<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Yep, fail2ban is another option.. it's nice to have options.. ;-)<br>
<br>
-John<br>
<br>
<div class="moz-cite-prefix">On 14/05/13 2:28 AM, Steven Ayre wrote:<br>
</div>
<blockquote
cite="mid:CAFiqYu=N4nxgeDzQkDWMy9SbAh0EM4-1u++U0rrcg0oXBYHTiQ@mail.gmail.com"
type="cite">This is the purpose of the fail2ban system that was
already mentioned.
<div><br>
</div>
<div>-Steve</div>
<div><br>
<div><br>
<br>
<div class="gmail_quote">On 13 May 2013 15:52, Telecube - John
<span dir="ltr"><<a moz-do-not-send="true"
href="mailto:john@telecube.com.au" target="_blank">john@telecube.com.au</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> You can install a
log watching program that looks out for specific log
entries and can take action. Eg; writing a firewall rule
to ban the ip address of the system trying to make
unauthorised calls.<br>
<br>
'swatch' is a good tool for this in linux systems.<br>
<br>
<a moz-do-not-send="true"
href="http://sourceforge.net/projects/swatch/"
target="_blank">http://sourceforge.net/projects/swatch/</a><span
class="HOEnZb"><font color="#888888"><br>
<br>
John <br>
</font></span>
<div>
<div class="h5"> <br>
<div>On 14/05/13 12:35 AM, Ken Rice wrote:<br>
</div>
<blockquote type="cite"> <font face="Monaco,
Courier New"><span style="font-size:11pt">Ok
look at the 3rd column... This is someone
trying to figure out how to get calls thru
your public context with various prefix
codexs... Notices how all the calls end with
972598371070 <-- that’s the intl
destination umber probably a phone in gaza
(definitely in Isreali controlled areas, but I
think I looked up this number or similar
number in the past)<br>
<br>
To protect yourself, only allow calls to local
extentsions from the public context... <br>
<br>
<br>
On 5/13/13 2:49 AM, "Steven Ayre" <<a
moz-do-not-send="true"
href="http://steveayre@gmail.com"
target="_blank">steveayre@gmail.com</a>>
wrote:<br>
<br>
</span></font>
<blockquote><font face="Monaco, Courier New"><span
style="font-size:11pt">The call duration is
0 seconds so no they didn't get in. Any
accepted call attempt will generate a CDR
even if it was not answered.<br>
<br>
They're coming in on the 'public' context
which'll mean an unauthenticated call on the
external profile. That would be the context
allowing you to receive calls from
strangers. Providing that context doesn't
allow them to dial out via providers that
charge you this isn't an issue.<br>
<br>
-Steve<br>
<br>
<br>
<br>
<br>
<br>
<br>
On 13 May 2013 07:17, Bala Murugan Mahendran
<<a moz-do-not-send="true"
href="http://b2m@a-cti.com"
target="_blank">b2m@a-cti.com</a>>
wrote:<br>
</span></font>
<blockquote><font face="Monaco, Courier New"><span
style="font-size:11pt">I have lot
of entries like 1000,1001,1002 and so on,
Is someone trying to get inside?
I believe they didn't in yet but how come
we have cdr log like this?<br>
<br>
"1004","1004","012972598371070","public","2013-05-12
07:30:07","","2013-05-12
07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","013972598371070","public","2013-05-12
07:30:07","","2013-05-12
07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","014972598371070","public","2013-05-12
07:30:07","","2013-05-12
07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","010972598371070","public","2013-05-12
07:30:08","","2013-05-12
07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","0061972598371070","public","2013-05-12
07:30:08","","2013-05-12
07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","0041972598371070","public","2013-05-12
07:30:09","","2013-05-12
07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","000972598371070","public","2013-05-12
07:30:09","","2013-05-12
07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","006972598371070","public","2013-05-12
07:30:09","","2013-05-12
07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","002972598371070","public","2013-05-12
07:30:10","","2013-05-12
07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729"<br>
"1004","1004","810972598371070","public","2013-05-12
07:29:49","","2013-05-12
07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"<br>
<br>
<br>
Thanks,<br>
Bala<br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting
Services:<br>
<a moz-do-not-send="true"
href="http://consulting@freeswitch.org"
target="_blank">consulting@freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://www.freeswitchsolutions.com"
target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel
Communication Server<br>
<a moz-do-not-send="true"
href="http://www.cudatel.com"
target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a moz-do-not-send="true"
href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://wiki.freeswitch.org"
target="_blank">http://wiki.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://www.cluecon.com"
target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a moz-do-not-send="true"
href="http://FreeSWITCH-users@lists.freeswitch.org"
target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/options/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a moz-do-not-send="true"
href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
<br>
</span></font></blockquote>
<font face="Monaco, Courier New"><span
style="font-size:11pt"><br>
<br>
<hr size="3" width="95%" align="CENTER"></span></font><font><font
face="Consolas, Courier New, Courier"><span
style="font-size:10pt">_________________________________________________________________________<br>
Professional FreeSWITCH Consulting
Services:<br>
<a moz-do-not-send="true"
href="http://consulting@freeswitch.org"
target="_blank">consulting@freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://www.freeswitchsolutions.com"
target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel
Communication Server<br>
<a moz-do-not-send="true"
href="http://www.cudatel.com"
target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a moz-do-not-send="true"
href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://wiki.freeswitch.org"
target="_blank">http://wiki.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://www.cluecon.com"
target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a moz-do-not-send="true"
href="http://FreeSWITCH-users@lists.freeswitch.org"
target="_blank">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/options/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a moz-do-not-send="true"
href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
</span></font></font></blockquote>
<font><font face="Consolas, Courier New, Courier"><span
style="font-size:10pt"><br>
</span></font></font><font face="Monaco,
Courier New"><span style="font-size:11pt">-- <br>
Ken<br>
<font color="#0000FF"><u><a
moz-do-not-send="true"
href="http://www.FreeSWITCH.org"
target="_blank">http://www.FreeSWITCH.org</a><br>
<a moz-do-not-send="true"
href="http://www.ClueCon.com"
target="_blank">http://www.ClueCon.com</a><br>
<a moz-do-not-send="true"
href="http://www.OSTAG.org"
target="_blank">http://www.OSTAG.org</a><br>
</u></font><a moz-do-not-send="true"
href="http://irc.freenode.net"
target="_blank">irc.freenode.net</a>
#freeswitch<br>
</span></font> <br>
<fieldset></fieldset>
<br>
<pre>_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
<a moz-do-not-send="true" href="mailto:consulting@freeswitch.org" target="_blank">consulting@freeswitch.org</a>
<a moz-do-not-send="true" href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
<a moz-do-not-send="true" href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a>
Official FreeSWITCH Sites
<a moz-do-not-send="true" href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a>
<a moz-do-not-send="true" href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a>
<a moz-do-not-send="true" href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a>
FreeSWITCH-users mailing list
<a moz-do-not-send="true" href="mailto:FreeSWITCH-users@lists.freeswitch.org" target="_blank">FreeSWITCH-users@lists.freeswitch.org</a>
<a moz-do-not-send="true" href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a>
UNSUBSCRIBE:<a moz-do-not-send="true" href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a>
<a moz-do-not-send="true" href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a>
</pre>
</blockquote>
<br>
</div>
</div>
</div>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a moz-do-not-send="true"
href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://www.freeswitchsolutions.com"
target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication
Server<br>
<a moz-do-not-send="true" href="http://www.cudatel.com"
target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a moz-do-not-send="true" href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a moz-do-not-send="true" href="http://www.cluecon.com"
target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a moz-do-not-send="true"
href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a moz-do-not-send="true"
href="http://lists.freeswitch.org/mailman/options/freeswitch-users"
target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a moz-do-not-send="true" href="http://www.freeswitch.org"
target="_blank">http://www.freeswitch.org</a><br>
<br>
</blockquote>
</div>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
<a class="moz-txt-link-abbreviated" href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitchsolutions.com">http://www.freeswitchsolutions.com</a>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
<a class="moz-txt-link-freetext" href="http://www.cudatel.com">http://www.cudatel.com</a>
Official FreeSWITCH Sites
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://wiki.freeswitch.org">http://wiki.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://www.cluecon.com">http://www.cluecon.com</a>
FreeSWITCH-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a>
UNSUBSCRIBE:<a class="moz-txt-link-freetext" href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a>
<a class="moz-txt-link-freetext" href="http://www.freeswitch.org">http://www.freeswitch.org</a>
</pre>
</blockquote>
<br>
</body>
</html>