Fs comed with many sample accounts. There are at least 20 sample directory users 1000-1020 which you should remove before putting it to production. On Sep 26, 2012 8:29 PM, "Todd Bailey" <toddb@toddbailey.net> wrote:
Hey All,
I just got an email from Frontier that there were several attempts to make international calls.
I checked the log file and verified that somehow someone was able to get access to FS from the internet.
here is a sample of the log
[m [36m2012-09-23 16:30:29.916821 [NOTICE] switch_channel.c:941 New Channel sofia/internal/1000@50.47.85.167 [af778857-0188-4ed2-a82a-94ae749a02cb] [m [32m2012-09-23 16:30:29.916821 [INFO] mod_dialplan_xml.c:485 Processing 1000 <1000>->01137168521352 in context default [m [36m2012-09-23 16:30:29.936831 [NOTICE] switch_channel.c:941 New Channel sofia/internal/01137168521352@192.168.1.5:5061 [d1243a78-c464-45fa-9215-e7b85e1221fc] [m [36m2012-09-23 16:30:29.956842 [NOTICE] sofia.c:6132 Ring-Ready sofia/internal/01137168521352@192.168.1.5:5061! [m [36m2012-09-23 16:30:29.956842 [NOTICE] mod_sofia.c:2572 Ring-Ready sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:29.956842 [NOTICE] switch_ivr_originate.c:519 Ring Ready sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:32.936826 [NOTICE] sofia.c:6777 Channel [sofia/internal/01137168521352@192.168.1.5:5061] has been answered [m [36m2012-09-23 16:30:32.956825 [NOTICE] sofia_glue.c:4176 Pre-Answer sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:32.956825 [NOTICE] switch_ivr_originate.c:3303 Channel [sofia/internal/1000@50.47.85.167] has been answered [m [36m2012-09-23 16:30:52.356865 [N [m [36m2012-09-23 16:30:29.916821 [NOTICE] switch_channel.c:941 New Channel sofia/internal/1000@50.47.85.167 [af778857-0188-4ed2-a82a-94ae749a02cb] [m [32m2012-09-23 16:30:29.916821 [INFO] mod_dialplan_xml.c:485 Processing 1000 <1000>->01137168521352 in context default [m [36m2012-09-23 16:30:29.936831 [NOTICE] switch_channel.c:941 New Channel sofia/internal/01137168521352@192.168.1.5:5061 [d1243a78-c464-45fa-9215-e7b85e1221fc] [m [36m2012-09-23 16:30:29.956842 [NOTICE] sofia.c:6132 Ring-Ready sofia/internal/01137168521352@192.168.1.5:5061! [m [36m2012-09-23 16:30:29.956842 [NOTICE] mod_sofia.c:2572 Ring-Ready sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:29.956842 [NOTICE] switch_ivr_originate.c:519 Ring Ready sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:32.936826 [NOTICE] sofia.c:6777 Channel [sofia/internal/01137168521352@192.168.1.5:5061] has been answered [m [36m2012-09-23 16:30:32.956825 [NOTICE] sofia_glue.c:4176 Pre-Answer sofia/internal/1000@50.47.85.167! [m [36m2012-09-23 16:30:32.956825 [NOTICE] switch_ivr_originate.c:3303 Channel [sofia/internal/1000@50.47.85.167] has been answered [m [36m2012-09-23 16:30:52.356865 [NOTICE] switch_channel.c:941 New Channel sofia/internal/1000@50.47.85.167 [4576bc76-144a-4f6f-8915-871b511c374d] [m [32m2012-09-23 16:30:52.376830 [INFO] mod_dialplan_xml.c:485 Processing 1000 <1000>->01137168905352 in context defaultOTICE] switch_channel.c:941 New Channel sofia/internal/1000@50.47.85.167 [4576bc76-144a-4f6f-8915-871b511c374d] [m [32m2012-09-23 16:30:52.376830 [INFO] mod_dialplan_xml.c:485 Processing 1000 <1000>->01137168905352 in context default
At this point I'm at a loss how this is happening as I have multiple firewalls in place that limit port access.
Can someone provide a few pointers on how to better secure FS running on Linux systems?
thanks
-- - - - Best Regards, - - Todd Bailey - -
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org