On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break
into our system and call external premium rate numbers
Unwanted registers we can block already, but we still have the issue
to block specific invites from fraudulent IPs inside the iptables
firewall.
In the Freeswitch log we see:
2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New
Channel sofia/internal/149@10.11.12.13
[167bb9ee-c8d0-11e4-9f31-b39e581405c5]
2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send
signal sofia/internal/149@10.11.12.13 [BREAK]
2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send
signal sofia/internal/149@10.11.12.13 [BREAK]
2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472
(sofia/internal/149@10.11.12.13) Running State Change CS_NEW
2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841
sofia/internal/149@10.11.12.13 receiving invite from
155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z
64bit
2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26
Rejected by acl "domains". Falling back to Digest auth.
2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491
(sofia/internal/149@10.11.12.13) State NEW
2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send
signal sofia/internal/149@10.11.12.13 [BREAK]
2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session
167bb9ee-c8d0-11e4-9f31-b39e581405c5
2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572
167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13
Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The
IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch
then sends "authentication required". Freeswitch then logs this
entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the
fraudulent IP 15.194.164.26 and some text like "abandonned"?
Example for extending a current log line
2015-03-12 16:54:48.461568 [WARNING]
switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5
sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26
This would enable us to process this entry with fail2ban and block
this IP in the Firewall.
Any other hint is welcome.
--
With kind regards
Marvin Keil
Telefaks Services GmbH
mailto:lists (att) telefaks.de
Internet: www.telefaks.de
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org