It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long. If you want to make sure they don't even talk to the FS, iptable is a good way, but you can only do so much by banning 1 ip address. fail2ban is a much better solution for the future Denial of Service (DoS) attacks. Regardless of any preventative you go with, make sure you don't have any sip accounts with easy to guess passwords. Depending on their script, it wouldn't take too long to brute-force a dictionary-based passwords. Frank On Sat, Jan 29, 2011 at 7:45 PM, Madovsky <infos@madovsky.org> wrote:
fail2ban on wiki
----- Original Message ----- *From:* Joao Leme <joaocarlosleme@gmail.com> *To:* FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *Sent:* Saturday, January 29, 2011 7:20 PM *Subject:* Re: [Freeswitch-users] Hacker Attack?
How do I do that? Thanks!
On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com>wrote:
Try using iptables and block all incoming traffic from this specific host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ----=======================---- Frank Park Telonium Communications, LLC frank@telonium.com http://www.telonium.com Follow Us on Twitter: @GetTelonium 404-566-8888 x1001 Office 404-939-4242 Cell ----=======================----