Automatically don't respond to abnormal registrations
Can anyone describe a way in FS to get rid of crawlers and hackers testing your PBX second by second on the internet?! What is the problem? This is ls of my FS's sqlite db after some annoying behaviours of hackers and crawlers violently done: [root@freeswitch db]# ll total 705580 -rw-r--r-- 1 root root 7168 Sep 29 13:20 callcenter.db -rw-r--r-- 1 root root 14336 Sep 23 10:29 call_limit.db -rw-r--r-- 1 root root 257024 Sep 29 13:56 core.db -rw-r--r-- 1 root root 5120 Sep 29 13:20 fifo.db -rw-r--r-- 1 root root 98304 Sep 24 11:34 sofia_reg_sipinterface_2.db -rw-r--r-- 1 root root 367616 Sep 25 18:31 sofia_reg_sipinterface_3.db -rw-r--r-- 1 root root 500726784 Sep 29 13:56 sofia_reg_sipinterface_5.db -rw-r--r-- 1 root root 221003312 Sep 29 13:56 sofia_reg_sipinterface_5.db-journal -rw-r--r-- 1 root root 16384 Sep 23 10:29 voicemail_default.db [root@freeswitch db]# sofia_reg_sipinterface_5.db belongs to the interface listening on 5060 port. As you see sofia_reg_sipinterface_5.db exceed 500MB of size! and this db has crashed! and leads to drop port 5060 of interfaces. when i ask fs_cli about profiles it tells me: +OK log level [7] freeswitch@internal> sofia status Name Type Data State ================================================================================================= sipinterface_3 profile sip:mod_sofia@192.168.2.73:5080 RUNNING (0) voicemail_1 alias sipinterface_2 ALIASED voicemail_2 alias sipinterface_2 ALIASED sipinterface_2 profile sip:mod_sofia@192.168.2.73:5070 RUNNING (0) ================================================================================================= 2 profiles 2 aliases Which open source firewalls can handle automatically weird sip requests to ban?! Sincerely yours,
http://wiki.freeswitch.org/wiki/Fail2ban On Sunday, September 29, 2013, Sayyed Mohammad Emami Razavi wrote:
Can anyone describe a way in FS to get rid of crawlers and hackers testing your PBX second by second on the internet?! What is the problem? This is ls of my FS's sqlite db after some annoying behaviours of hackers and crawlers violently done: [root@freeswitch db]# ll total 705580 -rw-r--r-- 1 root root 7168 Sep 29 13:20 callcenter.db -rw-r--r-- 1 root root 14336 Sep 23 10:29 call_limit.db -rw-r--r-- 1 root root 257024 Sep 29 13:56 core.db -rw-r--r-- 1 root root 5120 Sep 29 13:20 fifo.db -rw-r--r-- 1 root root 98304 Sep 24 11:34 sofia_reg_sipinterface_2.db -rw-r--r-- 1 root root 367616 Sep 25 18:31 sofia_reg_sipinterface_3.db -rw-r--r-- 1 root root 500726784 Sep 29 13:56 sofia_reg_sipinterface_5.db -rw-r--r-- 1 root root 221003312 Sep 29 13:56 sofia_reg_sipinterface_5.db-journal -rw-r--r-- 1 root root 16384 Sep 23 10:29 voicemail_default.db [root@freeswitch db]#
sofia_reg_sipinterface_5.db belongs to the interface listening on 5060 port.
As you see sofia_reg_sipinterface_5.db exceed 500MB of size! and this db has crashed! and leads to drop port 5060 of interfaces.
when i ask fs_cli about profiles it tells me: +OK log level [7] freeswitch@internal> sofia status Name Type Data State
================================================================================================= sipinterface_3 profile sip:mod_sofia@192.168.2.73:5080 RUNNING (0) voicemail_1 alias sipinterface_2 ALIASED voicemail_2 alias sipinterface_2 ALIASED sipinterface_2 profile sip:mod_sofia@192.168.2.73:5070 RUNNING (0)
================================================================================================= 2 profiles 2 aliases
Which open source firewalls can handle automatically weird sip requests to ban?!
Sincerely yours,
these iptables rules work for me: http://txlab.wordpress.com/2013/06/29/protecting-a-vpbx-from-dos-attacks/ They reduce the CPU usage quite dramatically, still keeping the system operational. ________________________________ From: Sayyed Mohammad Emami Razavi <emamirazavi@gmail.com> To: freeswitch-users@lists.freeswitch.org; freeswitch-dev@lists.freeswitch.org Sent: Sunday, September 29, 2013 1:14 PM Subject: [Freeswitch-users] Automatically don't respond to abnormal registrations Can anyone describe a way in FS to get rid of crawlers and hackers testing your PBX second by second on the internet?! What is the problem? This is ls of my FS's sqlite db after some annoying behaviours of hackers and crawlers violently done: [root@freeswitch db]# ll total 705580 -rw-r--r-- 1 root root 7168 Sep 29 13:20 callcenter.db -rw-r--r-- 1 root root 14336 Sep 23 10:29 call_limit.db -rw-r--r-- 1 root root 257024 Sep 29 13:56 core.db -rw-r--r-- 1 root root 5120 Sep 29 13:20 fifo.db -rw-r--r-- 1 root root 98304 Sep 24 11:34 sofia_reg_sipinterface_2.db -rw-r--r-- 1 root root 367616 Sep 25 18:31 sofia_reg_sipinterface_3.db -rw-r--r-- 1 root root 500726784 Sep 29 13:56 sofia_reg_sipinterface_5.db -rw-r--r-- 1 root root 221003312 Sep 29 13:56 sofia_reg_sipinterface_5.db-journal -rw-r--r-- 1 root root 16384 Sep 23 10:29 voicemail_default.db [root@freeswitch db]# sofia_reg_sipinterface_5.db belongs to the interface listening on 5060 port. As you see sofia_reg_sipinterface_5.db exceed 500MB of size! and this db has crashed! and leads to drop port 5060 of interfaces. when i ask fs_cli about profiles it tells me: +OK log level [7] freeswitch@internal> sofia status Name Type Data State ================================================================================================= sipinterface_3 profile sip:mod_sofia@192.168.2.73:5080 RUNNING (0) voicemail_1 alias sipinterface_2 ALIASED voicemail_2 alias sipinterface_2 ALIASED sipinterface_2 profile sip:mod_sofia@192.168.2.73:5070 RUNNING (0) ================================================================================================= 2 profiles 2 aliases Which open source firewalls can handle automatically weird sip requests to ban?! Sincerely yours, _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 09/29/2013 04:45 PM, Stanislav Sinyagin wrote:
these iptables rules work for me: http://txlab.wordpress.com/2013/06/29/protecting-a-vpbx-from-dos-attacks/ They reduce the CPU usage quite dramatically, still keeping the system operational.
Afaik RHEL/CentOS does not have a package iptables-persistent so this solution seems Debian/Ubuntu specific. Regards, Patrick
I do not know if anyone has seen this. I use spa8000 ata's to provide sip trunking to a freeswitch an onwards. Over the past three days I have had someone hacking into the spa8000 and relaying international calls back out. I have no ideal how they do it and cannot find any info in the traces that indicates where the call came from. I have seen a note on cisco's web site about someone else complaining about this but no resolution. My syslog from the spa8000 starts like so. Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc} Any thoughts or ideas would be REALLY appreciated. Darcy Primrose
I don't see the full syslog here, but check to see if there's a call forward number set in the SPA8000? We recently saw an instance where someone set a call forward on an SPA3102, dialed into the 3102 via a different number, and then it was forwarded back out. -Gabe On Mon, Sep 30, 2013 at 1:18 AM, fs <fs@voice2net.ca> wrote:
I do not know if anyone has seen this. I use spa8000 ata's to provide sip trunking to a freeswitch an onwards. Over the past three days I have had someone hacking into the spa8000 and relaying international calls back out. I have no ideal how they do it and cannot find any info in the traces that indicates where the call came from. I have seen a note on cisco's web site about someone else complaining about this but no resolution.
My syslog from the spa8000 starts like so.
Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc}
Any thoughts or ideas would be REALLY appreciated.
Darcy Primrose
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks for the reply, the first thing I checked was the call forward on all lines and trunks, nada. I made test calls into every port, it rang thru, so not sure. My next step is to get a tshark of everything in and out of the network. This is a voip only dsl so it should be easy to do. As an interim, we have instituted a pin number for overseas calls with a disable on 4 errors. . Thanks again. Darcy 199.187156 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: SDP RTPMAP 100 --> 255\n 199.188847 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: SDP RTPMAP 101 --> 136\n 199.190438 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [BCC]CallRoute:L1,2,3,401137744616847\n 199.191655 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [BCC]CallRoute:L1,2,3,401137744616847\n 199.199951 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: pri-->INVITE-->pub\n 199.200916 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: pri-->INVITE-->pub\n 199.202721 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@my.company.ca:0\n 199.215750 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(985)\n 199.217288 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(985)\n 199.228906 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog INVITE sip:01137744616847@my.company.ca SIP/2.0\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>\r\nRemote-Party-ID: "ivory dental" <sip:6132161111@my.company.ca>;screen=yes;party=calling\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nMax-Forwards: 70\r\nContact: "ivory dental" <sip:6132161111@xx.xxx.xxx.41:16598>\r\nExpires: 240\r\nUser-Agent: Linksys/SPA8000-6.1.12\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 265\r\nAllow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER\r\nSupported: x-sipura, replaces\r\nContent-Type: application/sdp\r\n\r\nv=0\r\no=- 81044819 81045805 IN IP4 10.10.1.63\r\ns=eyeBeam\r\nc=IN IP4 10.10.1.63\r\nt=0 0\r\nm=audio 8382 RTP/AVP 100 6 0 8 3 18 5 101\r\na=alt:1 1 : FC106A37 000000A7 10.10.1.63 8382\r\na=fmtp:101 0-15\r\na=rtpmap:100 speex/16000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n 199.229774 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.230739 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.236422 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(410)\n 199.238117 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(410)\n 199.243087 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609;rport=16598\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120620T194320Z~a0a9efcf02+unclean~20130121T043106Z\r\nContent-Length: 0\r\n\r\n 199.244280 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.245238 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.246773 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(903)\n 199.248491 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(903)\n 199.259707 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog SIP/2.0 407 Proxy Authentication Required\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609;rport=16598\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>;tag=2BXmFrcQ9v74Q\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120620T194320Z~a0a9efcf02+unclean~20130121T043106Z\r\nAccept: application/sdp\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE\r\nSupported: timer, precondition, path, replaces\r\nAllow-Events: talk, hold, presence, dialog, line-seize, call-info, sla, include-session-description, presence.winfo, message-summary, refer\r\nProxy-Authenticate: Digest realm="my.company.ca", nonce="63bcc7dc-298c-11e3-807c-17c4d7454b29", algorithm=MD5, qop="auth"\r\nContent-Length: 0\r\n\r\n 199.260840 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.261745 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.269739 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(497)\n 199.271381 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(497)\n 199.277953 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog ACK sip:01137744616847@my.company.ca SIP/2.0\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>;tag=2BXmFrcQ9v74Q\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 ACK\r\nMax-Forwards: 70\r\nContact: "ivory dental" <sip:6132161111@xx.xxx.xxx.41:16598>\r\nUser-Agent: Linksys/SPA8000-6.1.12\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 0\r\n\r\n ----- Original Message ----- From: Gabe Shepard To: FreeSWITCH Users Help Sent: Monday, September 30, 2013 9:52 AM Subject: Re: [Freeswitch-users] spa8000 hack I don't see the full syslog here, but check to see if there's a call forward number set in the SPA8000? We recently saw an instance where someone set a call forward on an SPA3102, dialed into the 3102 via a different number, and then it was forwarded back out. -Gabe On Mon, Sep 30, 2013 at 1:18 AM, fs <fs@voice2net.ca> wrote: I do not know if anyone has seen this. I use spa8000 ata's to provide sip trunking to a freeswitch an onwards. Over the past three days I have had someone hacking into the spa8000 and relaying international calls back out. I have no ideal how they do it and cannot find any info in the traces that indicates where the call came from. I have seen a note on cisco's web site about someone else complaining about this but no resolution. My syslog from the spa8000 starts like so. Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc} Any thoughts or ideas would be REALLY appreciated. Darcy Primrose _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ No virus found in this message. Checked by AVG - www.avg.com Version: 2014.0.4142 / Virus Database: 3604/1 - Release Date: 09/24/13
participants (6)
-
fs
-
Gabe Shepard
-
Patrick Lists
-
Sayyed Mohammad Emami Razavi
-
Stanislav Sinyagin
-
Steven Ayre