<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
p.BalonMetni, li.BalonMetni, div.BalonMetni
{mso-style-name:"Balon Metni";
mso-style-link:"Balon Metni Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.BalonMetniChar
{mso-style-name:"Balon Metni Char";
mso-style-priority:99;
mso-style-link:"Balon Metni";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I’m blocking it with: <a href="http://wiki.freeswitch.org/wiki/Fail2ban">http://wiki.freeswitch.org/wiki/Fail2ban</a><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] <b>On Behalf Of </b>Erkan Ünlü<br><b>Sent:</b> 08 Mar 2011 12:39<br><b>To:</b> freeswitch-users@lists.freeswitch.org<br><b>Subject:</b> [Freeswitch-users] sip auth challenge HACKING ???<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=TR>Hi FS Users,<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>in last time i see in my console of FS this kind of error messages.<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>[WARNING] sofia_reg.c:1246 SIP auth challenge (INVITE) on sofia profile 'internal' for [5828@?????????] from ip ???7?.1??.7??.???<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>i check my config files ever again and again, but today the console is only given this kind of messages. Maybe 20 messages per second.<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>i see the ip that given in the console “from ip xx.xx.xx.xx” i block this ip in my firewall and everything is fine.<o:p></o:p></span></p><p class=MsoNormal><span lang=TR>Now i understand that this a trying to hacking my server. The blocking of the ip is a solution but can not handle this in Freeswitch, because i see this problem sometimes on different FS servers also and in normally the FS server maybe must can handle this problem. For example with automatic black lists if an ip trys more than 20 times with wrong login. So the ip will be banned for 1 hour or so.<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>i’m interesting in if other users have the same problems and ideas in how we can handle this.<o:p></o:p></span></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p><p class=MsoNormal><span lang=TR>Kind regards<o:p></o:p></span></p><p class=MsoNormal><span lang=TR>Erkan</span><o:p></o:p></p><p class=MsoNormal><span lang=TR><o:p> </o:p></span></p></div></body></html>