It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long. If you want to make sure they don't even talk to the FS, iptable is a good way, but you can only do so much by banning 1 ip address. fail2ban is a much better solution for the future Denial of Service (DoS) attacks.
fail2ban on wiki----- Original Message -----From: Joao LemeSent: Saturday, January 29, 2011 7:20 PMSubject: Re: [Freeswitch-users] Hacker Attack?How do I do that?Thanks!
On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific host?
> _______________________________________________
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
> I just downloaded and compiled the latest Git and a little after starting
> freeswitch I'm getting non stop the following:
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
> ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236
> it's non-stop and doesn't let me do nothing else. After the first time I
> went on to vars and changed the 1234 password....restarted and same thing
> happened, I also try denying the ip on acl.conf (not sure if has something
> to do with it but gave it a try):
>
> <configuration name="acl.conf" description="Network Lists">
> <network-lists>
> <list name="test2" default="allow">
> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/>
> </list>
> </network-lists>
> </configuration>
>
> Restarted the computer but nothing, he (thomas I guess) was back on my
> console.
>
> Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the
> only way I got to be able to connect to the internal profile from out of the
> office etc).
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_______________________________________________
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org