If you are not sure how to secure a box like this down - I sure hope for your sake that your telephony provider has some good anti-fraud measures in place or you have deep pockets and don't mind sending great wads of cash off to your provider(s). You might want to spend a good amount of time coming up to speed with best practice security for boxes which do SIP and are connected to the public Internet. Brent On Mon, Jan 31, 2011 at 1:54 AM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I figured. Same for Fail2Ban I guess. Any suggestions for Windows?
Also I was wondering why it never happened on my 1.0.4 (14460) version (precompiled version)? I had it running for a month 24hrs and had never seen this before. And after starting the Git Head (below) from Yesterday it happened in seconds all 3 times I restarted (restarted the computer to be sure). Maybe something wrong with the current version? To be safe I went back to my stable 1.0.4 version and haven't had any problems.
49a5effcdf2cea9e0ddcf146cf3fe85d1872e654 mod_callcenter: Add error response for queue load and queue reload (FS-2988) Marc Olivier Chouinard 2011-01-29 00:09:06
On Sun, Jan 30, 2011 at 2:10 AM, Peter Olsson < peter.olsson@visionutveckling.se> wrote:
iptables is a Linux command.
/Peter
----- Reply message ----- Från: "Joao Leme" <joaocarlosleme@gmail.com> Datum: sön, jan 30, 2011 13:56 Rubrik: [SPAM] - Re: [Freeswitch-users] Hacker Attack? Till: "FreeSWITCH Users Help" <freeswitch-users@lists.freeswitch.org>
I tried "iptables -I INPUT -s [212.224.71.236] -j DROP" and got " Unknown command: iptables...". Do I must install fail2ban to issue iptables command? I'm on windows 7. Thanks
On Sat, Jan 29, 2011 at 4:26 PM, curriegrad2004 <curriegrad2004@gmail.com <mailto:curriegrad2004@gmail.com>> wrote: iptables -I INPUT -s [hackerip] -j DROP
A better solution is searching the wiki for fail2ban with FreeSwitch.
On Sat, Jan 29, 2011 at 4:20 PM, Joao Leme <joaocarlosleme@gmail.com <mailto:joaocarlosleme@gmail.com>> wrote:
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 < curriegrad2004@gmail.com<mailto:curriegrad2004@gmail.com>> wrote:
Try using iptables and block all incoming traffic from this specific
host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com
<mailto:joaocarlosleme@gmail.com>>
wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
!DSPAM:4d450b3232767678720833!
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- Brent Paddon Director | Over the Wire Pty Ltd brent.paddon@overthewire.com.au | www.overthewire.com.au Phone: 07 3847 9292 | Fax: 07 3847 9696 | Mobile: 0400 2400 54