[Freeswitch-users] repeated registration messages in logs

[Steven Ayre]

Registrations work by the client sending a REGISTER to the server, which returns 401 to challenge and client resends REGISTER with the authentication details.

The register has an expiry time. To remain registered the client must reREGISTER within this time, and each REGISTER has its own 401 authentication (to prevent replay attacks).

What you're seeing is a log message each time the registration is renewed. That's why you still see it even though FS is apparently idle.

The log message really is only informative. It logs at WARNING level so that you can use fail2ban while only logging serious messages so you don't get massive log files.

FS will log both the initial REGISTER/401 then at the 2nd REGISTER whether it succeeds or fails. Both are required to detect bots looking to break into an insecure or DDOS a SIP server, since the client might never send the 2nd REGISTER.

If you are not using fail2ban and want quieter logs, set the log-auth-failures param to false on the relevant Sofia profile. Add it if it doesn't exist.

mod_fail2ban provides native integration without having to log these messages for fail2ban to detect. If you use it you'll probably still need to set the above param. (Disclaimer: I haven't used the module).

Steve




On 27 Dec 2012, at 14:44, Archana Venugopan <a.venugopan at mundio.com> wrote:

> Hi,
> Thanks. If there is no activity for a while then calls drops out and I need to re-start the FS. I also see these messages frequently after each call and after registration and while FS is idle.
> Am not sure why is this happening.
>  
> I keep getting those messages every 5 mins.
>  
> Regards,
> Archana
>  
> From: Mick Stevens [mailto:mick.stevens at smartipx.com] 
> Sent: 27 December 2012 12:49
> To: Archana Venugopan
> Subject: Re: [Freeswitch-users] repeated registration messages in logs
>  
> Hi Archana,
>  
> This is just your SIP client (softphone etc) sending keep alive/SIP re-register messages. You can normally adjust this in the settings of your client.
>  
> I find setting "reregister every 300 seconds" normally works ok for me.
>  
> Rgds, Mick
>  
>  
> 
> On 27 December 2012 12:40, Archana Venugopan <a.venugopan at mundio.com> wrote:
> Hi,
>  
> After registering the phones successfully I am getting the below message continuously every few seconds in my logs and this is filling up the logs and freeswitch goes down sometimes.
> Can someone please tell me why I keep getting this message every few seconds? I have another server and there I don’t see this issue.
>  
> 2012-12-27 12:37:44.714558 [WARNING] sofia_reg.c:1484 SIP auth challenge (REGISTER) on sofia profile 'internal' for [Abarajit at vectonecloud.com] from ip 192.168.2.205
> 2012-12-27 12:41:58.744557 [WARNING] sofia_reg.c:1484 SIP auth challenge (REGISTER) on sofia profile 'internal' for [sana at vectonecloud.com] from ip 192.168.2.48
>  
> Regards,
> Archana
>  
> 
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
> 
> 
> 
> 
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
> 
> 
> 
>  
> --
> Regards
> 
> Mick Stevens
> Communications Technologist
> Smart IPX Ltd
> Tel/Fax. +44(0)20 7001 6869
> Email. mick.stevens at smartipx.com
> Skype. mick.smartipx.com
> www.smartipx.com
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
> 
> 
> 
> 
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20121227/0f2bbc59/attachment.html