I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try): <configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration> Restarted the computer but nothing, he (thomas I guess) was back on my console. Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc).
Try using iptables and block all incoming traffic from this specific host? On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com>wrote:
Try using iptables and block all incoming traffic from this specific host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
iptables -I INPUT -s [hackerip] -j DROP A better solution is searching the wiki for fail2ban with FreeSwitch. On Sat, Jan 29, 2011 at 4:20 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks I will try. What do you thing he/it was trying to do (any idea)? On Sat, Jan 29, 2011 at 4:26 PM, curriegrad2004 <curriegrad2004@gmail.com>wrote:
iptables -I INPUT -s [hackerip] -j DROP
A better solution is searching the wiki for fail2ban with FreeSwitch.
On Sat, Jan 29, 2011 at 4:20 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 < curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific
host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time
I
went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I tried "iptables -I INPUT -s [212.224.71.236] -j DROP" and got " Unknown command: iptables...". Do I must install fail2ban to issue iptables command? I'm on windows 7. Thanks On Sat, Jan 29, 2011 at 4:26 PM, curriegrad2004 <curriegrad2004@gmail.com>wrote:
iptables -I INPUT -s [hackerip] -j DROP
A better solution is searching the wiki for fail2ban with FreeSwitch.
On Sat, Jan 29, 2011 at 4:20 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 < curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific
host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time
I
went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
uhm... remove the braces and do iptables -I INPUT -s 212.224.71.236 -j DROP instead. Sorry for not being clear what the braces meant... On Sat, Jan 29, 2011 at 10:47 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I tried "iptables -I INPUT -s [212.224.71.236] -j DROP" and got " Unknown command: iptables...". Do I must install fail2ban to issue iptables command? I'm on windows 7. Thanks
On Sat, Jan 29, 2011 at 4:26 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote:
iptables -I INPUT -s [hackerip] -j DROP
A better solution is searching the wiki for fail2ban with FreeSwitch.
On Sat, Jan 29, 2011 at 4:20 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote:
Try using iptables and block all incoming traffic from this specific host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
fail2ban on wiki ----- Original Message ----- From: Joao Leme To: FreeSWITCH Users Help Sent: Saturday, January 29, 2011 7:20 PM Subject: Re: [Freeswitch-users] Hacker Attack? How do I do that? Thanks! On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com> wrote: Try using iptables and block all incoming traffic from this specific host? On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote: > I just downloaded and compiled the latest Git and a little after starting > freeswitch I'm getting non stop the following: > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile > ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 > it's non-stop and doesn't let me do nothing else. After the first time I > went on to vars and changed the 1234 password....restarted and same thing > happened, I also try denying the ip on acl.conf (not sure if has something > to do with it but gave it a try): > > <configuration name="acl.conf" description="Network Lists"> > <network-lists> > <list name="test2" default="allow"> > <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> > </list> > </network-lists> > </configuration> > > Restarted the computer but nothing, he (thomas I guess) was back on my > console. > > Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the > only way I got to be able to connect to the internal profile from out of the > office etc). > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long. If you want to make sure they don't even talk to the FS, iptable is a good way, but you can only do so much by banning 1 ip address. fail2ban is a much better solution for the future Denial of Service (DoS) attacks. Regardless of any preventative you go with, make sure you don't have any sip accounts with easy to guess passwords. Depending on their script, it wouldn't take too long to brute-force a dictionary-based passwords. Frank On Sat, Jan 29, 2011 at 7:45 PM, Madovsky <infos@madovsky.org> wrote:
fail2ban on wiki
----- Original Message ----- *From:* Joao Leme <joaocarlosleme@gmail.com> *To:* FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> *Sent:* Saturday, January 29, 2011 7:20 PM *Subject:* Re: [Freeswitch-users] Hacker Attack?
How do I do that? Thanks!
On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004@gmail.com>wrote:
Try using iptables and block all incoming traffic from this specific host?
On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme@gmail.com> wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following: [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [thomas@76.XXX.XX.XXX] from ip 212.224.71.236 it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
<configuration name="acl.conf" description="Network Lists"> <network-lists> <list name="test2" default="allow"> <node type="deny" host="212.224.71.236" mask="255.255.255.0"/> </list> </network-lists> </configuration>
Restarted the computer but nothing, he (thomas I guess) was back on my console.
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ----=======================---- Frank Park Telonium Communications, LLC frank@telonium.com http://www.telonium.com Follow Us on Twitter: @GetTelonium 404-566-8888 x1001 Office 404-939-4242 Cell ----=======================----
On Sat, Jan 29, 2011 at 6:48 PM, Frank Park <frank@telonium.com> wrote:
It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long.
Has anyone seen enough of these to know if they're sophisticated enough to use SRV records to find their target, or to they just plot along at 5060 for some range of IP addresses? Gabe
I'd suspect they just do a port scan and see who has port 5060 up and running. Wouldn't be too surprised if they went through the SRV route On Sat, Jan 29, 2011 at 7:24 PM, Gabriel Gunderson <gabe@gundy.org> wrote:
On Sat, Jan 29, 2011 at 6:48 PM, Frank Park <frank@telonium.com> wrote:
It's pretty normal to see a crawler every so often that tries to brute-force the username/password combo on SIP servers. Most of them are kiddie scripts online and shouldn't last long.
Has anyone seen enough of these to know if they're sophisticated enough to use SRV records to find their target, or to they just plot along at 5060 for some range of IP addresses?
Gabe
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Joao Leme wrote:
Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the only way I got to be able to connect to the internal profile from out of the office etc). This kind of flexibility exposes your equipment to crackers (not hackers) out in the Internet world. Why not remove the equipment from DMZ and use VPN to connect from office? This way, you will still be able to connect to the internal profile in a more secure manner.
----- don't and stop are the ONLY two 4-letter words considered offensive to men, but not when used together. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Hacker-Attack-tp5973660p597486... Sent from the freeswitch-users mailing list archive at Nabble.com.
On Sat, 2011-01-29 at 15:39 -0800, Joao Leme wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following:
[WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
It seems obvious, but since no one else mentioned it, I will: have you tried contacting the owner of attacking machine? Chances are it's a compromised machine and the owner is unaware of the situation. I experienced the same thing about a week ago, did a WHOIS lookup on the IP, contacted the owner who was quite grateful to be alerted of the issue, and had it resolved pretty quickly. As an aside, if the script that's attacking you is the same one that was attacking me, it won't stop once you setup the iptables rule. In my case it continued to send over 1Mbit/s of registration attempts even when it could no longer connect (as measured by pfSense). Regards, Cliff
Thanks Cliff, but I haven't had this problem for almost 2 weeks now (since I updated FS (again) to the latest GIT, even though FS version seems to have nothing to do with it). I wanted to remove DMZ but I can't get around the NO SOUND problem when connecting from outside the local network (I opened another thread for that but no solution so far from my end). Thanks, John On Mon, Feb 14, 2011 at 10:27 AM, Cliff Wells <cliff@develix.com> wrote:
On Sat, 2011-01-29 at 15:39 -0800, Joao Leme wrote:
I just downloaded and compiled the latest Git and a little after starting freeswitch I'm getting non stop the following:
[WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile ‘internal’ for [140@76.XXX.XX.XXX] from ip 212.224.71.236
it's non-stop and doesn't let me do nothing else. After the first time I went on to vars and changed the 1234 password....restarted and same thing happened, I also try denying the ip on acl.conf (not sure if has something to do with it but gave it a try):
It seems obvious, but since no one else mentioned it, I will: have you tried contacting the owner of attacking machine? Chances are it's a compromised machine and the owner is unaware of the situation. I experienced the same thing about a week ago, did a WHOIS lookup on the IP, contacted the owner who was quite grateful to be alerted of the issue, and had it resolved pretty quickly.
As an aside, if the script that's attacking you is the same one that was attacking me, it won't stop once you setup the iptables rule. In my case it continued to send over 1Mbit/s of registration attempts even when it could no longer connect (as measured by pfSense).
Regards, Cliff
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (7)
-
Cliff Wells
-
curriegrad2004
-
Frank Park
-
Gabriel Gunderson
-
Joao Leme
-
Madovsky
-
mazilo