Brute-force attack
Hi I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious? There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch. Thanks O
If you are only connecting to specified SIP providers, then you could specify those endpoints at the firewall level, which would help. Regards Bob> Date: Thu, 14 Jun 2012 10:27:50 +0800
From: ocset@the800group.com To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] Brute-force attack
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
Thanks Bob The reason for opening the port would be to allow a user running a "Viop phone" app on their smartphone to register with Freeswitch, so that calls can be transferred to them when they are away from the office. Regards O On 14/06/12 10:41, Bob Coleman wrote:
If you are only connecting to specified SIP providers, then you could specify those endpoints at the firewall level, which would help.
Regards
Bob
Date: Thu, 14 Jun 2012 10:27:50 +0800 From: ocset@the800group.com To: freeswitch-users@lists.freeswitch.org Subject: [Freeswitch-users] Brute-force attack
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Strong passwords are a great start, but fail2ban does a little more than this. you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced. Jay On 14 June 2012 12:27, ocset <ocset@the800group.com> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165 -Avi On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance. Thank you. On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net> wrote:
That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165
-Avi
On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com Email: shaheryarkh@googlemail.com
I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure. Lots has happened since Windows 95 :) Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon... /Peter 14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" <shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com>>: I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance. Thank you. On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net<mailto:avi@avimarcus.net>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165 -Avi On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com<mailto:jaybinks@gmail.com>> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com<mailto:ocset@the800group.com>> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com<mailto:shari_786pk@hotmail.com> Email: shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org !DSPAM:4fd978c432761360223007!
I would suggest to create separate profile for remote workers. For example, external-road-warrios. So you can play with ext-rtp-ip and ext-sip-ip. 2012/6/14 Peter Olsson <peter.olsson@visionutveckling.se>
I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure.
Lots has happened since Windows 95 :)
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" <shaheryarkh@googlemail.com <mailto:shaheryarkh@googlemail.com>>:
I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance.
Thank you.
On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net<mailto: avi@avimarcus.net>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165
-Avi
On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com<mailto: jaybinks@gmail.com>> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com<mailto: ocset@the800group.com>> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com<mailto:shari_786pk@hotmail.com> Email: shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
!DSPAM:4fd978c432761360223007!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Anton I know nothing about ext-rtp-ip and ext-sip-ip. Could you please explain how this will help in making the system more secure? Thanks O On 14/06/12 16:27, Anton Kvashenkin wrote:
I would suggest to create separate profile for remote workers. For example, external-road-warrios. So you can play with ext-rtp-ip and ext-sip-ip.
2012/6/14 Peter Olsson <peter.olsson@visionutveckling.se <mailto:peter.olsson@visionutveckling.se>>
I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure.
Lots has happened since Windows 95 :)
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" <shaheryarkh@googlemail.com <mailto:shaheryarkh@googlemail.com><mailto:shaheryarkh@googlemail.com <mailto:shaheryarkh@googlemail.com>>>:
I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance.
Thank you.
On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net <mailto:avi@avimarcus.net><mailto:avi@avimarcus.net <mailto:avi@avimarcus.net>>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165
-Avi
On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com <mailto:jaybinks@gmail.com><mailto:jaybinks@gmail.com <mailto:jaybinks@gmail.com>>> wrote: > Strong passwords are a great start, but fail2ban does a little more than > this. > > you could move off port 5060 to something un-conventional, meaning your less > likely to get scanned / brute forced. > > Jay > > On 14 June 2012 12:27, ocset <ocset@the800group.com <mailto:ocset@the800group.com><mailto:ocset@the800group.com <mailto:ocset@the800group.com>>> wrote: >> >> Hi >> >> I have deployed Freeswiitch on windows 7 and since there is no fail2ban >> on windows, I was wondering what the real risk is with opening it up to >> the internet. If I was to ensure that all users and passwords were >> extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what >> are the risks that I am exposing myself to? Is there a type of DoS for >> voip where hackers can just flood my system with requests simply to be >> malicious? >> >> There are VB windows scripts available that emulate what fail2ban does >> on Linux but I was just wondering whether I really need to implement >> this level of security if I can control the password complexity in >> Freeswitch. >> >> Thanks >> O >> >> >> _________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org><mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >> http://www.freeswitchsolutions.com >> >> FreeSWITCH-powered IP PBX: The CudaTel Communication Server >> http://www.cudatel.com >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org >> http://wiki.freeswitch.org >> http://www.cluecon.com >> >> Join Us At ClueCon - Aug 7-9, 2012 >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org><mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> http://www.freeswitch.org > > > > > -- > Sincerely > > Jay > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org <mailto:consulting@freeswitch.org><mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> > http://www.freeswitchsolutions.com > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > http://www.cudatel.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://wiki.freeswitch.org > http://www.cluecon.com > > Join Us At ClueCon - Aug 7-9, 2012 > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org><mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org><mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org><mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com <mailto:shari_786pk@hotmail.com><mailto:shari_786pk@hotmail.com <mailto:shari_786pk@hotmail.com>> Email: shaheryarkh@googlemail.com <mailto:shaheryarkh@googlemail.com><mailto:shaheryarkh@googlemail.com <mailto:shaheryarkh@googlemail.com>> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org><mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org><mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
!DSPAM:4fd978c432761360223007!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
For example, you don't need to open 5060 port to a whole world, just 5090 (the port you use for connecting road warriors). http://wiki.freeswitch.org/wiki/Nat http://wiki.freeswitch.org/wiki/External_profile 2012/6/14 ocset <ocset@the800group.com>
Anton
I know nothing about ext-rtp-ip and ext-sip-ip. Could you please explain how this will help in making the system more secure?
Thanks O
On 14/06/12 16:27, Anton Kvashenkin wrote:
I would suggest to create separate profile for remote workers. For example, external-road-warrios. So you can play with ext-rtp-ip and ext-sip-ip.
2012/6/14 Peter Olsson <peter.olsson@visionutveckling.se>
I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure.
Lots has happened since Windows 95 :)
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" < shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com>>:
I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance.
Thank you.
On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net<mailto: avi@avimarcus.net>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165
-Avi
On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com<mailto: jaybinks@gmail.com>> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com<mailto: ocset@the800group.com>> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com<mailto:shari_786pk@hotmail.com> Email: shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
!DSPAM:4fd978c432761360223007!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It IS possible to use windows 7 powershell scripts run on a schedule to dynamically add and remove firewall rules, it's something a firend and I did before for RDP. The RDP version is here: http://www.jonsdocs.org.uk/wiki/index.php/PSLogonFailures I'm sure with a little tweaking it can be made to work with freeswitch log files. On 14 June 2012 11:58, Anton Kvashenkin <anton.jugatsu@gmail.com> wrote:
For example, you don't need to open 5060 port to a whole world, just 5090 (the port you use for connecting road warriors). http://wiki.freeswitch.org/wiki/Nat http://wiki.freeswitch.org/wiki/External_profile
2012/6/14 ocset <ocset@the800group.com>
Anton
I know nothing about ext-rtp-ip and ext-sip-ip. Could you please explain how this will help in making the system more secure?
Thanks O
On 14/06/12 16:27, Anton Kvashenkin wrote:
I would suggest to create separate profile for remote workers. For example, external-road-warrios. So you can play with ext-rtp-ip and ext-sip-ip.
2012/6/14 Peter Olsson <peter.olsson@visionutveckling.se>
I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure.
Lots has happened since Windows 95 :)
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" < shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com>>:
I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance.
Thank you.
On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net<mailto: avi@avimarcus.net>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165
-Avi
On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com<mailto: jaybinks@gmail.com>> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com<mailto: ocset@the800group.com>> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no
fail2ban
on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com<mailto:shari_786pk@hotmail.com> Email: shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto: FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
!DSPAM:4fd978c432761360223007!
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Andrew Cassidy BSc (Hons) MBCS SSCA* Managing Director *T <info@cassidywebservices.co.uk> *03300 100 960 *F<info@cassidywebservices.co.uk> *03300 100 961 *E <info@cassidywebservices.co.uk> *andrew@cassidywebservices.co.uk *W <info@cassidywebservices.co.uk> *www.cassidywebservices.co.uk
The problem with that, is it's parsing the windows event log. You could add scripts/code to FS to write failures to the application event log (or a custom one), but that's a lot more work then just putting all the code to do it all in a managed DLL that can be invoked via mod_managed. No external processes, no invoking PowerShelll or WScript/CScript. On another note, if you want to do this w/ external scripts or other external methods of interfacing w/ freeswitch, you may want to play with the RC (RTM is about 60 days away) of Windows 8/Server 2012. WMF 3.0 (Windows Managment Framework 3.0) has been extended so that the HTTP interfaces which were only SOAP WS-Managment in v2, have been extended to more endpoints, including REST/XML and OData (www.odata.org like the google or Netflix APIs). This makes it easy to do directly from any scripting language or external system. --Dave _____ From: Andrew Cassidy [mailto:andrew@cassidywebservices.co.uk] To: FreeSWITCH Users Help [mailto:freeswitch-users@lists.freeswitch.org] Sent: Thu, 14 Jun 2012 04:29:23 -0700 Subject: Re: [Freeswitch-users] Brute-force attack It IS possible to use windows 7 powershell scripts run on a schedule to dynamically add and remove firewall rules, it's something a firend and I did before for RDP. The RDP version is here: http://www.jonsdocs.org.uk/wiki/index.php/PSLogonFailures I'm sure with a little tweaking it can be made to work with freeswitch log files. On 14 June 2012 11:58, Anton Kvashenkin <anton.jugatsu@gmail.com> wrote: For example, you don't need to open 5060 port to a whole world, just 5090 (the port you use for connecting road warriors). http://wiki.freeswitch.org/wiki/Nat http://wiki.freeswitch.org/wiki/External_profile 2012/6/14 ocset <ocset@the800group.com> Anton I know nothing about ext-rtp-ip and ext-sip-ip. Could you please explain how this will help in making the system more secure? Thanks O On 14/06/12 16:27, Anton Kvashenkin wrote: I would suggest to create separate profile for remote workers. For example, external-road-warrios. So you can play with ext-rtp-ip and ext-sip-ip. 2012/6/14 Peter Olsson <peter.olsson@visionutveckling.se> I use both Windows and Linux systems. As long as you know how to manage both systems, there is not a big difference when it comes to exploits and general security (not anymore anyway, if you use current versions). I would say that the biggest issue here is the knowledge of the people managing the systems. And it's usually more secure to manage a system that you know, then a system you don't know much about, even though that system is considered to be more secure. Lots has happened since Windows 95 :) Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon... /Peter 14 jun 2012 kl. 07:51 skrev "Muhammad Shahzad" <shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com>>: I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance. Thank you. On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net<mailto:avi@avimarcus.net>> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165 -Avi On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com<mailto:jaybinks@gmail.com>> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com<mailto:ocset@the800group.com>> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org>
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org>
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org>
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org>
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com<mailto:shari_786pk@hotmail.com> Email: shaheryarkh@googlemail.com<mailto:shaheryarkh@googlemail.com> !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org !DSPAM:4fd978c432761360223007! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Andrew Cassidy BSc (Hons) MBCS SSCA Managing Director T 03300 100 960 F 03300 100 961 E andrew@cassidywebservices.co.uk W www.cassidywebservices.co.uk
Hey .. On 14 June 2012 16:16, Peter Olsson <peter.olsson@visionutveckling.se>wrote:
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
if you do get round to writing something like this let me know. ( not that I even have a windows box ) but when I wrote the patches for FS to do the Fail2Ban compatible logging, I created ESL Events also with the intention that we could do a FS module "mod_security" or something ( no time given to the name ) it would be fairly simple to move some of the fail2ban functionality into such a module that could either call out to simple scripts or insert firewall rules its self. I have some ideas here, and I would probably be interested in working on this with others. Jay
If you are looking for a fail2ban equivalent on Windows, how about this script http://serverfault.com/questions/43360/cygwin-sshd-autoblock-failed-logins/4... I have not tried it but it may be a good starting point for something to use with Freeswitch Regards O On 14/06/12 17:55, jay binks wrote:
Hey ..
On 14 June 2012 16:16, Peter Olsson <peter.olsson@visionutveckling.se <mailto:peter.olsson@visionutveckling.se>> wrote:
Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon...
/Peter
if you do get round to writing something like this let me know. ( not that I even have a windows box ) but when I wrote the patches for FS to do the Fail2Ban compatible logging, I created ESL Events also with the intention that we could do a FS module "mod_security" or something ( no time given to the name )
it would be fairly simple to move some of the fail2ban functionality into such a module that could either call out to simple scripts or insert firewall rules its self.
I have some ideas here, and I would probably be interested in working on this with others.
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I already have implmented this a while ago, however it's burried in a product. Now that I see there is some interest, I can pull it out, and make it a standalone module. It's implmented in a C# module which runs under mod_managed. Has a single IApiPlugin class so that mod_managed will keep it loaded, and so you have an API command to shut it down, so you can replace it while it's running, and another static class that implments INotifyPluginLoaded to start a thread that sits in an EventConsumer loop. The tracking of failures is done by updating a Dictionary<String, myTrakingClass>() where the Key is the IP address as a string. Since it's very easy to call any WMI/CIMV2 queries/updates from managed code, it can just add and remove either IPSEC filter, or Advanced firewall rules directly. If you all would like me to do this, please respond. The more the response, the higher it will be on my priority list. --Dave _____ From: jay binks [mailto:jaybinks@gmail.com] To: FreeSWITCH Users Help [mailto:freeswitch-users@lists.freeswitch.org] Sent: Thu, 14 Jun 2012 02:55:50 -0700 Subject: Re: [Freeswitch-users] Brute-force attack Hey .. On 14 June 2012 16:16, Peter Olsson <peter.olsson@visionutveckling.se> wrote: Anyway, for this kind of setup I would also prefer Linux, but mostly for the possibilites with fail2ban etc, which doesn't exist on Windows. I'm thinking of writiling something similar for Windows, hopefully I get som time for that soon... /Peter if you do get round to writing something like this let me know. ( not that I even have a windows box ) but when I wrote the patches for FS to do the Fail2Ban compatible logging, I created ESL Events also with the intention that we could do a FS module "mod_security" or something ( no time given to the name ) it would be fairly simple to move some of the fail2ban functionality into such a module that could either call out to simple scripts or insert firewall rules its self. I have some ideas here, and I would probably be interested in working on this with others. Jay
Thanks Dave, This would be a great contribution for windows users. I would be happy to help is any way that I can. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Brute-force-attack-tp7579813p7... Sent from the freeswitch-users mailing list archive at Nabble.com.
Our System runs on Windows on a hosted dedicated server since 4 years without problems. So I think the choice is not Linux or Windows, the right choice is where you have your knowledge. Windows is also absolute secure if you know which settings are important for a good security. Kind regards Erkan From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Muhammad Shahzad Sent: Thursday, June 14, 2012 8:46 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Brute-force attack I would strongly suggest to move your production system to Linux, which is by far secure and controllable then Windows. Right now, if somebody does not breaks into your voip setup using some bruteforce / DOS attack, s/he can still exploit some hole in Windows to crack your security. Windows is simply not secure enough to production grade performance. Thank you. On Thu, Jun 14, 2012 at 6:39 AM, Avi Marcus <avi@avimarcus.net> wrote: That's not necessarily the best kind of password... see http://xkcd.com/936/ and then http://tech.dropbox.com/?p=165 -Avi On Thu, Jun 14, 2012 at 6:23 AM, jay binks <jaybinks@gmail.com> wrote:
Strong passwords are a great start, but fail2ban does a little more than this.
you could move off port 5060 to something un-conventional, meaning your less likely to get scanned / brute forced.
Jay
On 14 June 2012 12:27, ocset <ocset@the800group.com> wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Muhammad Shahzad ----------------------------------- CISCO Rich Media Communication Specialist (CRMCS) CISCO Certified Network Associate (CCNA) Cell: +92 334 422 40 88 MSN: shari_786pk@hotmail.com Email: shaheryarkh@googlemail.com
I have run into this same problem with win2003. You may need to check to see if windows 7 has IPSEC service. If so, you can set up a blocked list in ipsec that you can add ip addresses to and windows won't let them into your machine. Click on Start menu choose Administrative Tools choose Services Find IPSEC Services - double click to open properties - make sure it is set to Automatic and started. You can create the block list by issuing the following commands from a command window: netsh ipsec static add filteraction name=Block action=block netsh ipsec static add filter filterlist=BlockList srcaddr=192.168.192.100 dstaddr=me netsh ipsec static add policy name=Block assign=yes activatedefaultrule=no netsh ipsec static add rule name=BlockList policy=Block filterlist=BlockList filteraction=Block netsh ipsec static delete filter filterlist=BlockList srcaddr=192.168.192.100 dstaddr=Me create a directory called blockip now in notepad create blockip.bat with the following line in it: netsh ipsec static add filter filterlist=BlockList srcaddr=%1 dstaddr=me Now , in notepad, createunblockip.bat with the following line in it: netsh ipsec static delete filter filterlist=BlockList srcaddr=%1 dstaddr=me to block ip address 123.123.123.123 type blockip 123.123.123.123 at a command prompt. to unblock ip address 123.123.123.123 type unblockip 123.123.123.123 at a command prompt. You can use xml_curl to keep track of hit frequency and do the blocking for you. hope that helps.... jack On 6/13/2012 7:27 PM, ocset wrote:
Hi
I have deployed Freeswiitch on windows 7 and since there is no fail2ban on windows, I was wondering what the real risk is with opening it up to the internet. If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
There are VB windows scripts available that emulate what fail2ban does on Linux but I was just wondering whether I really need to implement this level of security if I can control the password complexity in Freeswitch.
Thanks O
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Wed, Jun 13, 2012 at 8:27 PM, ocset <ocset@the800group.com> wrote:
If I was to ensure that all users and passwords were extremely difficult to guess (passwords like "2$53E_d7?^2!3s$"), what are the risks that I am exposing myself to? Is there a type of DoS for voip where hackers can just flood my system with requests simply to be malicious?
If you happen to be using mod_xml_curl for your directory look ups, the dumb dictionary attack can really hurt. If you have strong passwords, it might not be them getting access to the system that you'll need to worry about. It's more likely getting your web and db servers hammered that you'll need to worry about :) Gabe
participants (13)
-
Andrew Cassidy
-
Anton Kvashenkin
-
Avi Marcus
-
Bob Coleman
-
Dave R. Kompel
-
Erkan Ünlü (simalube)
-
Gabriel Gunderson
-
Jack
-
jay binks
-
Jeff Lenk
-
Muhammad Shahzad
-
ocset
-
Peter Olsson