This little script has been doing a great job for us. #!/bin/bash publicIP=`/sbin/ifconfig eth0 | sed -En 's/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p'` for ip in `grep "Can't find user" /usr/local/freeswitch/var/log/freeswitch/freeswitch.log | grep $publicIP | awk '{print $10}' | sort | uniq` ; do /sbin/iptables -I INPUT -s $ip -m comment --comment "`date` $comment" -j DROP done *Jai Rangi* Cebod Technologies LLC dba DIDforSale/Cebod Telecom O 949-471-0102 | C 949-419-7634 <1-949-419-7634> | F 949-269-0449 / 949-232-1410 | jprangi@didforsale.com www.didforsale.com |2472 Chambers Rd Ste 100, Tustin, CA 92780 On Sun, Jul 26, 2020 at 8:57 PM Don Hawkins <hawkins@hawkinsegroup.com> wrote:
Hey everyone!
So I have quite a few "security" features installed on the server, including custom IP banning methods using IP Tables, (fail2ban caused too many issues).
All endpoints on our system register via a domain, I'm looking for suggestions on how to block IP addresses that attempt to register with the IP address only.
In other words, every time the warning below is received I'd like to ban that particular IP or at least add it to a list somewhere.
WARNING: "You must define a domain called 'XXX.XXX.XX.XXX' in your directory and add a user with the id"
I'm thinking of a custom script that scans the logs (which logs?)
Any advice is appreciated.
Thanks!
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com