[Freeswitch-users] sip auth challenge HACKING ???

[jay binks]

your after Fail2Ban ( which is a separate script )
but it inspects these log messages and adds them to iptables.

http://wiki.freeswitch.org/wiki/Fail2ban

<http://wiki.freeswitch.org/wiki/Fail2ban>Jay



2011/3/8 Erkan Ünlü <erkan at speedingtrade.com>

> Hi FS Users,
>
>
>
> in last time i see in my console of FS this kind of error messages.
>
>
>
> [WARNING] sofia_reg.c:1246 SIP auth challenge (INVITE) on sofia profile
> 'internal' for [5828@?????????] from ip ???7?.1??.7??.???
>
>
>
> i check my config files ever again and again, but today the console is only
> given this kind of messages. Maybe 20 messages per second.
>
>
>
> i see the ip that given in the console “from ip xx.xx.xx.xx” i block this
> ip in my firewall and everything is fine.
>
> Now i understand that this a trying to hacking my server. The blocking of
> the ip is a solution but can not handle this in Freeswitch, because i see
> this problem sometimes on different FS servers also and in normally the FS
> server maybe must can handle this problem. For example with automatic black
> lists if an ip trys more than 20 times with wrong login. So the ip will be
> banned for 1 hour or so.
>
>
>
> i’m interesting in if other users have the same problems and ideas in how
> we can handle this.
>
>
>
> Kind regards
>
> Erkan
>
>
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>


-- 
Sincerely

Jay
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20110308/632b1d83/attachment.html