This happens all the time. You need fail2ban set up properly. There are articles on both the freeswitch and fusionpbx wikis. I run a public server and I get people doing scans all the time. Does it worry me? No. Of course not. That's what fail2ban and other measures are for. Don't need to get all tinfoil hat about this. On Mar 11, 2012 7:09 PM, "Bzzz" <lazyvirus@gmx.com> wrote:
Hi,
I just setup an FS svr w/ fusionpbx (only ext.+users created), and I found THAT in the FS log:
2012-03-11 16:51:30.795812 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:30.795812 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [88775950945170@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.115813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.115813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [011441212790583@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:31.985813 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:31.985813 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [00441212790587@86.68.18.226] from ip 72.55.156.56 2012-03-11 16:51:33.015828 [DEBUG] sofia.c:7567 IP 72.55.156.56 Rejected by acl "domains". Falling back to Digest auth. 2012-03-11 16:51:33.015828 [WARNING] sofia_reg.c:1422 SIP auth challenge (INVITE) on sofia profile 'internal' for [000441212790581@86.68.18.226] from ip 72.55.156.56
How can this freak reach my svr as I'm in my LAN and my modem box integrates a firewall.
Oook (but not): just checked my box and found that there are 4 uPNP new rules: 0 UDP 5060 192.168.1.25 5060 1 TCP 5060 192.168.1.25 5060 2 UDP 5080 192.168.1.25 5080 3 TCP 5080 192.168.1.25 5080
I understand FS is opening these ports to be reached by external subscribers, but where can I stop it to do so until I made my internal tests, change these ports and limited VoIP to TLS only?
JY -- masturbation, n.: Coming unscrewed.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org