log auth failures only logs when there's been an actual failure:

reg -> 401 (send password again with md5 hashed password -> reg failure.

It sounds like this attack was just "reg" so it didn't get triggered.

That's why there's a separate fail2ban profile for floods --аhttp://wiki.freeswitch.org/wiki/Fail2ban#SIP_DOS_Attack

There's another module that makes a dedicated log for fail2ban but I don't think it's been tested much:

http://wiki.freeswitch.org/wiki/Mod_fail2ban

-Avi Marcus
BestFone

On Wed, Mar 20, 2013 at 6:21 AM, Phil Quesinberry <philq@qsystemsengineering.com> wrote:

We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didnТt catch it because there was no failure message in the log, just repeated registration messages.а I added the following to sofia.conf.xml and reloaded but there was no change in behavior:

<param name="log-auth-failures" value="true"/>

Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged.

IТm not sure why this attack doesnТt generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time.а Of course IТd prefer to ban only on failures.

The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash.

Here is an excerpt of the traffic:

2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

freeswitch@internal> sofia profile internal siptrace on

Enabled sip debugging on internal

2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:

аа ------------------------------------------------------------------------

аа REGISTER sip:xx.xx.xx.xx SIP/2.0

аа Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport

аа Content-Length: 0

аа From: "4623" <sip:4623@xx.xx.xx.xx>

аа Accept: application/sdp

аа User-Agent: friendly-scanner

аа To: "4623" <sip:4623@xx.xx.xx.xx>

аа Contact: sip:123@1.1.1.1

аа CSeq: 1 REGISTER

аа Call-ID: 1757394

аа Max-Forwards: 70

а

аа ------------------------------------------------------------------------

2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:

аа ------------------------------------------------------------------------

аа SIP/2.0 401 Unauthorized

аа Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75

аа From: "4623" <sip:4623@xx.xx.xx.xx>

аа To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F

аа Call-ID: 1757394

аа CSeq: 1 REGISTER

аа User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca

аа Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE

аа Supported: timer, precondition, path, replaces

аа WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"

аа Content-Length: 0

а

аа ------------------------------------------------------------------------

recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:

аа ------------------------------------------------------------------------

аа REGISTER sip:xx.xx.xx.xx SIP/2.0

аа Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport

аа Content-Length: 0

аа From: "4623" <sip:4623@xx.xx.xx.xx>

аа Accept: application/sdp

аа User-Agent: friendly-scanner

аа To: "4623" <sip:4623@xx.xx.xx.xx>

аа Contact: sip:123@1.1.1.1

аа CSeq: 1 REGISTER

аа Call-ID: 2727970266

аа Max-Forwards: 70

а

аа ------------------------------------------------------------------------

2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75

send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:

аа ------------------------------------------------------------------------

аа SIP/2.0 401 Unauthorized

аа Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75

аа From: "4623" <sip:4623@xx.xx.xx.xx>

аа To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB

аа Call-ID: 2727970266

аа CSeq: 1 REGISTER

аа User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca

аа Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE

аа Supported: timer, precondition, path, replaces

аа WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"

аа Content-Length: 0

Phil Quesinberry

Q Systems Engineering, Inc.

Electronic Controls and Embedded Systems Development

(410) 969-8002

http://www.qsystemsengineering.com

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org