troubles with Mod_gsmopen and Huawei E153
Hello, Actually i've compiled the last Freeswitch build and mod_gsmopen on win7 with Visual Studio Ultimate without big troubles. ( i only had to replace some lib files into the right folders in order to compile correctly mod_gsmopen ) i followed each steps described on Wiki. i already did 8 months ago nd it worked fine with the dongle Huawei E153 but today there is nothing to do it seems the port isnt open from freeswitch log... Before to wonder if the dongle is correctly installed , unlocked or if the voice capability is activate i must say i did it correctly and tried with an Indian Dashboard with Call plugin to call out nd receive calls nd it works like a charm but still using mod_gsmopen there is nothing to do i even tried different port in case it was interverted or something like that but nothing. I hope someone can help me to fix that. here's the simple config : <configuration name="gsmopen.conf" description="GSMopen Configuration"> <global_settings> </global_settings> <per_interface_settings> <interface id="1" name="gsm1"> </interface> </per_interface_settings> </configuration> here's the log : 013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1201 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1201 ][none ][-1,-1,-1] Windows CODEPAGE Input =850 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1203 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1203 ][none ][-1,-1,-1] Windows CODEPAGE Input =65001 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1204 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1204 ][none ][-1,-1,-1] Windows CODEPAGE Output =850 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1206 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1206 ][none ][-1,-1,-1] Windows CODEPAGE Output =65001 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1209 rev 1.3.13b[00000000|37 ][NOTICA 1209 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 0 èéòàù 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1210 rev 1.3.13b[00000000|37 ][NOTICA 1210 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 1 ç°§^£ 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1211 rev 1.3.13b[00000000|37 ][NOTICA 1211 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 2 новости 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1212 rev 1.3.13b[00000000|37 ][NOTICA 1212 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 3 ﺎﻠﺠﻤﻋﺓ 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1213 rev 1.3.13b[00000000|37 ][NOTICA 1213 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 4 ראת 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1214 rev 1.3.13b[00000000|37 ][NOTICA 1214 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 5 לק 2013-02-18 16:00:28.478618 [NOTICE] mod_gsmopen.cpp:1215 rev 1.3.13b[00000000|37 ][NOTICA 1215 ][none ][-1,-1,-1] GSMOPEN Charset Output Test 6 人大 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1228 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1228 ][none ][-1,-1,-1] Default globals.dialplan=XML 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1230 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1230 ][none ][-1,-1,-1] Default globals.destination=5000 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1232 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1232 ][none ][-1,-1,-1] Default globals.context=default 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1240 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1240 ][none ][-1,-1,-1] globals.debug=0 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1242 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1242 ][none ][-1,-1,-1] globals.debug=8 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1248 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1248 ][none ][-1,-1,-1] globals.dialplan=XML 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1254 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1254 ][none ][-1,-1,-1] globals.context=default 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1245 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1245 ][none ][-1,-1,-1] globals.hold_music= 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1251 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1251 ][none ][-1,-1,-1] globals.destination=1000 2013-02-18 16:00:28.478618 [WARNING] mod_gsmopen.cpp:1667 rev 1.3.13b[00000000|37 ][WARNINGA 1667 ][gsm1 ][-1, 0, 0] STARTING interface_id=1 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1668 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1668 ][gsm1 ][-1, 0, 0] id=1 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1669 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1669 ][gsm1 ][-1, 0, 0] name=gsm1 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1670 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1670 ][gsm1 ][-1, 0, 0] hold-music= 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1671 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1671 ][gsm1 ][-1, 0, 0] context=default 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1672 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1672 ][gsm1 ][-1, 0, 0] dialplan=XML 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1673 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1673 ][gsm1 ][-1, 0, 0] destination=1000 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1674 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1674 ][gsm1 ][-1, 0, 0] controldevice_name=COM11 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1675 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1675 ][gsm1 ][-1, 0, 0] controldevice_audio_name=COM10 2013-02-18 16:00:28.478618 [DEBUG] mod_gsmopen.cpp:1677 rev 1.3.13b[00000000|37 ][DEBUG_GSMOPEN 1677 ][gsm1 ][-1, 0, 0] gsmopen_serial_sync_period=300 2013-02-18 16:00:28.478618 [ERR] gsmopen_protocol.cpp:122 rev 1.3.13b[00000000|37 ][ERRORA 122 ][gsm1 ][-1, 0, 0] port COM11, NOT open 2013-02-18 16:00:28.478618 [ERR] mod_gsmopen.cpp:1684 rev 1.3.13b[00000000|37 ][ERRORA 1684 ][gsm1 ][-1, 0, 0] gsmopen_serial_init failed 2013-02-18 16:00:28.478618 [ERR] mod_gsmopen.cpp:1685 rev 1.3.13b[00000000|37 ][ERRORA 1685 ][gsm1 ][-1, 0, 0] STARTING interface_id=1 FAILED 2013-02-18 16:00:28.478618 [ERR] mod_gsmopen.cpp:2942 rev 1.3.13b[00000000|37 ][ERRORA 2942 ][gsm1 ][-1, 0, 0] ALARM on interface gsm1: 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:146 Adding Endpoint 'gsmopen' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:298 Adding API Function 'gsm' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:298 Adding API Function 'gsmopen' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:298 Adding API Function 'gsmopen_boost_audio' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:298 Adding API Function 'gsmopen_dump' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:298 Adding API Function 'gsmopen_sendsms' 2013-02-18 16:00:28.478618 [NOTICE] switch_loadable_module.c:405 Adding Chat interface 'sms' Thank You Best Regards -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Maybe it comes from the CTB (Communication toolbox library) libctb-0.16 ... ?? Any idea ? Anyone ? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
you need to find the right COM ports and put then in the config file... maybe by trial and error... or looking in device manager (or how it's called nowadays). Also, the application for unlocking may be useful for finding the ports ( http://www.dc-unlocker.com/ ) -giovanni On Mon, Feb 18, 2013 at 10:34 PM, PolyMorphiK <kaothics@hotmail.com> wrote:
Maybe it comes from the CTB (Communication toolbox library) libctb-0.16 ... ??
Any idea ? Anyone ?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
Thanks for your advices GIovanni but i already tried. I checked on the device manager , uninstalled the device , installed again the device , reloaded mod_gsmopen , used also the command gsm reload and same result unfortunatly , i tried all the port listed on device manager and inverted them to be sure nothing was wrong there. i also tried an other E153 device and on the Dashboard Mobil partner the port listed is the same than on the device manager and of course the dashboard isnt open when i use freeswitch to make sure the port com is available. i also checked on the source code the setup of the port com baud rate 115 200 "8N1" and i've made myself the same setup to make sure it will be compatible. I guess you worked on the Development of Gsm_open Giovanni, do you have any other idea ? Thanks -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
On Mon, Feb 18, 2013 at 7:19 PM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
you need to find the right COM ports and put then in the config file... maybe by trial and error... or looking in device manager (or how it's called nowadays). Also, the application for unlocking may be useful for finding the ports ( http://www.dc-unlocker.com/ )
mod_chan-dongle can auto-detect the port based on IMEI / IMSI -- ------------ Itamar Reis Peixoto
i've just tried DC-Unlocker like suggest and it detects pretty well the Dongle and it shows that the Dongle is unlocked and with the voice enabled. i tried the port detected and still the same :( Driving me nuts sometimes lol Cordialy -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Using of mod_gsmopen(and freeswitch too) on desktops systems is not good idea, IMO. Finding of "right" com-ports on Windows isn't so simple. Best Wishes, Dmitry. 2013/2/19 PolyMorphiK <kaothics@hotmail.com>
i've just tried DC-Unlocker like suggest and it detects pretty well the Dongle and it shows that the Dongle is unlocked and with the voice enabled. i tried the port detected and still the same :( Driving me nuts sometimes lol
Cordialy
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Well, i somewhat agree with you dvl36 but if you travel a lot and want to try some scripts really fast it's not too bad to be on windows systems. And if there is a windows development that's for a reason don't you think ? ... Beside that it's not constructive to think that way so instead i'm looking for a provisory solution using Oktell SIP-GSM ... http://www.oktellpbx.com/gateways/ <http://www.oktellpbx.com/gateways/> if someone already worked with, he is welcome to help ;) have fun ! Cordialy -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
last tries with Oktell SIP-GSM, works fine with huawei E153 and Freeswitch. on Oktell setup to make it work i use Router Mode settings SIP account is a basic extension setup default port i use for SIP server 5060 nd local port 5070 outbound-proxy check As a SIP server Default SIP-Number (the extension number you wish to receive the incoming calls when in gateway mode) CallerID Send Caller ID nd Send in "From" default GSM number blank (it's used when in gateway mode) Codecs : 1 G.711Ulaw 2 G.711Alaw 3 G.729 4 GSM 610 additional setting DTMF type RFC2833 to dial out ring the extension , wait the tonality , dial and it's done i didn't try yet the gateway mode. else i wonder if i can make a lua script for dialing. P.S: about gsmopen com port and how to find them on Oktell SIP-GSM you can find log files between the modem and the computer to have the right adresses but still doesnt work on GSMOPEN Cordialy -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
On Tue, Feb 19, 2013 at 5:07 PM, PolyMorphiK <kaothics@hotmail.com> wrote:
P.S: about gsmopen com port and how to find them on Oktell SIP-GSM you can find log files between the modem and the computer to have the right adresses but still doesnt work on GSMOPEN
Maybe (but just maybe, shooting in the dark here) is a problem of ownership/permission on the ports (eg: need to have dredentials or run as to use the port)? -giovanni -- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
Thanks to keep trying to find out Giovanni , On Oktell that's true i've to run as Admin to make it work but i also tried yesterday to do the same running freeswitch as admin but i had the same result. is it possible to identify the port as for exemple "USB\VID_12D1&PID_14AC&MI_02\7&3491CC90&6&0002" in the gsmopen xml config file ? in same time i try to add a gateway profile for a better use of Oktell but not much support available and translating from russian to english or french is somewhat very fun lol :-D i saw something about Oktell and Asterisk : http://vk.it-sfera.com.ua/439.html did someone worked around too ? Nice day all Cordialy -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
On Tue, Feb 19, 2013 at 7:14 PM, PolyMorphiK <kaothics@hotmail.com> wrote:
is it possible to identify the port as for exemple "USB\VID_12D1&PID_14AC&MI_02\7&3491CC90&6&0002" in the gsmopen xml config file ?
no, and would not be accepted by the underlining library -giovanni -- Sincerely, Giovanni Maruzzelli Cell : +39-347-2665618
Could it comes from the libctb , check there http://translate.google.com/translate?hl=fr&sl=auto&tl=en&u=http%3A%2F%2Fblo... <http://translate.google.com/translate?hl=fr&sl=auto&tl=en&u=http%3A%2F%2Fblog.xtao.me%2F2012%2F01%2Fa-problem-with-libctb%2F> beside that Oktell SIP-GSM woks really well for now and also in Gateway mode with a basic gateway setting on freeswitch so i can work on some lua scripts. i wonder if it could be possible to use an other library instead of libctb Cordialy -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/troubles-with-Mod-gsmopen-and-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Hi all, For some days i noticed that somebody was able to register to my freeswitch and trying to call international numbers. The attack is very clever as the hacker logs at the night, trying to call international number 10-15 times while changing the prefix and go away. The sip profile is connected directly to the internet and require authentication: auth-calls = true auth-all-packets = true There is no IP filtering as the service does not allow setting some. Firewall blokes all port except TCP and UDP 5060 and required UDP media ports. The authentication is made by directory. What I wonder is how ones can authenticated with extension that not exist and not described anywhere. Can it be some security issue with freeswitch? Any ideas how to solve the problem? Regards, Mario
Not unusual at all, and not even clever... there are lots of bots that just randomly search the net for IP addresses that're open to allowing calls. First, are you sure the profile is actually requiring authentication (a simple packet trace will reveal that - the first INVITE should get a 401 reply). Second, do you have blind auth enabled, in which case it'd be accepting any username/password? Third, are they getting authenticated via an ACL or user CIDR? Finally, is it possible that you're loading CDRs for calls which have been rejected? -Steve On 20 February 2013 07:28, Mario Karakanovski <mario@ims.bg> wrote:
Hi all,
For some days i noticed that somebody was able to register to my freeswitch and trying to call international numbers. The attack is very clever as the hacker logs at the night, trying to call international number 10-15 times while changing the prefix and go away.
The sip profile is connected directly to the internet and require authentication: auth-calls = true auth-all-packets = true
There is no IP filtering as the service does not allow setting some. Firewall blokes all port except TCP and UDP 5060 and required UDP media ports. The authentication is made by directory. What I wonder is how ones can authenticated with extension that not exist and not described anywhere.
Can it be some security issue with freeswitch? Any ideas how to solve the problem?
Regards, Mario
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Personally, I've seen the last option -- CDRs for calls that have been rejected. They come in on the public profile, attempt to call a single number with several prefix types... but they are indeed unauthenticated so FS just hangs up on them. -Avi On Wed, Feb 20, 2013 at 10:14 AM, Steven Ayre <steveayre@gmail.com> wrote:
Not unusual at all, and not even clever... there are lots of bots that just randomly search the net for IP addresses that're open to allowing calls.
First, are you sure the profile is actually requiring authentication (a simple packet trace will reveal that - the first INVITE should get a 401 reply).
Second, do you have blind auth enabled, in which case it'd be accepting any username/password?
Third, are they getting authenticated via an ACL or user CIDR?
Finally, is it possible that you're loading CDRs for calls which have been rejected?
-Steve
On 20 February 2013 07:28, Mario Karakanovski <mario@ims.bg> wrote:
Hi all,
For some days i noticed that somebody was able to register to my freeswitch and trying to call international numbers. The attack is very clever as the hacker logs at the night, trying to call international number 10-15 times while changing the prefix and go away.
The sip profile is connected directly to the internet and require authentication: auth-calls = true auth-all-packets = true
There is no IP filtering as the service does not allow setting some. Firewall blokes all port except TCP and UDP 5060 and required UDP media ports. The authentication is made by directory. What I wonder is how ones can authenticated with extension that not exist and not described anywhere.
Can it be some security issue with freeswitch? Any ideas how to solve the problem?
Regards, Mario
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
They are probably hitting the public/external interface which by default accepts calls for any number but will reject them as the public dialplan doesn¹t know what to do with them. I see this on a regular basis on my PBX... The real question is, are you setup to allow anyone to call you, and if you are, are you sure to block calls not destined for your box. As a previous response pointed out this is a very common attack, I see it several times a day from many different IPs as its just a bot.... There is also sipvicious attacks which I don¹t see much of as I block them on the firewall level (they almost always include the string friendly-scanner¹ and a quick google with give you an iptables command to drop them). These bots exist to exploit not just freeswitch, but any SIP server, and to exploit sip users with bad/common passwords... Good System Admin practices and double checking your FreeSWITCH configs will generally stop them in their tracks. If you need assistance stop by the FreeSWITCH IRC channel on Freenode #freeswitch and ask around... If you need professional help email consulting@freeswitch.org and they will help you out. K On 2/20/13 2:35 AM, "Avi Marcus" <avi@avimarcus.net> wrote:
Personally, I've seen the last option -- CDRs for calls that have been rejected.
They come in on the public profile, attempt to call a single number with several prefix types... but they are indeed unauthenticated so FS just hangs up on them.
-Avi
On Wed, Feb 20, 2013 at 10:14 AM, Steven Ayre <steveayre@gmail.com> wrote:
Not unusual at all, and not even clever... there are lots of bots that just randomly search the net for IP addresses that're open to allowing calls.
First, are you sure the profile is actually requiring authentication (a simple packet trace will reveal that - the first INVITE should get a 401 reply).
Second, do you have blind auth enabled, in which case it'd be accepting any username/password?
Third, are they getting authenticated via an ACL or user CIDR?
Finally, is it possible that you're loading CDRs for calls which have been rejected?
-Steve
On 20 February 2013 07:28, Mario Karakanovski <mario@ims.bg> wrote:
Hi all,
For some days i noticed that somebody was able to register to my freeswitch and trying to call international numbers. The attack is very clever as the hacker logs at the night, trying to call international number 10-15 times while changing the prefix and go away.
The sip profile is connected directly to the internet and require authentication: auth-calls = true auth-all-packets = true
There is no IP filtering as the service does not allow setting some. Firewall blokes all port except TCP and UDP 5060 and required UDP media ports. The authentication is made by directory. What I wonder is how ones can authenticated with extension that not exist and not described anywhere.
Can it be some security issue with freeswitch? Any ideas how to solve the problem?
Regards, Mario
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
Thanks Ken, It is helpful, but I still think there is some security issue. I've double check configuration. I've try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected - calls/authentication was rejected. I've decide to log the traffic - maybe I will be able to see where is the problem. Regards, Mario _____ From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Ken Rice Sent: Wednesday, February 20, 2013 10:46 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] freeswitch hack They are probably hitting the public/external interface which by default accepts calls for any number but will reject them as the public dialplan doesn't know what to do with them. I see this on a regular basis on my PBX... The real question is, are you setup to allow anyone to call you, and if you are, are you sure to block calls not destined for your box. As a previous response pointed out this is a very common attack, I see it several times a day from many different IPs as its just a bot.... There is also sipvicious attacks which I don't see much of as I block them on the firewall level (they almost always include the string 'friendly-scanner' and a quick google with give you an iptables command to drop them). These bots exist to exploit not just freeswitch, but any SIP server, and to exploit sip users with bad/common passwords... Good System Admin practices and double checking your FreeSWITCH configs will generally stop them in their tracks. If you need assistance stop by the FreeSWITCH IRC channel on Freenode #freeswitch and ask around... If you need professional help email consulting@freeswitch.org and they will help you out. K On 2/20/13 2:35 AM, "Avi Marcus" <avi@avimarcus.net> wrote: Personally, I've seen the last option -- CDRs for calls that have been rejected. They come in on the public profile, attempt to call a single number with several prefix types... but they are indeed unauthenticated so FS just hangs up on them. -Avi On Wed, Feb 20, 2013 at 10:14 AM, Steven Ayre <steveayre@gmail.com> wrote: Not unusual at all, and not even clever... there are lots of bots that just randomly search the net for IP addresses that're open to allowing calls. First, are you sure the profile is actually requiring authentication (a simple packet trace will reveal that - the first INVITE should get a 401 reply). Second, do you have blind auth enabled, in which case it'd be accepting any username/password? Third, are they getting authenticated via an ACL or user CIDR? Finally, is it possible that you're loading CDRs for calls which have been rejected? -Steve On 20 February 2013 07:28, Mario Karakanovski <mario@ims.bg> wrote:
Hi all,
For some days i noticed that somebody was able to register to my freeswitch and trying to call international numbers. The attack is very clever as the hacker logs at the night, trying to call international number 10-15 times while changing the prefix and go away.
The sip profile is connected directly to the internet and require authentication: auth-calls = true auth-all-packets = true
There is no IP filtering as the service does not allow setting some. Firewall blokes all port except TCP and UDP 5060 and required UDP media ports. The authentication is made by directory. What I wonder is how ones can authenticated with extension that not exist and not described anywhere.
Can it be some security issue with freeswitch? Any ideas how to solve the problem?
Regards, Mario
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _____ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote:
Thanks Ken,****
** **
It is helpful, but I still think there is some security issue. I’ve double check configuration. I’ve try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected – calls/authentication was rejected. I’ve decide to log the traffic – maybe I will be able to see where is the problem.
What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban>and just shut the door on them when they fail too many times. -Michael
I have also had the situation that they are calls getting rejected. On Wed, Feb 20, 2013 at 11:08 AM, Michael Collins <msc@freeswitch.org>wrote:
On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote:
Thanks Ken,****
** **
It is helpful, but I still think there is some security issue. I’ve double check configuration. I’ve try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected – calls/authentication was rejected. I’ve decide to log the traffic – maybe I will be able to see where is the problem.
What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban>and just shut the door on them when they fail too many times.
-Michael
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Blakelund Priddy* Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 http://www.bryantschools.org p 501-653-5038 f 501-847-5656
Aren't they supposed to be rejected? On Wed, Feb 20, 2013 at 11:19 AM, Blake Priddy <bpriddy@bryantschools.org>wrote:
I have also had the situation that they are calls getting rejected.
On Wed, Feb 20, 2013 at 11:08 AM, Michael Collins <msc@freeswitch.org>wrote:
On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote:
Thanks Ken,****
** **
It is helpful, but I still think there is some security issue. I’ve double check configuration. I’ve try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected – calls/authentication was rejected. I’ve decide to log the traffic – maybe I will be able to see where is the problem.
What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban>and just shut the door on them when they fail too many times.
-Michael
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Blakelund Priddy* Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 http://www.bryantschools.org p 501-653-5038 f 501-847-5656
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
In my situation all calls are rejected, but I think it is because they are authenticated with invalid username. My concern is how ones can authenticate in freeswitch with user that not exists and never was configured. I was not able to reproduce that. What I found so far: they use a couple of IPs. They send OPTIONS (only one time) during the day and start try at the night. They tried a maximum of 100 calls. I am still waiting to log some packet Mario _____ From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Michael Collins Sent: Wednesday, February 20, 2013 10:41 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] freeswitch hack Aren't they supposed to be rejected? On Wed, Feb 20, 2013 at 11:19 AM, Blake Priddy <bpriddy@bryantschools.org> wrote: I have also had the situation that they are calls getting rejected. On Wed, Feb 20, 2013 at 11:08 AM, Michael Collins <msc@freeswitch.org> wrote: On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote: Thanks Ken, It is helpful, but I still think there is some security issue. I've double check configuration. I've try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected - calls/authentication was rejected. I've decide to log the traffic - maybe I will be able to see where is the problem. What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban> and just shut the door on them when they fail too many times. -Michael _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Blakelund Priddy Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 <http://www.bryantschools.org/> http://www.bryantschools.org p 501-653-5038 f 501-847-5656 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
They can't auth with a username that does not exist. The best they can do is try to guess user names and passwords. That's where Ken's best practices are quite useful. -MC On Wed, Feb 20, 2013 at 10:35 PM, Mario Karakanovski <mario@ims.bg> wrote:
In my situation all calls are rejected, but I think it is because they are authenticated with invalid username.****
My concern is how ones can authenticate in freeswitch with user that not exists and never was configured. I was not able to reproduce that.****
What I found so far: they use a couple of IPs. They send OPTIONS (only one time) during the day and start try at the night. They tried a maximum of 100 calls.****
I am still waiting to log some packet****
** **
Mario ****
** ** ------------------------------
*From:* freeswitch-users-bounces@lists.freeswitch.org [mailto: freeswitch-users-bounces@lists.freeswitch.org] *On Behalf Of *Michael Collins *Sent:* Wednesday, February 20, 2013 10:41 PM *To:* FreeSWITCH Users Help *Subject:* Re: [Freeswitch-users] freeswitch hack****
** **
Aren't they supposed to be rejected?****
On Wed, Feb 20, 2013 at 11:19 AM, Blake Priddy <bpriddy@bryantschools.org> wrote:****
I have also had the situation that they are calls getting rejected.****
** **
On Wed, Feb 20, 2013 at 11:08 AM, Michael Collins <msc@freeswitch.org> wrote:****
** **
On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote:* ***
Thanks Ken,****
****
It is helpful, but I still think there is some security issue. I’ve double check configuration. I’ve try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected – calls/authentication was rejected. I’ve decide to log the traffic – maybe I will be able to see where is the problem.****
** **
What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban>and just shut the door on them when they fail too many times.
-Michael
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org****
****
** **
-- ****
*Blakelund Priddy*****
Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 http://www.bryantschools.org****
p 501-653-5038 f 501-847-5656****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org****
-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org****
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
Definitely my fault! Somebody was open internet to test environment where external profile does not require authentication. Mario _____ From: Mario Karakanovski [mailto:mario@ims.bg] Sent: Thursday, February 21, 2013 8:36 AM To: 'FreeSWITCH Users Help' Subject: RE: [Freeswitch-users] freeswitch hack In my situation all calls are rejected, but I think it is because they are authenticated with invalid username. My concern is how ones can authenticate in freeswitch with user that not exists and never was configured. I was not able to reproduce that. What I found so far: they use a couple of IPs. They send OPTIONS (only one time) during the day and start try at the night. They tried a maximum of 100 calls. I am still waiting to log some packet Mario _____ From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Michael Collins Sent: Wednesday, February 20, 2013 10:41 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] freeswitch hack Aren't they supposed to be rejected? On Wed, Feb 20, 2013 at 11:19 AM, Blake Priddy <bpriddy@bryantschools.org> wrote: I have also had the situation that they are calls getting rejected. On Wed, Feb 20, 2013 at 11:08 AM, Michael Collins <msc@freeswitch.org> wrote: On Wed, Feb 20, 2013 at 1:53 AM, Mario Karakanovski <mario@ims.bg> wrote: Thanks Ken, It is helpful, but I still think there is some security issue. I've double check configuration. I've try to reproduce the issue trying to do direct call (TCP and UDP) or authenticate with invalid user, but everything works as expected - calls/authentication was rejected. I've decide to log the traffic - maybe I will be able to see where is the problem. What "security issue"? You said that they cannot make calls with the passwords that they've guessed, correct? About the only thing left to do is set up fail2ban <http://wiki.freeswitch.org/wiki/Fail2ban> and just shut the door on them when they fail too many times. -Michael _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Blakelund Priddy Network Systems Engineer Bryant Public School District Bryant, Arkansas 72022 <http://www.bryantschools.org/> http://www.bryantschools.org p 501-653-5038 f 501-847-5656 _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org -- Michael S Collins Twitter: @mercutioviz http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org
participants (11)
-
Avi Marcus
-
Blake Priddy
-
Dmitry Lysenko
-
Giovanni Maruzzelli
-
Giovanni Maruzzelli
-
Itamar Reis Peixoto
-
Ken Rice
-
Mario Karakanovski
-
Michael Collins
-
PolyMorphiK
-
Steven Ayre