[Freeswitch-users] Hacker Attack?

[Madovsky]

fail2ban on wiki
  ----- Original Message ----- 
  From: Joao Leme 
  To: FreeSWITCH Users Help 
  Sent: Saturday, January 29, 2011 7:20 PM
  Subject: Re: [Freeswitch-users] Hacker Attack?


  How do I do that?
  Thanks!


  On Sat, Jan 29, 2011 at 4:12 PM, curriegrad2004 <curriegrad2004 at gmail.com> wrote:

    Try using iptables and block all incoming traffic from this specific host?


    On Sat, Jan 29, 2011 at 3:39 PM, Joao Leme <joaocarlosleme at gmail.com> wrote:
    > I just downloaded and compiled the latest Git and a little after starting
    > freeswitch I'm getting non stop the following:
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [140 at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > [WARNING] sofia_reg.c:1247 SIP auth challenge (REGISTER) on sofia profile
    > ‘internal’ for [thomas at 76.XXX.XX.XXX] from ip 212.224.71.236
    > it's non-stop and doesn't let me do nothing else. After the first time I
    > went on to vars and changed the 1234 password....restarted and same thing
    > happened, I also try denying the ip on acl.conf (not sure if has something
    > to do with it but gave it a try):
    >
    > <configuration name="acl.conf" description="Network Lists">
    >         <network-lists>
    >           <list name="test2" default="allow">
    >             <node type="deny" host="212.224.71.236" mask="255.255.255.0"/>
    >           </list>
    >         </network-lists>
    >       </configuration>
    >
    > Restarted the computer but nothing, he (thomas I guess) was back on my
    > console.
    >
    > Any ideas??? p.s. My computer is on DMZ (I know DMZ is not ideal but is the
    > only way I got to be able to connect to the internal profile from out of the
    > office etc).

    > _______________________________________________
    > FreeSWITCH-users mailing list
    > FreeSWITCH-users at lists.freeswitch.org
    > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
    > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
    > http://www.freeswitch.org
    >
    >

    _______________________________________________
    FreeSWITCH-users mailing list
    FreeSWITCH-users at lists.freeswitch.org
    http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
    UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
    http://www.freeswitch.org





------------------------------------------------------------------------------


  _______________________________________________
  FreeSWITCH-users mailing list
  FreeSWITCH-users at lists.freeswitch.org
  http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
  UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
  http://www.freeswitch.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20110129/2dc32b58/attachment.html