Fail to ban rule for detecting INVITES with no challenge
Hello, we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall. In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server. The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it. So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall. Any other hint is welcome. -- With kind regards Marvin Keil Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de
Have you tried mod_fail2ban? On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de
------------------------------------------------------------------------
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my Android device with K-9 Mail. Please excuse my brevity.
Version? I'm almost sure this is already implemented in master. Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com> escreveu:
Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
------------------------------
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my Android device with K-9 Mail. Please excuse my brevity.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master. Sergey On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <italorossib@gmail.com> wrote:
Version?
I'm almost sure this is already implemented in master. Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com> escreveu:
Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
------------------------------
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my Android device with K-9 Mail. Please excuse my brevity.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I set the JIRA status as Needs Review, hope it get merged soon. On Thu, Mar 12, 2015 at 4:03 PM, Sergey Safarov <s.safarov@gmail.com> wrote:
Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master.
Sergey
On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <italorossib@gmail.com> wrote:
Version?
I'm almost sure this is already implemented in master. Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com> escreveu:
Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
------------------------------
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my Android device with K-9 Mail. Please excuse my brevity.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ítalo Rossi
Is there a pull request on that? On 3/12/15, 1:27 PM, "Ítalo Rossi" <italorossib@gmail.com> wrote:
I set the JIRA status as Needs Review, hope it get merged soon.
On Thu, Mar 12, 2015 at 4:03 PM, Sergey Safarov <s.safarov@gmail.com> wrote:
Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master.
Sergey
On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <italorossib@gmail.com> wrote:
Version?
I'm almost sure this is already implemented in master.
Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com> escreveu:
Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 <http://155.94.64.26:5076> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch Twitter: @FreeSWITCH
Ken pull request has been created https://freeswitch.org/stash/projects/FS/repos/freeswitch/pull-requests/159/... Mike rightly said that it is necessary to use a variable network_addr in caller profile On Thu, Mar 12, 2015 at 11:46 PM, Ken Rice <krice@freeswitch.org> wrote:
Is there a pull request on that?
On 3/12/15, 1:27 PM, "Ítalo Rossi" <italorossib@gmail.com> wrote:
I set the JIRA status as Needs Review, hope it get merged soon.
On Thu, Mar 12, 2015 at 4:03 PM, Sergey Safarov <s.safarov@gmail.com> wrote:
Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master.
Sergey
On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <italorossib@gmail.com> wrote:
Version?
I'm almost sure this is already implemented in master.
Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com> escreveu:
Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 < http://155.94.64.26:5076> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- Ken
*http://www.FreeSWITCH.org <http://www.FreeSWITCH.org> http://www.ClueCon.com <http://www.ClueCon.com> http://www.OSTAG.org <http://www.OSTAG.org> *irc.freenode.net #freeswitch Twitter: @FreeSWITCH
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I want to understand why that variable is not populated and see if it can be instead of adding a new channel variable, correct.
On Mar 12, 2015, at 4:02 PM, Sergey Safarov <s.safarov@gmail.com> wrote:
Ken pull request has been created https://freeswitch.org/stash/projects/FS/repos/freeswitch/pull-requests/159/... <https://freeswitch.org/stash/projects/FS/repos/freeswitch/pull-requests/159/overview> Mike rightly said that it is necessary to use a variable network_addr in caller profile
On Thu, Mar 12, 2015 at 11:46 PM, Ken Rice <krice@freeswitch.org <mailto:krice@freeswitch.org>> wrote: Is there a pull request on that?
On 3/12/15, 1:27 PM, "Ítalo Rossi" <italorossib@gmail.com <http://italorossib@gmail.com/>> wrote:
I set the JIRA status as Needs Review, hope it get merged soon.
On Thu, Mar 12, 2015 at 4:03 PM, Sergey Safarov <s.safarov@gmail.com <http://s.safarov@gmail.com/>> wrote: Ítalo I am not rewrite patch set use network_addr in caller profile and path not merget to master.
Sergey
On Thu, Mar 12, 2015 at 7:51 PM, Ítalo Rossi <italorossib@gmail.com <http://italorossib@gmail.com/>> wrote:
Version?
I'm almost sure this is already implemented in master.
Em 12/03/2015 13:43, "Kyle King" <kyle.king@quentustech.com <http://kyle.king@quentustech.com/>> escreveu: Have you tried mod_fail2ban?
On March 12, 2015 12:28:16 PM EDT, Peter Steinbach <lists@telefaks.de <http://lists@telefaks.de/>> wrote: Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>[167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>[BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>[BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>receiving invite from 155.94.64.26:5076 <http://155.94.64.26:5076/><http://155.94.64.26:5076 <http://155.94.64.26:5076/>> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>[BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <http://sofia/internal/149@10.11.12.13>Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
Check <param name="log-auth-failures" value="true"/> is on your sofia profiles. There should be a message when the challenge is sent and when the call is abandoned. It's not the 'Abandoned' switch_core_state_machine.c one but one coming from sofia_reg.c. On 12 March 2015 at 16:28, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks Steven i've put stat into the internal and external profile now. I will later look at the output. On 03/12/15 18:36, Steven Ayre wrote:
Check <param name="log-auth-failures" value="true"/> is on your sofia profiles. There should be a message when the challenge is sent and when the call is abandoned. It's not the 'Abandoned' switch_core_state_machine.c one but one coming from sofia_reg.c.
On 12 March 2015 at 16:28, Peter Steinbach <lists@telefaks.de <mailto:lists@telefaks.de>> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13>) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> receiving invite from 155.94.64.26:5076 <http://155.94.64.26:5076> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13>) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbH mailto:lists (att) telefaks.de <http://telefaks.de> Internet: www.telefaks.de <http://www.telefaks.de>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- With kind regards Peter Steinbach Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de
Marvin you can use solution published at https://freeswitch.org/jira/browse/FS-7125 https://freeswitch.org/stash/projects/FS/repos/freeswitch/commits/63a622decc... Currently I successfully block that calls On Thu, Mar 12, 2015 at 7:28 PM, Peter Steinbach <lists@telefaks.de> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 ( sofia/internal/149@10.11.12.13) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 receiving invite from 155.94.64.26:5076 version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 ( sofia/internal/149@10.11.12.13) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbHmailto:lists <lists> (att) telefaks.de Internet: www.telefaks.de
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks Sergey i've installed it. That was rather simple. I will look at the output in some next hours. On 03/12/15 19:44, Sergey Safarov wrote:
Marvin you can use solution published at https://freeswitch.org/jira/browse/FS-7125 https://freeswitch.org/stash/projects/FS/repos/freeswitch/commits/63a622decc...
Currently I successfully block that calls
On Thu, Mar 12, 2015 at 7:28 PM, Peter Steinbach <lists@telefaks.de <mailto:lists@telefaks.de>> wrote:
Hello,
we receive a number of Invites from certain IPs, who want to break into our system and call external premium rate numbers Unwanted registers we can block already, but we still have the issue to block specific invites from fraudulent IPs inside the iptables firewall.
In the Freeswitch log we see: 2015-03-12 16:54:38.381552 [NOTICE] switch_channel.c:1055 New Channel sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [167bb9ee-c8d0-11e4-9f31-b39e581405c5] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.381552 [DEBUG] switch_core_state_machine.c:472 (sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13>) Running State Change CS_NEW 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:8841 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> receiving invite from 155.94.64.26:5076 <http://155.94.64.26:5076> version: 1.5.15b git 82f267a 2015-02-16 22:59:55Z 64bit 2015-03-12 16:54:38.381552 [DEBUG] sofia.c:9008 IP 15.194.164.26 Rejected by acl "domains". Falling back to Digest auth. 2015-03-12 16:54:38.441582 [DEBUG] switch_core_state_machine.c:491 (sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13>) State NEW 2015-03-12 16:54:38.441582 [DEBUG] switch_core_session.c:1061 Send signal sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> [BREAK] 2015-03-12 16:54:38.441582 [DEBUG] sofia.c:2067 detaching session 167bb9ee-c8d0-11e4-9f31-b39e581405c5 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> Abandoned
The fraudulent IP here is 15.194.164.26 (anonymized of course). The IP 10.11.12.13 is the (anonymized) IP of our server.
The point here is: 15.194.164.26 is sending an INVITE, Freeswitch then sends "authentication required". Freeswitch then logs this entry with "Abandoned" (see last line above) and that's it.
So Is there any way to make Freeswitch show up a log line with the fraudulent IP 15.194.164.26 and some text like "abandonned"? Example for extending a current log line 2015-03-12 16:54:48.461568 [WARNING] switch_core_state_machine.c:572 167bb9ee-c8d0-11e4-9f31-b39e581405c5 sofia/internal/149@10.11.12.13 <mailto:sofia/internal/149@10.11.12.13> Abandoned for IP 15.194.164.26 This would enable us to process this entry with fail2ban and block this IP in the Firewall.
Any other hint is welcome.
-- With kind regards Marvin Keil
Telefaks Services GmbH mailto:lists (att) telefaks.de <http://telefaks.de> Internet: www.telefaks.de <http://www.telefaks.de>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- With kind regards Peter Steinbach Telefaks Services GmbH mailto:lists (att) telefaks.de Internet: www.telefaks.de
participants (7)
-
Ken Rice
-
Kyle King
-
Michael Jerris
-
Peter Steinbach
-
Sergey Safarov
-
Steven Ayre
-
Ítalo Rossi