Hi, We suffered an SIP attack from 67.23.236.75. It attempted to register to our SIP server using bruce force. We are running FS on a PC as our office PBX. When all phone failed, we noticed a high CPU load with 90%+ waiting or nice, and in the meantime it used up memory and start swapping to disk. It's a cheap PC with only 700MB memory, and we are running FS, DB, Rails and other system on it. So it took me some time to check every part. And it didn't help even I did a full server reboot. Finally I turned on sip trace in FS and found thousands and millions of illegal registers. And then I blocked the IP in iptables. During the hard time, I noticed: 1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ? 2) CPU also waiting page swap when used up memory. 3) After I dropped all packets from that IP, FS still kept sending register error sip messages for quite a long time before I restarted FS. Now looking to add http://wiki.freeswitch.org/wiki/Fail2ban, hope this helps . Hope this helps if some one also suffered this. 7. -- Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn
fail2ban is works like a charm for that... ----- Original Message ----- From: "Seven Du" <dujinfang@gmail.com> To: "freeswitch-users" <freeswitch-users@lists.freeswitch.org> Sent: Sunday, August 08, 2010 9:24 PM Subject: [Freeswitch-users] we are under attack Hi, We suffered an SIP attack from 67.23.236.75. It attempted to register to our SIP server using bruce force. We are running FS on a PC as our office PBX. When all phone failed, we noticed a high CPU load with 90%+ waiting or nice, and in the meantime it used up memory and start swapping to disk. It's a cheap PC with only 700MB memory, and we are running FS, DB, Rails and other system on it. So it took me some time to check every part. And it didn't help even I did a full server reboot. Finally I turned on sip trace in FS and found thousands and millions of illegal registers. And then I blocked the IP in iptables. During the hard time, I noticed: 1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ? 2) CPU also waiting page swap when used up memory. 3) After I dropped all packets from that IP, FS still kept sending register error sip messages for quite a long time before I restarted FS. Now looking to add http://wiki.freeswitch.org/wiki/Fail2ban, hope this helps . Hope this helps if some one also suffered this. 7. -- Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn _______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ? Your FS uses a single process, and the operating systems need multiple processes to fully utilize multiple cores. It's major difference between threads and processes on this. Jan
THIS : http://etel.wiki.oreilly.com/wiki/index.php/SIP_DoS/DDoS_Mitigation also works quite well for these attacks.. they wont stop the brute force ( you will need to configure fail2ban for that ) but this will setup iptables to rate limit any sip connections, so your pc wont get that loaded. you can thank Kristian Kielhofner ( a member of the FS community ) for that neat little script :) maybe we can copy that script ( Kristian ?? ) to the Freeswitch wiki.. ( with a few modifications ).. be careful of the STOP command on that script its defective ! ( and will wipe all firewall rules, especially dangerous if you drop all by default ) Jay On Mon, Aug 9, 2010 at 5:03 PM, Jan Berger <jan.berger@video24.no> wrote:
1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ?
Your FS uses a single process, and the operating systems need multiple processes to fully utilize multiple cores. It's major difference between threads and processes on this.
Jan
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
The current version of the script and a little background can be found here: http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html I have no problem linking the FS wiki to either of these but the eTel wiki will probably get taken down eventually. As far as the issue with the stop command... I remember us talking about it but I don't remember the specific problem. Care to refresh my memory? On Mon, Aug 9, 2010 at 3:19 AM, jay binks <jaybinks@gmail.com> wrote:
THIS : http://etel.wiki.oreilly.com/wiki/index.php/SIP_DoS/DDoS_Mitigation also works quite well for these attacks.. they wont stop the brute force ( you will need to configure fail2ban for that ) but this will setup iptables to rate limit any sip connections, so your pc wont get that loaded. you can thank Kristian Kielhofner ( a member of the FS community ) for that neat little script :) maybe we can copy that script ( Kristian ?? ) to the Freeswitch wiki.. ( with a few modifications ).. be careful of the STOP command on that script its defective ! ( and will wipe all firewall rules, especially dangerous if you drop all by default ) Jay
-- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com
with your permission ill probably copy the script to the FS wiki, and attribute it with links to the other locations. ( that way we dont rely on a 3rd party site to stay up ) as for the issue with STOP... .. i removes all rules :) and if you have the default set to drop all incoming, then .. well your stuffed.. STOP should just back out the rules that the script added, not remove everything J On Tue, Aug 10, 2010 at 12:23 AM, Kristian Kielhofner <kris@kriskinc.com>wrote:
The current version of the script and a little background can be found here:
http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html
I have no problem linking the FS wiki to either of these but the eTel wiki will probably get taken down eventually.
As far as the issue with the stop command... I remember us talking about it but I don't remember the specific problem. Care to refresh my memory?
I had a similar problem a couple of weeks ago. I was hit from IP's in China and Finland. In the end I created an iptables chain to just allow Australian IP's only as we only expect to see Australian IP's, I obtained the list from http://www.ipaddresslocation.org. Then I create a log rule to log any drop connections to /var/log/messages and use nagios check_log to email me if there are any drops, this way I can be sure its only Australian IP's. I also added some rate limiting to ports 5060-5080. To date we have not had anymore issues... Touch wood!. On 09/08/2010, at 11:24 AM, Seven Du wrote:
Hi,
We suffered an SIP attack from 67.23.236.75. It attempted to register to our SIP server using bruce force.
We are running FS on a PC as our office PBX. When all phone failed, we noticed a high CPU load with 90%+ waiting or nice, and in the meantime it used up memory and start swapping to disk.
It's a cheap PC with only 700MB memory, and we are running FS, DB, Rails and other system on it. So it took me some time to check every part. And it didn't help even I did a full server reboot. Finally I turned on sip trace in FS and found thousands and millions of illegal registers. And then I blocked the IP in iptables.
During the hard time, I noticed:
1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ?
2) CPU also waiting page swap when used up memory.
3) After I dropped all packets from that IP, FS still kept sending register error sip messages for quite a long time before I restarted FS.
Now looking to add http://wiki.freeswitch.org/wiki/Fail2ban, hope this helps .
Hope this helps if some one also suffered this.
7.
-- Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (6)
-
Ash
-
Jan Berger
-
jay binks
-
Kristian Kielhofner
-
Madovsky
-
Seven Du