Re: [asterisk-users] (no subject)

2014-09-04 Thread Ishfaq Malik
If you're using a redhat based distro, have you checked SELinux? Try
disabling (will require a server reboot)

Regards

Ish


On 3 September 2014 20:41, Steve Edwards asterisk@sedwards.com wrote:

 For future reference, a well chosen subject will yield more relevant
 replies.

 Better bait == better fish.

 --
 Thanks in advance,
 -
 Steve Edwards   sedwa...@sedwards.com  Voice: +1-760-468-3867 PST
 Newline  Fax: +1-760-731-3000


 --
 _
 -- Bandwidth and Colocation Provided by http://www.api-digital.com --
 New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

 asterisk-users mailing list
 To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users




-- 

Ishfaq Malik
Department: VOIP Support
Company: Packnet Limited
t: +44 (0)845 004 4994
f: +44 (0)161 660 9825
e: i...@pack-net.co.uk
w: http://www.pack-net.co.uk

Registered Address: PACKNET LIMITED, Duplex 2, Ducie House
37 Ducie Street
Manchester, M1 2JW
COMPANY REG NO. 04920552
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

[asterisk-users] opus 11.12.0

2014-09-04 Thread Marek Cervenka

hi,

any plans update patch for 11.12.0?

|https://github.com/meetecho/asterisk-opus
https://github.com/netaskd/asterisk-opus/
|



patching file build_tools/menuselect-deps.in
patching file channels/chan_sip.c
Hunk #1 succeeded at 7659 (offset -98 lines).
Hunk #2 succeeded at 11011 (offset -34 lines).
Hunk #3 succeeded at 11050 (offset -34 lines).
Hunk #4 succeeded at 7 with fuzz 1 (offset -34 lines).
Hunk #5 FAILED at 12722.
1 out of 6 hunks FAILED -- saving rejects to file channels/chan_sip.c.rej
patching file codecs/codec_opus.c
patching file codecs/ex_opus.h
patching file configure.ac
Hunk #2 succeeded at 2150 (offset 31 lines).
patching file formats/format_vp8.c
patching file include/asterisk/format.h
patching file main/channel.c
patching file main/format.c
Hunk #6 succeeded at 1098 (offset 12 lines).
patching file main/frame.c
patching file main/rtp_engine.c
Hunk #1 succeeded at 2326 (offset 37 lines).
Hunk #2 succeeded at 2370 (offset 37 lines).
patching file makeopts.in
patching file res/res_rtp_asterisk.c
Hunk #1 succeeded at 95 with fuzz 1 (offset 4 lines).
Hunk #2 FAILED at 349.
Hunk #3 succeeded at 3011 (offset 394 lines).
Hunk #4 succeeded at 3097 (offset 394 lines).
1 out of 4 hunks FAILED -- saving rejects to file res/res_rtp_asterisk.c.rej

thanks

--
---
Marek Cervenka
===

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

[asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread motty cruz
Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

[Sep  4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite:
Call from '' (213.136.81.166:9306) to extension '34422' rejected because
extension not found in context 'default'.

Thanks in advance,
-Motty
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Patrick Laimbock

On 04-09-14 16:44, motty cruz wrote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to
block that IP?

[Sep  4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite:
Call from '' (213.136.81.166:9306 http://213.136.81.166:9306) to
extension '34422' rejected because extension not found in context 'default'.


Have a look at Fail2ban:
http://www.fail2ban.org/wiki/index.php/Main_Page

HTH,
Patrick

--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
  http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Thorsten Göllner


Am 04.09.2014 16:44, schrieb motty cruz:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to 
block that IP?


[Sep  4 07:41:06] NOTICE[7375]: chan_sip.c:23375 
handle_request_invite: Call from '' (213.136.81.166:9306 
http://213.136.81.166:9306) to extension '34422' rejected because 
extension not found in context 'default'.




You should not invest time in blocking single IPs. Take a look at 
fail2ban.

http://www.fail2ban.org/wiki/index.php/Asterisk

-Thorsten-
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread motty cruz
Thanks, looks like fail2ban is the way to go, I would prefer a different
alternatives if there is one. I tried deny=IP/netmask but did not work for
me, in sip.conf. seems like fail2ban is what you all are using, so I will
give it a try.

Thanks,


On Thu, Sep 4, 2014 at 7:58 AM, Thorsten Göllner t...@ovm-group.com wrote:


 Am 04.09.2014 16:44, schrieb motty cruz:

  Hi All,
 I see this kind of attack on our Asterisk Server, do you know how to block
 that IP?

  [Sep  4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite:
 Call from '' (213.136.81.166:9306) to extension '34422' rejected because
 extension not found in context 'default'.


 You should not invest time in blocking single IPs. Take a look at
 fail2ban.
 http://www.fail2ban.org/wiki/index.php/Asterisk

 -Thorsten-

 --
 _
 -- Bandwidth and Colocation Provided by http://www.api-digital.com --
 New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

 asterisk-users mailing list
 To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

[asterisk-users] Unable to connect to remote asterisk

2014-09-04 Thread Anthony Azzopardi
solved, permissions problem. Asterisks run with user asterisk at default, I
changed to asteriskpbx as the book says ;)

 

 

  _  

From: asterisk-users-boun...@lists.digium.com
[mailto:asterisk-users-boun...@lists.digium.com] On Behalf Of Anthony
Azzopardi
Sent: 03 September 2014 20:57
To: asterisk-users@lists.digium.com
Subject: [asterisk-users] (no subject)

 

Hello asterisk-users,

 

Just compiled and installed 11.12.0 however when I try to connect with
rasterisk I get:

 

Unable to connect to remote asterisk (does /var/run/asterisk/asterisk.ctl
exist?)

 

It seems that asterisk.ctl is not created.

 

 

 

 

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread A J Stiles
On Thursday 04 Sep 2014, motty cruz wrote:
 Hi All,
 I see this kind of attack on our Asterisk Server, do you know how to block
 that IP?

Instead of blocking unwanted IPs, you should be permitting only wanted IPs.

-- 
AJS

Note:  Originating address only accepts e-mail from list!  If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread motty cruz
Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions
outside the office with dynamic IPs, so that is not a possibility. Thanks
for your suggestions, I will try fail2ban. I don't know how complicated is
to implement that on production server.

Thanks,
-Motty


On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles asterisk_l...@earthshod.co.uk
wrote:

 On Thursday 04 Sep 2014, motty cruz wrote:
  Hi All,
  I see this kind of attack on our Asterisk Server, do you know how to
 block
  that IP?

 Instead of blocking unwanted IPs, you should be permitting only wanted IPs.

 --
 AJS

 Note:  Originating address only accepts e-mail from list!  If replying off-
 list, change address to asterisk1list at earthshod dot co dot uk .

 --
 _
 -- Bandwidth and Colocation Provided by http://www.api-digital.com --
 New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

 asterisk-users mailing list
 To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Hashmat Khan
dont forgot to put your trusted IPs into ignoreip list while configuring 
fail2ban
its very important when a customer (may be 100+ extns) are behind NAT and only 
present single public IP
RgdsHash

Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.c...@gmail.com
To: asterisk-users@lists.digium.com
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

Hi A J, believe me, I wish i do as you suggested, however I have a few 
extensions outside the office with dynamic IPs, so that is not a possibility. 
Thanks for your suggestions, I will try fail2ban. I don't know how complicated 
is to implement that on production server. 

Thanks, 
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles asterisk_l...@earthshod.co.uk 
wrote:

On Thursday 04 Sep 2014, motty cruz wrote:

 Hi All,

 I see this kind of attack on our Asterisk Server, do you know how to block

 that IP?



Instead of blocking unwanted IPs, you should be permitting only wanted IPs.



--

AJS



Note:  Originating address only accepts e-mail from list!  If replying off-

list, change address to asterisk1list at earthshod dot co dot uk .



--

_

-- Bandwidth and Colocation Provided by http://www.api-digital.com --

New to Asterisk? Join us for a live introductory webinar every Thurs:

   http://www.asterisk.org/hello



asterisk-users mailing list

To UNSUBSCRIBE or update options visit:

   http://lists.digium.com/mailman/listinfo/asterisk-users




-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users  
  -- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Eric Wieling
If we don't need to allow access from outside the USA we block access from all 
non-ARIN IP addresses by using iptables.   This takes care of at least 80% of 
attacks.

I enabled guest access and pointed all guest calls to an IVR which auto 
disconnects the call after a while (2 min seems good) if there is no response.  
 That took care of most of the remaining attacks.

I'm considering enabling auto create peer and routing calls to the same IVR as 
above.

We also use fail2ban, but mostly for non-SIP attacks.

Before enabling any guest access be ABSOLUTELY SURE you know how to do it 
without causing security issues.

From: asterisk-users-boun...@lists.digium.com 
[mailto:asterisk-users-boun...@lists.digium.com] On Behalf Of Hashmat Khan
Sent: Thursday, September 04, 2014 3:45 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

dont forgot to put your trusted IPs into ignoreip list while configuring 
fail2ban

its very important when a customer (may be 100+ extns) are behind NAT and only 
present single public IP

Rgds
Hash

Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.c...@gmail.commailto:motty.c...@gmail.com
To: asterisk-users@lists.digium.commailto:asterisk-users@lists.digium.com
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack
Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions 
outside the office with dynamic IPs, so that is not a possibility. Thanks for 
your suggestions, I will try fail2ban. I don't know how complicated is to 
implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles 
asterisk_l...@earthshod.co.ukmailto:asterisk_l...@earthshod.co.uk wrote:
On Thursday 04 Sep 2014, motty cruz wrote:
 Hi All,
 I see this kind of attack on our Asterisk Server, do you know how to block
 that IP?
Instead of blocking unwanted IPs, you should be permitting only wanted IPs.

--
AJS

Note:  Originating address only accepts e-mail from list!  If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users


-- _ -- 
Bandwidth and Colocation Provided by http://www.api-digital.com -- New to 
Asterisk? Join us for a live introductory webinar every Thurs: 
http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or 
update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Failover / modifying response time

2014-09-04 Thread Stephen More
I was able to get a packet trace of this event

Time
312.353549 - INVITE to primary
313.222303 - INVITE to primary ( suspected resend of frame )
314.289215 - INVITE to backup
315.397120 - INVITE to backup ( suspected resend of frame )

So is primary just too slow to answer ? I am not seeing anything in the
logs on primary.



On Wed, Sep 3, 2014 at 2:39 PM, Stephen More stephen.m...@gmail.com wrote:

 I have two real time asterisk boxes configured to accept incoming or
 outgoing calls at any time.

 All the users are configured to send their calls to primary. If primary is
 down calls will go to backup.
 All incoming SIP calls should be sent to primary. If primary is down
 incoming calls will go to backup.

 99.9% of the time it works as designed.

 Every once in a while my SIP provider will send a sip call to our backup.
 primary is working fine. When asked they responded with it's possible
 primary didn't respond fast enough so backup grabbed it. You should lower
 the response time on primary and raise it on backup

 What setting is he referring to ? Can I tweak a setting to make our backup
 server respond slower so that the primary answers the call ?


 -Thanks

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Michelle Dupuis
You can also take a look at SecAst (www.generationd.com).The free version 
is a drop-in replacement for fail2ban but also add a lot more intelligence (and 
no need to update regex's etc). There's also geographic IP fencing so you can 
block attacks by country / region / city etc., only allow access by geography, 
etc.  And a whole lot more (including detection of breached but valid 
credentials to halt ongoing fraud, etc)


-=M=-


The opinions above are my own, and don't necessarily represent those of my 
employer.  Since I'm employed by Generation D however you can bet that I have a 
serious bias :)



From: asterisk-users-boun...@lists.digium.com 
asterisk-users-boun...@lists.digium.com on behalf of Eric Wieling 
ewiel...@nyigc.com
Sent: Thursday, September 4, 2014 11:58 AM
To: Asterisk Users List
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

If we don't need to allow access from outside the USA we block access from all 
non-ARIN IP addresses by using iptables.   This takes care of at least 80% of 
attacks.

I enabled guest access and pointed all guest calls to an IVR which auto 
disconnects the call after a while (2 min seems good) if there is no response.  
 That took care of most of the remaining attacks.

I'm considering enabling auto create peer and routing calls to the same IVR as 
above.

We also use fail2ban, but mostly for non-SIP attacks.

Before enabling any guest access be ABSOLUTELY SURE you know how to do it 
without causing security issues.

From: asterisk-users-boun...@lists.digium.com 
[mailto:asterisk-users-boun...@lists.digium.com] On Behalf Of Hashmat Khan
Sent: Thursday, September 04, 2014 3:45 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

dont forgot to put your trusted IPs into ignoreip list while configuring 
fail2ban

its very important when a customer (may be 100+ extns) are behind NAT and only 
present single public IP

Rgds
Hash


Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.c...@gmail.commailto:motty.c...@gmail.com
To: asterisk-users@lists.digium.commailto:asterisk-users@lists.digium.com
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack
Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions 
outside the office with dynamic IPs, so that is not a possibility. Thanks for 
your suggestions, I will try fail2ban. I don't know how complicated is to 
implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles 
asterisk_l...@earthshod.co.ukmailto:asterisk_l...@earthshod.co.uk wrote:
On Thursday 04 Sep 2014, motty cruz wrote:
 Hi All,
 I see this kind of attack on our Asterisk Server, do you know how to block
 that IP?
Instead of blocking unwanted IPs, you should be permitting only wanted IPs.

--
AJS

Note:  Originating address only accepts e-mail from list!  If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

--
_
-- Bandwidth and Colocation Provided by 
http://www.api-digital.comhttp://www.api-digital.com/ --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users


-- _ -- 
Bandwidth and Colocation Provided by 
http://www.api-digital.comhttp://www.api-digital.com/ -- New to Asterisk? 
Join us for a live introductory webinar every Thurs: 
http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or 
update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Steve Edwards

Please don't top post.

On Thu, 4 Sep 2014, motty cruz wrote:

Hi A J, believe me, I wish i do as you suggested, however I have a few 
extensions outside the office with dynamic IPs, so that is not a 
possibility.


Do your few extensions travel to China, Russia, Iran, Iraq, North Korea, 
etc? (Sorry if I stepped on anybody's toes.)


If you configure iptables to drop all and then only allow the few IP 
address ranges you really need, 90% of the problem is solved. Then use 
fail2ban to manage the remaining anklebitters.


--
Thanks in advance,
-
Steve Edwards   sedwa...@sedwards.com  Voice: +1-760-468-3867 PST
Newline  Fax: +1-760-731-3000-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread A J Stiles
On Thursday 04 Sep 2014, motty cruz wrote:
 Hi A J,
 believe me, I wish i do as you suggested, however I have a few extensions
 outside the office with dynamic IPs, so that is not a possibility.

If you know what ISPs they are using, then you can allow just those ISPs' 
address ranges.  That will slow things down, by requiring an attacker to be 
using the same ISP as a legitimate user.

 Thanks
 for your suggestions, I will try fail2ban. I don't know how complicated is
 to implement that on production server.

It's fairly easy -- but note that physical access to the server's console is 
highly desirable, lest you accidentally block yourself out from using ssh  
(not a mistake you want to make too many times).  


-- 
AJS

Note:  Originating address only accepts e-mail from list!  If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread Chris Bagnall

On 4/9/14 4:58 pm, Eric Wieling wrote:

If we don't need to allow access from outside the USA we block access from all 
non-ARIN IP addresses by using iptables.   This takes care of at least 80% of 
attacks.


Likewise here (though RIPE rather than ARIN, since we're the other side 
of the pond).


You can also take it a bit further: if, for example, you know what 
ISP(s) your dynamic clients are using, you can limit connections to the 
IP ranges those ISP(s) use - look up their ranges on he.net's BGP 
looking glass if you need to find out what ranges they're using.


Another thing I've been playing with of late is using iptables' string 
matching functionality to block user agents of known attack vectors: 
'sipcli', 'sipvicious', 'friendly-scanner', etc.


This seems to work remarkably well, though what impact it has on net 
performance under load remains to be seen.


Kind regards,

Chris
--
This email is made from 100% recycled electrons

--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
  http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Asterisk secure fine tune - stop attack

2014-09-04 Thread motty cruz
Thank you all for your support, your suggestions are welcome.
Thanks,


On Thu, Sep 4, 2014 at 9:26 AM, Chris Bagnall aster...@lists.minotaur.cc
wrote:

 On 4/9/14 4:58 pm, Eric Wieling wrote:

 If we don't need to allow access from outside the USA we block access
 from all non-ARIN IP addresses by using iptables.   This takes care of at
 least 80% of attacks.


 Likewise here (though RIPE rather than ARIN, since we're the other side of
 the pond).

 You can also take it a bit further: if, for example, you know what ISP(s)
 your dynamic clients are using, you can limit connections to the IP ranges
 those ISP(s) use - look up their ranges on he.net's BGP looking glass if
 you need to find out what ranges they're using.

 Another thing I've been playing with of late is using iptables' string
 matching functionality to block user agents of known attack vectors:
 'sipcli', 'sipvicious', 'friendly-scanner', etc.

 This seems to work remarkably well, though what impact it has on net
 performance under load remains to be seen.

 Kind regards,

 Chris
 --
 This email is made from 100% recycled electrons


 --
 _
 -- Bandwidth and Colocation Provided by http://www.api-digital.com --
 New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

 asterisk-users mailing list
 To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

[asterisk-users] Special functionality for Secretary/Boss

2014-09-04 Thread Carlos Chavez
We are currently migrating from a Nortel pbx to Asterisk and we 
have been able to convert most of the functions that people are used to 
but there is one I have no clear idea how to do.  The scenario is:


Boss calls secretary from outside the office to get connected to 
another outside destination.  The secretary dials the destination and 
then trasfers call to the boss.  When boss finishes with that person 
they want to send the call back to the secretary in order to make 
another connection or simply to talk to the secretary.


The first part is not a problem, but after the boss finishes his 
call how can we send the call back to the secretary?  I was thinking of 
using a conference room but how would the secretary know when the boss 
has finished?  Anyone know how to handle this scenario?


--
Telecomunicaciones Abiertas de México S.A. de C.V.
Carlos Chávez
+52 (55)9116-91161


--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
  http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Special functionality for Secretary/Boss

2014-09-04 Thread jg
Why can't you continue within the extension and dispatch whether the call failed or terminated? 
Simply make a second call.


jg

--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
  http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
  http://lists.digium.com/mailman/listinfo/asterisk-users


Re: [asterisk-users] Special functionality for Secretary/Boss

2014-09-04 Thread Kevin Larsen
asterisk-users-boun...@lists.digium.com wrote on 09/04/2014 11:57:40 AM:
  We are currently migrating from a Nortel pbx to Asterisk and we 
 have been able to convert most of the functions that people are used to 
 but there is one I have no clear idea how to do.  The scenario is:
 
  Boss calls secretary from outside the office to get connected to 
 another outside destination.  The secretary dials the destination and 
 then trasfers call to the boss.  When boss finishes with that person 
 they want to send the call back to the secretary in order to make 
 another connection or simply to talk to the secretary.
 
  The first part is not a problem, but after the boss finishes his 
 call how can we send the call back to the secretary?  I was thinking of 
 using a conference room but how would the secretary know when the boss 
 has finished?  Anyone know how to handle this scenario?

I haven't tested this, but my initial thought would be to create a special 
context or extension that the secretary could route through when doing the 
call transfer. The Dial application could be called with the 'g' option to 
continue the dialplan at the next priority when the call hangs up. 
Something like a normal call transfer would just dial the number as 
normal, but for the special transfer, you could prepend the dialed number 
with a #.

For example (using a local US dialstring, change to fit your needs):

; This is a normal external call.
exten = _NXXNXXX,1,Dial(SIP/your_external_trunk/${EXTEN})
  same = n,Hangup()

; This is a call that should be transfered back to the secretary's 
extension when external call is finished
exten = _#NXXNXXX,1,NoOp(Special Dial for Boss/Secretary Transfer)
  same = n,Dial(SIP/your_external_trunk/${EXTEN:1},,g)
; First call has ended, now we go back to the secretary)
  same = n,Dial(SIP/1234)
  same = n,Hangup()

That's at least where I would start with my testing and then develop the 
solution from there.-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Special functionality for Secretary/Boss

2014-09-04 Thread Eric Wieling
Sounds like you are running FreePBX.

From: asterisk-users-boun...@lists.digium.com 
[mailto:asterisk-users-boun...@lists.digium.com] On Behalf Of Mitul Limbani
Sent: Thursday, September 04, 2014 6:34 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Special functionality for Secretary/Boss


Kevin,

With your dialplan with g option on external trunk, if the call finishes the 
boss's leg of call also gets disconnected. So the next instruction would make a 
call to secratary, however with no one on other end.

Mitul
On 04-Sep-2014 11:44 PM, Kevin Larsen 
kevin.lar...@pioneerballoon.commailto:kevin.lar...@pioneerballoon.com wrote:
asterisk-users-boun...@lists.digium.commailto:asterisk-users-boun...@lists.digium.com
 wrote on 09/04/2014 11:57:40 AM:
  We are currently migrating from a Nortel pbx to Asterisk and we
 have been able to convert most of the functions that people are used to
 but there is one I have no clear idea how to do.  The scenario is:

  Boss calls secretary from outside the office to get connected to
 another outside destination.  The secretary dials the destination and
 then trasfers call to the boss.  When boss finishes with that person
 they want to send the call back to the secretary in order to make
 another connection or simply to talk to the secretary.

  The first part is not a problem, but after the boss finishes his
 call how can we send the call back to the secretary?  I was thinking of
 using a conference room but how would the secretary know when the boss
 has finished?  Anyone know how to handle this scenario?

I haven't tested this, but my initial thought would be to create a special 
context or extension that the secretary could route through when doing the call 
transfer. The Dial application could be called with the 'g' option to continue 
the dialplan at the next priority when the call hangs up. Something like a 
normal call transfer would just dial the number as normal, but for the special 
transfer, you could prepend the dialed number with a #.

For example (using a local US dialstring, change to fit your needs):

; This is a normal external call.
exten = _NXXNXXX,1,Dial(SIP/your_external_trunk/${EXTEN})
  same = n,Hangup()

; This is a call that should be transfered back to the secretary's extension 
when external call is finished
exten = _#NXXNXXX,1,NoOp(Special Dial for Boss/Secretary Transfer)
  same = n,Dial(SIP/your_external_trunk/${EXTEN:1},,g)
; First call has ended, now we go back to the secretary)
  same = n,Dial(SIP/1234)
  same = n,Hangup()

That's at least where I would start with my testing and then develop the 
solution from there.
--
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

Re: [asterisk-users] Special functionality for Secretary/Boss

2014-09-04 Thread Mitul Limbani
Kevin,

With your dialplan with g option on external trunk, if the call finishes
the boss's leg of call also gets disconnected. So the next instruction
would make a call to secratary, however with no one on other end.

Mitul
On 04-Sep-2014 11:44 PM, Kevin Larsen kevin.lar...@pioneerballoon.com
wrote:

 asterisk-users-boun...@lists.digium.com wrote on 09/04/2014 11:57:40 AM:
   We are currently migrating from a Nortel pbx to Asterisk and we
  have been able to convert most of the functions that people are used to
  but there is one I have no clear idea how to do.  The scenario is:
 
   Boss calls secretary from outside the office to get connected to
  another outside destination.  The secretary dials the destination and
  then trasfers call to the boss.  When boss finishes with that person
  they want to send the call back to the secretary in order to make
  another connection or simply to talk to the secretary.
 
   The first part is not a problem, but after the boss finishes his
  call how can we send the call back to the secretary?  I was thinking of
  using a conference room but how would the secretary know when the boss
  has finished?  Anyone know how to handle this scenario?

 I haven't tested this, but my initial thought would be to create a special
 context or extension that the secretary could route through when doing the
 call transfer. The Dial application could be called with the 'g' option to
 continue the dialplan at the next priority when the call hangs up.
 Something like a normal call transfer would just dial the number as normal,
 but for the special transfer, you could prepend the dialed number with a #.

 For example (using a local US dialstring, change to fit your needs):

 ; This is a normal external call.
 exten = _NXXNXXX,1,Dial(SIP/your_external_trunk/${EXTEN})
   same = n,Hangup()

 ; This is a call that should be transfered back to the secretary's
 extension when external call is finished
 exten = _#NXXNXXX,1,NoOp(Special Dial for Boss/Secretary Transfer)
   same = n,Dial(SIP/your_external_trunk/${EXTEN:1},,g)
 ; First call has ended, now we go back to the secretary)
   same = n,Dial(SIP/1234)
   same = n,Hangup()

 That's at least where I would start with my testing and then develop the
 solution from there.
 --
 _
 -- Bandwidth and Colocation Provided by http://www.api-digital.com --
 New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

 asterisk-users mailing list
 To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users

[asterisk-users] AstriCon Hackathon

2014-09-04 Thread Matthew Jordan
Join a worldwide community of designers, developers, and communications
technologists to to create, code, and design apps built on Asterisk and
other communications APIs at the inaugural AstriCon Hackathon!

Obligatory yet useful information:

*When*: Wednesday, October 22nd at 8AM. A reception is on Tuesday, October
21st from 5 - 7 PM.
*Where*: Red Rocks Casino in Las Vegas, Nevada (at AstriCon!)
*How to apply*: Sign up at http://astriconhackathon.challengepost.com/
*Do I need a team?* If you have one, that's great! If not, you can post on
the ChallengePost page (previously linked) or we can help you find one.
*What can I win?* Prizes (no idea what, but I'm sure it will be suitably
nifty) and the respect and admiration of your colleagues.

If nothing else, you'll have a great time hacking on Asterisk and other
communications APIs, while getting to lob whatever questions you may have
at members of the Asterisk Development Team (myself included).

More information about the hackathon can be found on the ChallengePost page
or at http://www.asterisk.org/community/astricon-user-conference/hackathon

See everyone in Las Vegas!

Matt

-- 
Matthew Jordan
Digium, Inc. | Engineering Manager
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
Check us out at: http://digium.com  http://asterisk.org
-- 
_
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
   http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users