You can create and tweak another fail2ban rule specifically for this: https://wiki.freeswitch.org/wiki/Fail2ban#SIP_DOS_Attack On 14-06-04 01:59 PM, Neo Haux wrote:
Hi all,
I am receiving hundreds of INVITE/minute and in the log I can see:
/2014-06-04 13:52:30.189371 [WARNING] sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'internal' for [340@MyExternalIP] from ip 62.210.142.39// //2014-06-04 13:52:42.789530 [WARNING] sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'internal' for [341@MyExternalIP] from ip 62.210.142.39// //2014-06-04 13:52:55.479999 [WARNING] sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'internal' for [341@MyExternalIP] from ip 62.210.142.39// //2014-06-04 13:53:08.289660 [WARNING] sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'internal' for [342@MyExternalIP] from ip 62.210.142.39// //2014-06-04 13:53:21.679512 [WARNING] sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile 'internal' for [342@MyExternalIP] from ip 62.210.142.39/
In the /etc/fail2ban/filter.d/freeswitch.conf file I have these lines:
/failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth failure \(REGISTER\) on sofia profile \'\w+\' for \[.*\] from ip <HOST> \[WARNING\] sofia_reg.c:\d+ SIP auth failure \(INVITE\) on sofia profile \'\w+\' for \[.*\] from ip <HOST>/
You can see clearly that my logs contain failure word not "auth challange".
My question is : If I put "auth challange" in my /etc/fail2ban/filter.d/freeswitch.conf will I block regular known and authenticated SIP clients ? If yes, could you help find the right regex to stop this kind of spammers ?
Thank you very much in advance.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org