[Freeswitch-dev] Automatically don't respond to abnormal registrations
Can anyone describe a way in FS to get rid of crawlers and hackers testing your PBX second by second on the internet?! What is the problem? This is ls of my FS's sqlite db after some annoying behaviours of hackers and crawlers violently done: [root@freeswitch db]# ll total 705580 -rw-r--r-- 1 root root 7168 Sep 29 13:20 callcenter.db -rw-r--r-- 1 root root 14336 Sep 23 10:29 call_limit.db -rw-r--r-- 1 root root 257024 Sep 29 13:56 core.db -rw-r--r-- 1 root root 5120 Sep 29 13:20 fifo.db -rw-r--r-- 1 root root 98304 Sep 24 11:34 sofia_reg_sipinterface_2.db -rw-r--r-- 1 root root 367616 Sep 25 18:31 sofia_reg_sipinterface_3.db -rw-r--r-- 1 root root 500726784 Sep 29 13:56 sofia_reg_sipinterface_5.db -rw-r--r-- 1 root root 221003312 Sep 29 13:56 sofia_reg_sipinterface_5.db-journal -rw-r--r-- 1 root root 16384 Sep 23 10:29 voicemail_default.db [root@freeswitch db]# sofia_reg_sipinterface_5.db belongs to the interface listening on 5060 port. As you see sofia_reg_sipinterface_5.db exceed 500MB of size! and this db has crashed! and leads to drop port 5060 of interfaces. when i ask fs_cli about profiles it tells me: +OK log level [7] freeswitch@internal> sofia status Name Type Data State ================================================================================================= sipinterface_3 profile sip:mod_sofia@192.168.2.73:5080 RUNNING (0) voicemail_1 alias sipinterface_2 ALIASED voicemail_2 alias sipinterface_2 ALIASED sipinterface_2 profile sip:mod_sofia@192.168.2.73:5070 RUNNING (0) ================================================================================================= 2 profiles 2 aliases Which open source firewalls can handle automatically weird sip requests to ban?! Sincerely yours,
http://wiki.freeswitch.org/wiki/Fail2ban On Sunday, September 29, 2013, Sayyed Mohammad Emami Razavi wrote:
Can anyone describe a way in FS to get rid of crawlers and hackers testing your PBX second by second on the internet?! What is the problem? This is ls of my FS's sqlite db after some annoying behaviours of hackers and crawlers violently done: [root@freeswitch db]# ll total 705580 -rw-r--r-- 1 root root 7168 Sep 29 13:20 callcenter.db -rw-r--r-- 1 root root 14336 Sep 23 10:29 call_limit.db -rw-r--r-- 1 root root 257024 Sep 29 13:56 core.db -rw-r--r-- 1 root root 5120 Sep 29 13:20 fifo.db -rw-r--r-- 1 root root 98304 Sep 24 11:34 sofia_reg_sipinterface_2.db -rw-r--r-- 1 root root 367616 Sep 25 18:31 sofia_reg_sipinterface_3.db -rw-r--r-- 1 root root 500726784 Sep 29 13:56 sofia_reg_sipinterface_5.db -rw-r--r-- 1 root root 221003312 Sep 29 13:56 sofia_reg_sipinterface_5.db-journal -rw-r--r-- 1 root root 16384 Sep 23 10:29 voicemail_default.db [root@freeswitch db]#
sofia_reg_sipinterface_5.db belongs to the interface listening on 5060 port.
As you see sofia_reg_sipinterface_5.db exceed 500MB of size! and this db has crashed! and leads to drop port 5060 of interfaces.
when i ask fs_cli about profiles it tells me: +OK log level [7] freeswitch@internal> sofia status Name Type Data State
================================================================================================= sipinterface_3 profile sip:mod_sofia@192.168.2.73:5080 RUNNING (0) voicemail_1 alias sipinterface_2 ALIASED voicemail_2 alias sipinterface_2 ALIASED sipinterface_2 profile sip:mod_sofia@192.168.2.73:5070 RUNNING (0)
================================================================================================= 2 profiles 2 aliases
Which open source firewalls can handle automatically weird sip requests to ban?!
Sincerely yours,
File it on JIRA so we don't lose track. Include a pcap and debug logs from console. On Fri, Oct 4, 2013 at 9:55 AM, daemonserj <daemonserj@gmail.com> wrote:
Hello all.
FS erroneously detects that G729 stream is using ptime=30ms whereas it is ptime=20ms for sure. Because of wrong detection audio is stretched and it's playing choppy.
2013-10-04 21:36:04.496933 [WARNING] mod_sofia.c:1281 Asynchronous PTIME not supported, changing our end from 20 to 30 2013-10-04 21:36:04.496933 [DEBUG] sofia_glue.c:3063 Changing Codec from G729@20ms@8000hz to G729@30ms@8000hz
<param name="rtp-autofix-timing" value="false"/> helped me.
Is it intresting to fix that behaviour for someone ? I can reproduce it easily.
Sincerely yours, DaemonSerj
*-- С уважением, daemonserj *mailto:daemonserj@gmail.com<daemonserj@gmail.com>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
participants (4)
-
Anthony Minessale
-
daemonserj
-
Sayyed Mohammad Emami Razavi
-
Steven Ayre