Hi Roman, I think that more elegant solution for your task is cut off bruteforce on Kamailio side rather than on FreeSWITCH. You do not need (and must not) pass malicious traffic to backends. It is best practice. Is every inbound requests (REGISTER, INVITE) passes Kamailio? If Kamailio work as stateful SIP proxy then you can pay attention to unsuccessful authentication attempts in reply routes and manages it, for example, with pike or something like that. Or event configure fail2ban on Kamailio server rather than on FreeSWITCH. This is just my opinion. 2016-11-29 10:50 GMT+02:00 Alex Balashov <abalashov@evaristesys.com>:
On Tue, Nov 29, 2016 at 09:37:26AM +0100, Roman Dissauer wrote:
I already get the original source IP into FS but I need to log unsuccessful auth attempts with original IP to block them with fail2ban. The default log message „SIP auth challenge…“ does only log the Proxy IP
Ah, I see.
I must have misunderstood your question, then. It sounds like what you actually want to know is how to issue an arbitrary log statement?
I think this page answers that question:
https://wiki.freeswitch.org/wiki/Misc._Dialplan_Tools_log
Or did I miss something still?
-- Alex
-- Alex Balashov | Principal | Evariste Systems LLC
Tel: +1-706-510-6800 (direct) / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- С уважением, Владислав Захожай