attack, still no ip address logging
Hi. I was attacked by that famous Friendly scanner, but in the fs logs it did not give the ip address -- I had to put the siptrace on to get the address and dropped all packets. The strange thing was even after dropping the ip address using shorewall, it kept going for a while -- I restarted fs and that seemed to fix things, I am not sure if this was a coincidence or not. I would urge the devs to put the ip address in the request registration or somewhere other than the bad password so fail2ban can be configured to drop the ip address. I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually. -- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
Did you even bother to look on the wiki? http://wiki.freeswitch.org/wiki/Fail2ban /b On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
Hi. I was attacked by that famous Friendly scanner, but in the fs logs it did not give the ip address -- I had to put the siptrace on to get the address and dropped all packets. The strange thing was even after dropping the ip address using shorewall, it kept going for a while -- I restarted fs and that seemed to fix things, I am not sure if this was a coincidence or not.
I would urge the devs to put the ip address in the request registration or somewhere other than the bad password so fail2ban can be configured to drop the ip address.
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it?
John Covici covici@ccs.covici.com
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I have fail2ban installed and the only regexp has to do with invalid passwords. The message I was getting did not have an ip address so fail2ban would not have worked at all. I thought I remembered a discussion on one of the conferences that logging would be improved -- is this wrong? Brian West <brian@freeswitch.org> wrote:
Did you even bother to look on the wiki?
http://wiki.freeswitch.org/wiki/Fail2ban
/b
On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
Hi. I was attacked by that famous Friendly scanner, but in the fs logs it did not give the ip address -- I had to put the siptrace on to get the address and dropped all packets. The strange thing was even after dropping the ip address using shorewall, it kept going for a while -- I restarted fs and that seemed to fix things, I am not sure if this was a coincidence or not.
I would urge the devs to put the ip address in the request registration or somewhere other than the bad password so fail2ban can be configured to drop the ip address.
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it?
John Covici covici@ccs.covici.com
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
Ok my mistake I thought this fail2ban setup did that but its only auth failures to register or invite... But you should also be able to get them into the logs with a few lines of patching.. iptables -A INPUT -p udp --dport 5060 -m limit --limit 5/s --limit-burst 5 -i eth0 -j REJECT Try that iptables rule also. /b On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
Hi. I was attacked by that famous Friendly scanner, but in the fs logs it did not give the ip address -- I had to put the siptrace on to get the address and dropped all packets. The strange thing was even after dropping the ip address using shorewall, it kept going for a while -- I restarted fs and that seemed to fix things, I am not sure if this was a coincidence or not.
I would urge the devs to put the ip address in the request registration or somewhere other than the bad password so fail2ban can be configured to drop the ip address.
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it?
John Covici covici@ccs.covici.com
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Also if you go enable the profile debug you'll get this if (profile->debug) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Send %s for [%s@%s]\n", forbidden ? "forbidden" : "challenge", to_user, to_host); } for every single register also so you can use fail2ban. /b On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
Ahh thanks -- now what level do I need for this to take place? In my external.xml I have <param name="debug" value="7"/> -- is this the correct debug or is there something else? Brian West <brian@freeswitch.org> wrote:
Also if you go enable the profile debug you'll get this
if (profile->debug) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Send %s for [%s@%s]\n", forbidden ? "forbidden" : "challenge", to_user, to_host); }
for every single register also so you can use fail2ban.
/b
On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
Brian West wrote:
Also if you go enable the profile debug you'll get this
if (profile->debug) { switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Send %s for [%s@%s]\n", forbidden ? "forbidden" : "challenge", to_user, to_host); }
for every single register also so you can use fail2ban.
/b
Unfortunately some logging is missing which don't allow to use Fail2Ban effectively. I've added a patch http://jira.freeswitch.org/browse/FS-2943 It allows Fail2ban to monitor all authentication attempts and react properly. It'll be great if some of developers check it asap and apply to the main tree. Dmitry
On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I have commited this: + switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Send %s for [%s@%s] from ip '%s'\n", + forbidden ? "forbidden" : "challenge", to_user, to_host, network_ip); /b On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
Very nice -- this is what I was looking for. Do I need to change anything to get this? Brian West <brian@freeswitch.org> wrote:
I have commited this:
+ switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_DEBUG, "Send %s for [%s@%s] from ip '%s'\n", + forbidden ? "forbidden" : "challenge", to_user, to_host, network_ip);
/b
On Nov 21, 2010, at 8:45 AM, covici@ccs.covici.com wrote:
I don't mean to bother people, but it was a pain and I couldn't make any calls for some time till I fixed things manually.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
So where do I put profile debug -- I have debug as 7 in my external.xml? Brian West <brian@freeswitch.org> wrote:
same thing as my previous email profile debug.
/b
On Nov 21, 2010, at 1:00 PM, covici@ccs.covici.com wrote:
Very nice -- this is what I was looking for. Do I need to change anything to get this?
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
On Sun, Nov 21, 2010 at 11:16 AM, <covici@ccs.covici.com> wrote:
So where do I put profile debug -- I have debug as 7 in my external.xml?
OK, I already had that and so I am getting the message and things are working! The attack did stop, but hopefully I am in better shape. Thanks very much for that fix! Michael Collins <msc@freeswitch.org> wrote:
On Sun, Nov 21, 2010 at 11:16 AM, <covici@ccs.covici.com> wrote:
So where do I put profile debug -- I have debug as 7 in my external.xml?
http://wiki.freeswitch.org/wiki/Sofia.conf.xml#debug
-MC
---------------------------------------------------- Alternatives:
---------------------------------------------------- _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Your life is like a penny. You're going to lose it. The question is: How do you spend it? John Covici covici@ccs.covici.com
participants (4)
-
Brian West
-
covici＠ccs.covici.com
-
Dmitry M
-
Michael Collins