Freeswitch server itself generating unwanted calls (Ghost calls)
Dear Team, from last few days my FreeSWITCH server generating some logs itself. I don't know how to stop this .. please help .. it's urgent. Please see the attached logs. -- Regards, Shisheer T *Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.*
Hi! This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall? пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com>:
Dear Team,
from last few days my FreeSWITCH server generating some logs itself.
I don't know how to stop this .. please help .. it's urgent.
Please see the attached logs.
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.* _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 add.: 15-94
hello, Just install fail2ban and point it to your freeswitch.log location. David On Mon, Feb 20, 2017 at 11:33 AM Борисов, Дмитрий / Dmitriy Borisov < bordmi@rarus.ru> wrote:
Hi!
This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall?
пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com>:
Dear Team,
from last few days my FreeSWITCH server generating some logs itself.
I don't know how to stop this .. please help .. it's urgent.
Please see the attached logs.
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.* _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 add.: 15-94 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
all my users are connected from office outside. so I can't block any IP. is there any configuration in FreeSWITCH to block them.. ? On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov < bordmi@rarus.ru> wrote:
Hi!
This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall?
пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com>:
Dear Team,
from last few days my FreeSWITCH server generating some logs itself.
I don't know how to stop this .. please help .. it's urgent.
Please see the attached logs.
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.* _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 add.: 15-94
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Shisheer T *Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.*
your username / passwords are probably compromised, if not your box entirely. - Change ALL your passwords and enforce strong password policies. - Make sure all your SIP Profiles require auth, or have strong ACL's - Implement fail2ban - BLOCK THE KNOWN ATTACKER IP with Iptables. Im sorry to sound like an ass, but if you havnt done one of the above or dont think you can do them all then you probably need to pay someone who knows what they are doing. On 20 February 2017 at 20:38, Shisheer Teli <telishisheer@gmail.com> wrote:
all my users are connected from office outside. so I can't block any IP.
is there any configuration in FreeSWITCH to block them.. ?
On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov < bordmi@rarus.ru> wrote:
Hi!
This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall?
пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com>:
Dear Team,
from last few days my FreeSWITCH server generating some logs itself.
I don't know how to stop this .. please help .. it's urgent.
Please see the attached logs.
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.* ____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 <+7%20495%20231-20-02> доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 <+7%20495%20231-20-02> add.: 15-94
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.*
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
You need to enable fail2ban, whether you like it or not. It will only block ip addresses from which failed register attempts are received. It won't block successful registers. On the other hand, if you are seeing calls from registered users and those users claim they didn't make those calls, you must change all passwords. As Jay points out, you should authorize on all profiles either with digest or with acl. On Mon, Feb 20, 2017 at 12:10 PM jay binks <jaybinks@gmail.com> wrote:
your username / passwords are probably compromised, if not your box entirely.
- Change ALL your passwords and enforce strong password policies. - Make sure all your SIP Profiles require auth, or have strong ACL's - Implement fail2ban - BLOCK THE KNOWN ATTACKER IP with Iptables.
Im sorry to sound like an ass, but if you havnt done one of the above or dont think you can do them all then you probably need to pay someone who knows what they are doing.
On 20 February 2017 at 20:38, Shisheer Teli <telishisheer@gmail.com> wrote:
all my users are connected from office outside. so I can't block any IP.
is there any configuration in FreeSWITCH to block them.. ?
On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov < bordmi@rarus.ru> wrote:
Hi!
This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall?
пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com>:
Dear Team,
from last few days my FreeSWITCH server generating some logs itself.
I don't know how to stop this .. please help .. it's urgent.
Please see the attached logs.
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.* _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 <+7%20495%20231-20-02> доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 <+7%20495%20231-20-02> add.: 15-94
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Shisheer T
*Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.*
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely
Jay _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi, Additionally tot he Mentioned Measures I would recommend the following: (Since I did 1 I never ever saw an attack on out server again, previously there was permanent attacks) 1. If possible use a non-default port on all public IPs for SIP. Use a very high port > 60K. 2. Ensure that if u do a outbound call in your dialplan <condition field="${sip_authorized}" expression="^true$"/> is part of the conditions, example: <extension name="public_outbound_call"> <condition field="${sip_authorized}" expression="^true$"/> <condition field="${Username}" expression="^4[5-7]$|^[24578]$"> <action application="log" data="auth user: ${sip_authorized} $${sip_authorized} / ${Username}" /> <action application="set" data="call_timeout=60"/> <action application="bridge" data="x/y/yb@a" /> </condition> </extension> You must ensure that you got set “auth-calls” to true in the profile for users that make outbound calls. Von: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von jay binks Gesendet: Montag, 20. Februar 2017 12:09 An: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Betreff: Re: [Freeswitch-users] Freeswitch server itself generating unwanted calls (Ghost calls) your username / passwords are probably compromised, if not your box entirely. * Change ALL your passwords and enforce strong password policies. * Make sure all your SIP Profiles require auth, or have strong ACL's * Implement fail2ban * BLOCK THE KNOWN ATTACKER IP with Iptables. Im sorry to sound like an ass, but if you havnt done one of the above or dont think you can do them all then you probably need to pay someone who knows what they are doing. On 20 February 2017 at 20:38, Shisheer Teli <telishisheer@gmail.com<mailto:telishisheer@gmail.com>> wrote: all my users are connected from office outside. so I can't block any IP. is there any configuration in FreeSWITCH to block them.. ? On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov <bordmi@rarus.ru<mailto:bordmi@rarus.ru>> wrote: Hi! This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall? пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com<mailto:telishisheer@gmail.com>>: Dear Team, from last few days my FreeSWITCH server generating some logs itself. I don't know how to stop this .. please help .. it's urgent. Please see the attached logs. -- Regards, Shisheer T Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02<tel:+7%20495%20231-20-02> доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02<tel:+7%20495%20231-20-02> add.: 15-94 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Regards, Shisheer T Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Sincerely Jay
These aren’t “ghost calls” these are a sip scanner attempting to brute force your server… you should do some research on fail2ban, blocking sip scanners and other security methods…. If you need pro help you can contact consulting@freeswitch.org <mailto:consulting@freeswitch.org> and the Team to assist you in locking it down Ken From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Shisheer Teli Sent: Monday, February 20, 2017 4:38 AM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Freeswitch server itself generating unwanted calls (Ghost calls) all my users are connected from office outside. so I can't block any IP. is there any configuration in FreeSWITCH to block them.. ? On Mon, Feb 20, 2017 at 4:02 PM, Борисов, Дмитрий / Dmitriy Borisov <bordmi@rarus.ru <mailto:bordmi@rarus.ru> > wrote: Hi! This call is not self generated. It`s was generated by 23.239.85.20 (in most cases). Do you have properli configurated firewall? пн, 20 февр. 2017 г. в 13:29, Shisheer Teli <telishisheer@gmail.com <mailto:telishisheer@gmail.com> >: Dear Team, from last few days my FreeSWITCH server generating some logs itself. I don't know how to stop this .. please help .. it's urgent. Please see the attached logs. -- Regards, Shisheer T Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- -- С уважением, Борисов Дмитрий Отдел облачных технологий 1С-Рарус Тел. +7 (495) 231-20-02 доб.: 15-94 -- with best regards, Dmitriy Borisov 1C-Rarus Cloud Services tel.: +7 (495) 231-20-02 add.: 15-94 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Regards, Shisheer T Save paper, save trees.... Please do not print this e-mail unless it is absolutely necessary.
participants (6)
-
David Villasmil
-
jay binks
-
Ken Rice
-
Marcel Haldemann
-
Shisheer Teli
-
Борисов, Дмитрий / Dmitriy Borisov