The internal address seems to be the one from which the OPoster tried to be registered, and sent the challenge (and was rejected). The original attempts, that were not rejected (probably because were not sending challenges) were coming from external addresses. -giovanni On 1/4/11, Michael Collins <msc@freeswitch.org> wrote:
Just curious, but did you notice that the IP address was internal? 192.168.0.6 - what IP address is that?
On Mon, Jan 3, 2011 at 9:34 PM, xuyan yang <xyangni@gmail.com> wrote:
Got it. But if no failure log. fail2ban will not work. So how can we protect fs from this kind of attack besides manually setup firewall rules 1 by 1 on discovery?
On Tue, Jan 4, 2011 at 12:54 AM, Brian West <brian@freeswitch.org> wrote:
Chances are he never received the challenge.. thus never logs an auth failure.
/b
On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my mobile device Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618