It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long. If you want to make sure they don't even talk to the FS, iptable is a good way, but you can only do so much by banning 1 ip address. fail2ban is a much better solution for the future Denial of Service (DoS) attacks.

Regardless of any preventative you go with, make sure you don't have any sip accounts with easy to guess passwords. Depending on their script, it wouldn't take too long to brute-force a dictionary-based passwords.

Frank



On Sat, Jan 29, 2011 at 7:45 PM, Madovsky <infos@madovsky.org> wrote:
fail2ban on wiki
----- Original Message -----
From: Joao Leme
Sent: Saturday, January 29, 2011 7:20 PM
Subject: Re: [Freeswitch-users] Hacker Attack?

How do I do that?
Thanks!

On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific host?

On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
> I just downloaded and compiled the latest Git and a little after starting
> freeswitch I'm getting non stop the following:
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> it's non-stop and doesn't let me do nothing else. After the first time I
> went on to vars and changed the 1234 password....restarted and same thing
> happened, I also try denying the ip on acl.conf (not sure if has something
> to do with it but gave it a try):
>
> <configuration name="acl.conf" description="Network Lists">
>         <network-lists>
>           <list name="test2" default="allow">
>             <node type="deny" host="212.224.71.236" mask="255.255.255.0"/>
>           </list>
>         </network-lists>
>       </configuration>
>
> Restarted the computer but nothing, he (thomas I guess) was back on my
> console.
>
> Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the
> only way I got to be able to connect to the internal profile from out of the
> office etc).
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>

_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org



_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org




--

----=======================----
Frank Park
Telonium Communications, LLC
frank@telonium.com
http://www.telonium.com
Follow Us on Twitter: @GetTelonium
404-566-8888 x1001 Office
404-939-4242 Cell
----=======================----