Re: [Freeswitch-users] Security issue

15 Aug 2015

      I face the same a while ago and after some analysts and investigations I applied the below solution which fixes my problem

I did a simple change to the external sip profile which resolved the issue from my point of view.

what I did is I add the below line to the external sip profile, which inform it to valid any request from external system against ACL list.

<param name="apply-inbound-acl" value="domains”/>
...
From: Anthony Minessale <anthony.minessale@gmail.com>
Subject: Re: [Freeswitch-users] Security issue
Date: August 15, 2015 at 5:12:55 PM GMT+3
To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
Reply-To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
The public context is unauthentecared that is why its called public.  Only public facing extensions should be defined there.
The example configs are only a suggestion on how to run your server.  The best approach is to learn how the sofia profiles and contexts work to configure it to your needs.
On Saturday, August 15, 2015, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> wrote:
1) Output network_ip of received INVITE with appropriate comment like "Block for one day ip x.x.x.x"
2) Add fail2ban rule to search strings like "Block for one day ip x.x.x.x" and block ip
On Sat, Aug 15, 2015 at 12:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com <javascript:_e(%7B%7D,'cvml','nzaytsevc@gmail.com');>> wrote:
Hi,all)
I have the freeswitch on public ip with set up fail2ban.
However, there is an external invites which proceed to dialplan's context public.
How can I defend my freeswitch from such attaks?
The log of such attack is in the attachment.
Bets Regards,
Nikolay Zaytsev
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org <javascript:_e(%7B%7D,'cvml','consulting@freeswitch.org');>
http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites
http://www.freeswitch.org <http://www.freeswitch.org/>
http://confluence.freeswitch.org <http://confluence.freeswitch.org/>
http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org <javascript:_e(%7B%7D,'cvml','FreeSWITCH-users@lists.freeswitch.org');>
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>
http://www.freeswitch.org <http://www.freeswitch.org/>
-- 
Anthony Minessale II       ♬ @anthmfs  ♬ @FreeSWITCH  ♬
☞ http://freeswitch.org/ <http://freeswitch.org/>  ☞ http://cluecon.com/ <http://cluecon.com/>  ☞ http://twitter.com/FreeSWITCH <http://twitter.com/FreeSWITCH>
☞ irc.freenode.net <http://irc.freenode.net/> #freeswitch ☞ http://freeswitch.org/g+ <http://freeswitch.org/g+>
ClueCon Weekly Development Call 
☎ sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org>  ☎ +19193869900
https://www.youtube.com/watch?v=9XXgW34t40s <https://www.youtube.com/watch?v=9XXgW34t40s>
https://www.youtube.com/watch?v=NLaDpGQuZDA <https://www.youtube.com/watch?v=NLaDpGQuZDA>
From: Giovanni Maruzzelli <gmaruzz@gmail.com>
Subject: Re: [Freeswitch-users] Security issue
Date: August 15, 2015 at 5:22:47 PM GMT+3
To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
Reply-To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org>
An external invite in default config go to the public context. That is the expected and correct behavior, in default config.
Eg: is where the incoming did calls would go, and then (in default config) are dispatched to local extensions (1000...1020).
Obviously, you can change the config to fit your needs.
-giovanni
sent from my mobile,
Giovanni Maruzzelli
cell: +39 347 266 56 18
On Aug 15, 2015 4:14 PM, "Anthony Minessale" <anthony.minessale@gmail.com <mailto:anthony.minessale@gmail.com>> wrote:
The public context is unauthentecared that is why its called public.  Only public facing extensions should be defined there.
The example configs are only a suggestion on how to run your server.  The best approach is to learn how the sofia profiles and contexts work to configure it to your needs.
On Saturday, August 15, 2015, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> wrote:
1) Output network_ip of received INVITE with appropriate comment like "Block for one day ip x.x.x.x"
2) Add fail2ban rule to search strings like "Block for one day ip x.x.x.x" and block ip
On Sat, Aug 15, 2015 at 12:18 PM, Nikolay Zaytsev <nzaytsevc@gmail.com <>> wrote:
Hi,all)
I have the freeswitch on public ip with set up fail2ban.
However, there is an external invites which proceed to dialplan's context public.
How can I defend my freeswitch from such attaks?
The log of such attack is in the attachment.
Bets Regards,
Nikolay Zaytsev
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org <>
http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites
http://www.freeswitch.org <http://www.freeswitch.org/>
http://confluence.freeswitch.org <http://confluence.freeswitch.org/>
http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org <>
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>
http://www.freeswitch.org <http://www.freeswitch.org/>
-- 
Anthony Minessale II       ♬ @anthmfs  ♬ @FreeSWITCH  ♬
☞ http://freeswitch.org/ <http://freeswitch.org/>  ☞ http://cluecon.com/ <http://cluecon.com/>  ☞ http://twitter.com/FreeSWITCH <http://twitter.com/FreeSWITCH>
☞ irc.freenode.net <http://irc.freenode.net/> #freeswitch ☞ http://freeswitch.org/g+ <http://freeswitch.org/g+>
ClueCon Weekly Development Call 
☎ sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org>  ☎ +19193869900 <tel:%2B19193869900>
https://www.youtube.com/watch?v=9XXgW34t40s <https://www.youtube.com/watch?v=9XXgW34t40s>
https://www.youtube.com/watch?v=NLaDpGQuZDA <https://www.youtube.com/watch?v=NLaDpGQuZDA>
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org <mailto:consulting@freeswitch.org>
http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>
Official FreeSWITCH Sites
http://www.freeswitch.org <http://www.freeswitch.org/>
http://confluence.freeswitch.org <http://confluence.freeswitch.org/>
http://www.cluecon.com <http://www.cluecon.com/>
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>
http://www.freeswitch.org <http://www.freeswitch.org/>

Ahmed Habiba

tags

participants (1)