needs some advice to secure my system
Hello, Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility? since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that. At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP. Any help/links will be gladly received thanks /Philippe
Hi Philippe, Have a look at http://wiki.freeswitch.org/wiki/Fail2ban On Tue, Feb 7, 2012 at 8:12 PM, Philippe Le Toquin <philippe@ppmt.org> wrote:
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
ACL'ing like folks have suggested should help. But the problem is these attacks don't always stop just because you've stopped responding. I've seen multi-day sustained scans at 30Mbps, but I'm sure they go much higher. As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities. I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo'd machine or something, you should not have problems with caps, right? -Michael From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Philippe Le Toquin Sent: Tuesday, February 07, 2012 7:42 AM To: FreeSWITCH-users@lists.freeswitch.org Subject: [Freeswitch-users] needs some advice to secure my system Hello, Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility? since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that. At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP. Any help/links will be gladly received thanks /Philippe
I saw some comments about friendly-scanner that putting a REJECT in iptables or responding with a SIP 200 OK caused the scanner to stop nearly immediately. Might be worth looking into.. -Avi On Tue, Feb 14, 2012 at 6:40 PM, Michael Giagnocavo <mgg@giagnocavo.net>wrote:
ACL’ing like folks have suggested should help. But the problem is these attacks don’t always stop just because you’ve stopped responding. I’ve seen multi-day sustained scans at 30Mbps, but I’m sure they go much higher.****
** **
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.****
** **
I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo’d machine or something, you should not have problems with caps, right?****
** **
-Michael****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Philippe Le Toquin *Sent:* Tuesday, February 07, 2012 7:42 AM *To:* FreeSWITCH-users@lists.freeswitch.org *Subject:* [Freeswitch-users] needs some advice to secure my system****
** **
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Also, don't forget that the author of SIPVicious came and spoke to us about his project. He mentioned that most friendly scanners are using an older version of SIPVicious that susceptible to a "retaliatory attack" that will bring the script to a screeching halt. http://wiki.freeswitch.org/wiki/Weekly_Conference_Call (get recording from 2011-04-13) -MC On Tue, Feb 14, 2012 at 9:05 AM, Avi Marcus <avi@avimarcus.net> wrote:
I saw some comments about friendly-scanner that putting a REJECT in iptables or responding with a SIP 200 OK caused the scanner to stop nearly immediately. Might be worth looking into..
-Avi
On Tue, Feb 14, 2012 at 6:40 PM, Michael Giagnocavo <mgg@giagnocavo.net>wrote:
ACL’ing like folks have suggested should help. But the problem is these attacks don’t always stop just because you’ve stopped responding. I’ve seen multi-day sustained scans at 30Mbps, but I’m sure they go much higher.*** *
** **
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.****
** **
I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo’d machine or something, you should not have problems with caps, right?****
** **
-Michael****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Philippe Le Toquin *Sent:* Tuesday, February 07, 2012 7:42 AM *To:* FreeSWITCH-users@lists.freeswitch.org *Subject:* [Freeswitch-users] needs some advice to secure my system****
** **
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
if do a quick google for crash sip vicious you'll also find his blog entry about the counter attack On Tue, Feb 14, 2012 at 12:43 PM, Michael Collins <msc@freeswitch.org>wrote:
Also, don't forget that the author of SIPVicious came and spoke to us about his project. He mentioned that most friendly scanners are using an older version of SIPVicious that susceptible to a "retaliatory attack" that will bring the script to a screeching halt.
http://wiki.freeswitch.org/wiki/Weekly_Conference_Call (get recording from 2011-04-13)
-MC
On Tue, Feb 14, 2012 at 9:05 AM, Avi Marcus <avi@avimarcus.net> wrote:
I saw some comments about friendly-scanner that putting a REJECT in iptables or responding with a SIP 200 OK caused the scanner to stop nearly immediately. Might be worth looking into..
-Avi
On Tue, Feb 14, 2012 at 6:40 PM, Michael Giagnocavo <mgg@giagnocavo.net>wrote:
ACL’ing like folks have suggested should help. But the problem is these attacks don’t always stop just because you’ve stopped responding. I’ve seen multi-day sustained scans at 30Mbps, but I’m sure they go much higher.** **
** **
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.****
** **
I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo’d machine or something, you should not have problems with caps, right?****
** **
-Michael****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Philippe Le Toquin *Sent:* Tuesday, February 07, 2012 7:42 AM *To:* FreeSWITCH-users@lists.freeswitch.org *Subject:* [Freeswitch-users] needs some advice to secure my system****
** **
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks I will look at it Once again thanks all for your advices On Feb 14, 2012 2:32 PM, "Ken Rice" <krice@freeswitch.org> wrote:
if do a quick google for crash sip vicious you'll also find his blog entry about the counter attack
On Tue, Feb 14, 2012 at 12:43 PM, Michael Collins <msc@freeswitch.org>wrote:
Also, don't forget that the author of SIPVicious came and spoke to us about his project. He mentioned that most friendly scanners are using an older version of SIPVicious that susceptible to a "retaliatory attack" that will bring the script to a screeching halt.
http://wiki.freeswitch.org/wiki/Weekly_Conference_Call (get recording from 2011-04-13)
-MC
On Tue, Feb 14, 2012 at 9:05 AM, Avi Marcus <avi@avimarcus.net> wrote:
I saw some comments about friendly-scanner that putting a REJECT in iptables or responding with a SIP 200 OK caused the scanner to stop nearly immediately. Might be worth looking into..
-Avi
On Tue, Feb 14, 2012 at 6:40 PM, Michael Giagnocavo <mgg@giagnocavo.net>wrote:
ACL’ing like folks have suggested should help. But the problem is these attacks don’t always stop just because you’ve stopped responding. I’ve seen multi-day sustained scans at 30Mbps, but I’m sure they go much higher.* ***
** **
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.****
** **
I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo’d machine or something, you should not have problems with caps, right?****
** **
-Michael****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Philippe Le Toquin *Sent:* Tuesday, February 07, 2012 7:42 AM *To:* FreeSWITCH-users@lists.freeswitch.org *Subject:* [Freeswitch-users] needs some advice to secure my system****
** **
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.
Another useful thing - at least in my case - is to configure iptables so that this ip is completely disabled - i.e. connections (SYNs) from/to this particular IP address are instantly dropped, no matter what port this connection requests are made to. I am employing a long list of banned addresses and instead of getting 1000s of requests/scans after employing this "blacklist" now I have reduced these scans to just a few per day. Very effective!
What is ACL exactly? Is it implemented via iptables? I know it means access control list but is it about blocking or actually allowing? As for Canadian we are all treated equally and have caps for cable and adsl (also that seems to change recently) What is a colo'd machine? On Feb 14, 2012 11:45 AM, "Michael Giagnocavo" <mgg@giagnocavo.net> wrote:
ACL’ing like folks have suggested should help. But the problem is these attacks don’t always stop just because you’ve stopped responding. I’ve seen multi-day sustained scans at 30Mbps, but I’m sure they go much higher.****
** **
As folks have suggested, run SIP on another port to avoid detection, and only open your firewall on 5060 for absolute necessities.****
** **
I was under the impression that Canadian bandwidth limits were more for DSL and the like. If you get a colo’d machine or something, you should not have problems with caps, right?****
** **
-Michael****
** **
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Philippe Le Toquin *Sent:* Tuesday, February 07, 2012 7:42 AM *To:* FreeSWITCH-users@lists.freeswitch.org *Subject:* [Freeswitch-users] needs some advice to secure my system****
** **
Hello,
Sorry to ask like that but could someone points me to some site that explains exactly what I need to open towards the internet so that my FS server is working while limiting its visibility?
since 1st of February I have an IP that continually sends me SIP Register request at a rate of 70KB/s. I have complained to my internet provider but they refuse to help saying that the problem is on my side. I also logged a complain to the provider on that IP and am waiting on that.
At the moment on my firewall I opened port 5060 and 5080 (well now I blocked as well that IP) but I want to know if both are really needed or if I could block one of them or may be limit the port to some IP.
Any help/links will be gladly received
thanks
/Philippe****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (7)
-
Avi Marcus
-
guru singh
-
Josh
-
Ken Rice
-
Michael Collins
-
Michael Giagnocavo
-
Philippe Le Toquin