[Freeswitch-users] Freeswitch server itself generating unwanted calls (Ghost calls)

[David Villasmil]

You need to enable fail2ban, whether you like it or not. It will only block
ip addresses from which failed register attempts are received. It won't
block successful registers.

On the other hand, if you are seeing calls from registered users and those
users claim they didn't make those calls, you must change all passwords.

As Jay points out, you should authorize on all profiles either with digest
or with acl.
On Mon, Feb 20, 2017 at 12:10 PM jay binks <jaybinks at gmail.com> wrote:

> your username / passwords are probably compromised, if not your box
> entirely.
>
>
>    - Change ALL your passwords and enforce strong password policies.
>    - Make sure all your SIP Profiles require auth, or have strong ACL's
>    - Implement fail2ban
>    - BLOCK THE KNOWN ATTACKER IP with Iptables.
>
> Im sorry to sound like an ass, but if you havnt done one of the above or
> dont think you can do them all then you probably need to pay someone who
> knows what they are doing.
>
>
>
>
>
>
> On 20 February 2017 at 20:38, Shisheer Teli <telishisheer at gmail.com>
> wrote:
>
> all my users are connected from office outside. so I can't block any IP.
>
> is there any configuration in FreeSWITCH to block them.. ?
>
> On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov <
> bordmi at rarus.ru> wrote:
>
> Hi!
>
> This call is not self generated. It`s was generated by 23.239.85.20 (in
> most cases). Do you have properli configurated firewall?
>
> пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer at gmail.com>:
>
> Dear Team,
>
> from last few days my FreeSWITCH server generating some logs itself.
>
> I don't know how to stop this .. please help  .. it's urgent.
>
> Please see the attached logs.
>
>
> --
> Regards,
> Shisheer T
>
> *Save paper, save trees.... Please do not print this e-mail unless it is
> absolutely necessary.*
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
> --
> --
> С уважением,
> Борисов Дмитрий
> Отдел облачных технологий 1С-Рарус
> Тел. +7 (495) 231-20-02 <+7%20495%20231-20-02> доб.: 15-94
> --
> with best regards,
> Dmitriy Borisov
> 1C-Rarus Cloud Services
> tel.: +7 (495) 231-20-02 <+7%20495%20231-20-02> add.: 15-94
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
>
>
> --
> Regards,
> Shisheer T
>
> *Save paper, save trees.... Please do not print this e-mail unless it is
> absolutely necessary.*
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
>
>
> --
> Sincerely
>
> Jay
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20170220/556b8754/attachment-0001.html