There are lots of ways to solve this, and NOT to solve this. Don't start adding lots of rules to iptables (or deep per packet inspection requirements) as this will hurt capacity...and it doesn't really solve the problem
Take a look at http://www.voip-info.org/wiki/view/Asterisk+security If you are running a small system I recommend trying the free version of SecAst. If you're running a larger PBX, the SecAst GeoIP blocking (deny/allow by country/city/etc) will remove 99% of the attacks. Take a good look at the page above for options...free/paid, software/hardware Michelle *All opinions are my own, and do not represent my employer. Since I'm employed by GenerationD, you can bet that my opinions are biased :) ________________________________ From: asterisk-users-boun...@lists.digium.com <asterisk-users-boun...@lists.digium.com> on behalf of Rainer Piper <rainer.pi...@soho-piper.de> Sent: Friday, October 3, 2014 2:15 PM To: Asterisk Users List Subject: Re: [asterisk-users] PBX hacked: why hundred of calls to the same number ? Hi Chris, yes ... it is boring ... I stop posting ... ;-) Am 03.10.2014 um 20:11 schrieb Chris Bagnall: On 3/10/14 6:52 pm, Rainer Piper wrote: the attacking server changed the destination Number at 18:53 CEST and he is still blocked ... LOL 972597438354 <callto:00972597438354><callto:00972597438354> It's pretty much an everyday occurrence for any internet-connected SIP system these days... Oct 3 19:46:20 server /sbin/kamailio[3977]: NOTICE: <script>: blocking IP 62.210.149.136 sipcli/v1.8 rm=INVITE aU=<null> rU=100972597438354 Many of these attacks come from fairly easily recognised user-agent strings, so if you fancy doing a bit of packet inspection with your firewall, you can block many of these before they get as far as your SIP server(s) themselves. For example, the sipcli scans you listed above can be blocked fairly easily with: iptables -A INPUT -p udp --dport 5060 -m string --algo bm --string "sipcli" -j DROP (obviously there are overheads to string searching UDP/5060 packets that you'll want to consider, and the above won't work if you're using sipcli legitimately anywhere on your network) Kind regards, Chris -- Rainer Piper Integration engineer Koeslinstr. 56 53123 BONN GERMANY Phone: +49 228 97167161 P2P: sip:rai...@sip.soho-piper.de:5072 (pjsip-test) XMPP: rai...@xmpp.soho-piper.de<mailto:rai...@xmpp.soho-piper.de>
-- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
