[Fwd: Re: Warning - SIP auth challenge]
But the message is every 4 minutes. -------- Forwarded Message -------- From: Avi Marcus <avi@avimarcus.net> Reply-to: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Warning - SIP auth challenge Date: Wed, 15 Jun 2011 01:38:29 +0300 It's just a notice that there's a register attempt. If it's every 30 or 60 minutes from a known extension, it's fine. It's there for fail2ban to notice excessive register attempts so it can block abuse from clients that try to register but don't submit a password to avoid setting off the warning bells. -Avi On Wed, Jun 15, 2011 at 1:33 AM, Henk Oegema <henk@oegema.com> wrote: What is the meaning of getting (regular) this message: .....[WARNING] sofia_reg.c:1241 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1001@10.0.0.101] from ip 10.0.0.12 ?? Extension 1001 is a Portech GSM gateway MV370. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If it's from the same extension and the same device, then it's set to register every 4 minutes. If you don't want that, you can change the register time on the phone or forces the subscription expire time: http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#force-subscription... -Avi Marcus On Wed, Jun 15, 2011 at 1:48 AM, Henk Oegema <henk@oegema.com> wrote:
But the message is every 4 minutes.
-------- Forwarded Message -------- *From*: Avi Marcus <avi@avimarcus.net<Avi%20Marcus%20%3cavi@avimarcus.net%3e>
*Reply-to*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *To*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org<FreeSWITCH%20Users%20Help%20%3cfreeswitch-users@lists.freeswitch.org%3e>
*Subject*: Re: [Freeswitch-users] Warning - SIP auth challenge *Date*: Wed, 15 Jun 2011 01:38:29 +0300
It's just a notice that there's a register attempt. If it's every 30 or 60 minutes from a known extension, it's fine.
It's there for fail2ban to notice excessive register attempts so it can block abuse from clients that try to register but don't submit a password to avoid setting off the warning bells.
-Avi
On Wed, Jun 15, 2011 at 1:33 AM, Henk Oegema <henk@oegema.com> wrote:
What is the meaning of getting (regular) this message: .....[WARNING] sofia_reg.c:1241 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1001@10.0.0.101] from ip 10.0.0.12 ??
Extension 1001 is a Portech GSM gateway MV370.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I think the log-auth-failures option will also disable logging of that message, useful if you're not using fail2ban: http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#log-auth-failures The only reason that it's a warning level message is so that you can run FS on warning level and fail2ban can still see those messages. -Steve On 15 June 2011 07:26, Avi Marcus <avi@avimarcus.net> wrote:
If it's from the same extension and the same device, then it's set to register every 4 minutes. If you don't want that, you can change the register time on the phone or forces the subscription expire time:
http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#force-subscription...
-Avi Marcus
On Wed, Jun 15, 2011 at 1:48 AM, Henk Oegema <henk@oegema.com> wrote:
But the message is every 4 minutes.
-------- Forwarded Message -------- *From*: Avi Marcus <avi@avimarcus.net<Avi%20Marcus%20%3cavi@avimarcus.net%3e>
*Reply-to*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *To*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org<FreeSWITCH%20Users%20Help%20%3cfreeswitch-users@lists.freeswitch.org%3e>
*Subject*: Re: [Freeswitch-users] Warning - SIP auth challenge *Date*: Wed, 15 Jun 2011 01:38:29 +0300
It's just a notice that there's a register attempt. If it's every 30 or 60 minutes from a known extension, it's fine.
It's there for fail2ban to notice excessive register attempts so it can block abuse from clients that try to register but don't submit a password to avoid setting off the warning bells.
-Avi
On Wed, Jun 15, 2011 at 1:33 AM, Henk Oegema <henk@oegema.com> wrote:
What is the meaning of getting (regular) this message: .....[WARNING] sofia_reg.c:1241 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1001@10.0.0.101] from ip 10.0.0.12 ??
Extension 1001 is a Portech GSM gateway MV370.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
useful if you use fail2ban.... ;) ----- Original Message ----- From: Steven Ayre To: FreeSWITCH Users Help Sent: Wednesday, June 15, 2011 6:15 AM Subject: Re: [Freeswitch-users] [Fwd: Re: Warning - SIP auth challenge] I think the log-auth-failures option will also disable logging of that message, useful if you're not using fail2ban: http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#log-auth-failures The only reason that it's a warning level message is so that you can run FS on warning level and fail2ban can still see those messages. -Steve On 15 June 2011 07:26, Avi Marcus <avi@avimarcus.net> wrote: If it's from the same extension and the same device, then it's set to register every 4 minutes. If you don't want that, you can change the register time on the phone or forces the subscription expire time: http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#force-subscription... -Avi Marcus On Wed, Jun 15, 2011 at 1:48 AM, Henk Oegema <henk@oegema.com> wrote: But the message is every 4 minutes. -------- Forwarded Message -------- From: Avi Marcus <avi@avimarcus.net> Reply-to: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Warning - SIP auth challenge Date: Wed, 15 Jun 2011 01:38:29 +0300 It's just a notice that there's a register attempt. If it's every 30 or 60 minutes from a known extension, it's fine. It's there for fail2ban to notice excessive register attempts so it can block abuse from clients that try to register but don't submit a password to avoid setting off the warning bells. -Avi On Wed, Jun 15, 2011 at 1:33 AM, Henk Oegema <henk@oegema.com> wrote: What is the meaning of getting (regular) this message: .....[WARNING] sofia_reg.c:1241 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1001@10.0.0.101] from ip 10.0.0.12 ?? Extension 1001 is a Portech GSM gateway MV370. _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
and everyone SHOULD use fail2ban ... or your asking for trouble.. not many good reasons to avoid it . J On Thu, Jun 16, 2011 at 12:21 AM, Madovsky <infos@madovsky.org> wrote:
useful if you use fail2ban.... ;)
----- Original Message ----- *From:* Steven Ayre <steveayre@gmail.com> *To:* FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *Sent:* Wednesday, June 15, 2011 6:15 AM *Subject:* Re: [Freeswitch-users] [Fwd: Re: Warning - SIP auth challenge]
I think the log-auth-failures option will also disable logging of that message, useful if you're not using fail2ban: http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#log-auth-failures
The only reason that it's a warning level message is so that you can run FS on warning level and fail2ban can still see those messages.
-Steve
On 15 June 2011 07:26, Avi Marcus <avi@avimarcus.net> wrote:
If it's from the same extension and the same device, then it's set to register every 4 minutes. If you don't want that, you can change the register time on the phone or forces the subscription expire time:
http://wiki.freeswitch.org/wiki/Sofia_Configuration_Files#force-subscription...
-Avi Marcus
On Wed, Jun 15, 2011 at 1:48 AM, Henk Oegema <henk@oegema.com> wrote:
But the message is every 4 minutes.
-------- Forwarded Message -------- *From*: Avi Marcus <avi@avimarcus.net<Avi%20Marcus%20%3cavi@avimarcus.net%3e>
*Reply-to*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org
*To*: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org<FreeSWITCH%20Users%20Help%20%3cfreeswitch-users@lists.freeswitch.org%3e>
*Subject*: Re: [Freeswitch-users] Warning - SIP auth challenge *Date*: Wed, 15 Jun 2011 01:38:29 +0300
It's just a notice that there's a register attempt. If it's every 30 or 60 minutes from a known extension, it's fine.
It's there for fail2ban to notice excessive register attempts so it can block abuse from clients that try to register but don't submit a password to avoid setting off the warning bells.
-Avi
On Wed, Jun 15, 2011 at 1:33 AM, Henk Oegema <henk@oegema.com> wrote:
What is the meaning of getting (regular) this message: .....[WARNING] sofia_reg.c:1241 SIP auth challenge (REGISTER) on sofia profile 'internal' for [1001@10.0.0.101] from ip 10.0.0.12 ??
Extension 1001 is a Portech GSM gateway MV370.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
participants (5)
-
Avi Marcus
-
Henk Oegema
-
jay binks
-
Madovsky
-
Steven Ayre