Hello, You have to use one of the below options: Option1: if you are not allowing another system to access you system without username and password i.e. you make your system as sip gateway for other trusted company, the you can remove the file named “external.xml” under /usr/local/freeswitch/conf/sip_profiles/, then either restart your instance or run “reload mod_sofia” in fs_cli Note be sure that you take a copy of external.xml before you remove it. Option2: add the below line in you external.xml profile mentioned above, this will not allow any external system to login expect if it has been allowed in you ACL list or it has a username/password this will make things little hard, then you may install fail2ban module. all cases you need to restart your profiles. Thanks, Ahmed Habiba
From: Jude Mukundane <jude19love@gmail.com> Subject: Re: [Freeswitch-users] Suspicious Incoming Calls Date: February 6, 2016 at 6:50:23 PM GMT+3 To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Reply-To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
Hello Deepika,
This is common for anyone running FS in the cloud with discoverable ports. Lots of people just run scripts that crawl the internet in search of SIP servers. After getting one they try bogus invites to try and see if they can get calls through - if your server is forwarding to PSTN, you could end up with a bill in thousands of dollars in minutest. In my case, I use a simple IP Table in Ubuntu (more like an access control list) to define allowed and non allowed IPs.
Can someone please elaborate on a measure that inolves config level security because blocking out masses is not goot Internet Citizenry.
Jude
On Sat, Feb 6, 2016 at 2:24 PM, Deepika Yadav <deepikay@iiitd.ac.in <mailto:deepikay@iiitd.ac.in>> wrote: Hi,
I have microsip installed in my windows configured for one or two SIP accounts for different Freeswitch servers. I am receiving a call from 2022@myPublicIP repeatitively even if I disconnect from all the accounts, these Freeswitch servers are hosted at cloud machine.
Is it a case of hacking the servers. What measures should I take to secure both my servers and system.
Regards, Deepika
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>