Dear all, Recently, my FS server are often slowed down at midnight, and system logged a lot of these lines below: 2011-01-03 04:13:07.494973 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [5843@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:41.344034 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:41.503079 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:41.671564 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:41.828182 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:41.998964 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:42.145093 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:42.291273 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:42.448811 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 2011-01-03 04:11:42.605709 [WARNING] sofia_reg.c:1203 SIP auth challenge (REGISTER) on sofia profile 'internal' for [music@90.192.85.12] from ip 184.106.178.189 I installed fail2ban, but it does not seem to work. After reading these lines, I found this to be a successful REGISTER instead of a failure. But I do not have 5843 or music in my directory, and myself can not login to music account, it generate the following error log: 2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6 So, how can this hacker successfully registered music account and avoid to be baned? it is strange. Thanks.
Chances are he never received the challenge.. thus never logs an auth failure. /b On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
Got it. But if no failure log. fail2ban will not work. So how can we protect fs from this kind of attack besides manually setup firewall rules 1 by 1 on discovery? On Tue, Jan 4, 2011 at 12:54 AM, Brian West <brian@freeswitch.org> wrote:
Chances are he never received the challenge.. thus never logs an auth failure.
/b
On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Just curious, but did you notice that the IP address was internal? 192.168.0.6 - what IP address is that? On Mon, Jan 3, 2011 at 9:34 PM, xuyan yang <xyangni@gmail.com> wrote:
Got it. But if no failure log. fail2ban will not work. So how can we protect fs from this kind of attack besides manually setup firewall rules 1 by 1 on discovery?
On Tue, Jan 4, 2011 at 12:54 AM, Brian West <brian@freeswitch.org> wrote:
Chances are he never received the challenge.. thus never logs an auth failure.
/b
On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
The internal address seems to be the one from which the OPoster tried to be registered, and sent the challenge (and was rejected). The original attempts, that were not rejected (probably because were not sending challenges) were coming from external addresses. -giovanni On 1/4/11, Michael Collins <msc@freeswitch.org> wrote:
Just curious, but did you notice that the IP address was internal? 192.168.0.6 - what IP address is that?
On Mon, Jan 3, 2011 at 9:34 PM, xuyan yang <xyangni@gmail.com> wrote:
Got it. But if no failure log. fail2ban will not work. So how can we protect fs from this kind of attack besides manually setup firewall rules 1 by 1 on discovery?
On Tue, Jan 4, 2011 at 12:54 AM, Brian West <brian@freeswitch.org> wrote:
Chances are he never received the challenge.. thus never logs an auth failure.
/b
On Jan 3, 2011, at 9:26 AM, xuyan yang wrote:
2011-01-03 15:19:32.360152 [WARNING] sofia_reg.c:1161 SIP auth failure (REGISTER) on sofia profile 'internal' for [music@192.168.0.3] from ip 192.168.0.6
So, how can this hacker successfully registered music account and avoid to be baned? it is strange.
Thanks
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sent from my mobile device Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
participants (4)
-
Brian West
-
Giovanni Maruzzelli
-
Michael Collins
-
xuyan yang