Just curious, but did you notice that the IP address was internal? 192.168.0.6 - what IP address is that? On Mon, Jan 3, 2011 at 9:34 PM, xuyan yang <xyangni@gmail.com> wrote:
Got it. But if no failure log. fail2ban will not work. So how can we protect fs from this kind of attack besides manually setup firewall rules 1 by 1 on discovery?
On Tue, Jan 4, 2011 at 12:54 AM, Brian West <brian@freeswitch.org> wrote:
Chances are he never received the challenge.. thus never logs an auth failure.
/b
On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org