https://api.github.com/users/yarikoptic/following{/other_user}","gists_url":"https://api.github.com/users/yarikoptic/gists{/gist_id}","starred_url":"https://api.github.com/users/yarikoptic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yarikoptic/subscriptions","organizations_url":"https://api.github.com/users/yarikoptic/orgs","repos_url":"https://api.github.com/users/yarikoptic/repos","events_url":"https://api.github.com/users/yarikoptic/events{/privacy}","received_events_url":"https://api.github.com/users/yarikoptic/received_events","type":"User","site_admin":false},"created_at":"2016-02-20T17:59:34Z","updated_at":"2016-02-20T17:59:34Z","body":"\nOn Sat, 20 Feb 2016, shakvaal wrote:\n\n>    @yarikoptic Yes I'm sure: I've checked my tshark dump and corresponding\n>    asterisk log and see that malicious sip packets are crafted to look like\n>    this. For example: (XXX.XXX.XXX.XXX is my asterisk's public ip)\n\n>  ACK sip:810972595341444@82.146.36.6 SIP/2.0\n>  Via: SIP/2.0/UDP 80.86.90.250:5088;branch=z9hG4bK-d109ca620cb2c71a0b286a9ab0a79fdc;rport\n>  From: 1005<sip:1005@XXX.XXX.XXX.XXX>;tag=6f69dacc\n>  To: 810972595341444<sip:810972595341444@XXX.XXX.XXX.XXX>;tag=as26a286bb\n>  Call-ID: d109ca620cb2c71a0b286a9ab0a79fdc\n>  CSeq: 2 ACK\n>  ...\n\nI am not familiar with asterisk insides...\n\nany of 80.86.90.250,  82.146.36.6 relate to your network of the server?\n;)\n\ninteresting.... it brings the related question actually:  is logged IP\nis something provided at the level of asterisk packet envelope without\nany support/verification from IP level and/or after initial\nhandshake interaction via TCP or UDP?  \n\nif not, i.e. reported value just a matter of an (arbitrary) value\nin the envelope then we must remove ANY/EVERY failregex which relies on\nit or at least add a big fat warning into filter/jail, since that\nreported IP could be arbitrary IP of a victim (i.e. yourself ;) )\n\n-- \nYaroslav O. Halchenko\nCenter for Open Neuroscience     http://centerforopenneuroscience.org\nDartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755\nPhone: +1 (603) 646-9834                       Fax: +1 (603) 646-1419\nWWW:   http://www.linkedin.com/in/yarik        \n"}}