On Mon, 30 Aug 2010, J. Oquendo wrote: > How about a little cron script without having to install anything? You > could run it off the hour: > > rightnow=`date "+%Y-%m-%d %k"` > > grep $rightnow /var/log/asterisk/messages |\ > awk '/No matching peer/' | sed's:'\''::g' |\ > uniq | awk '{print "iptables -A INPUT -s "$1" -j DROP"}'| sh
Your script is fine, but I think you are missing the point I made which is that early versions of sipvicious are badly broken in that they will continue to send their attacks for days after you firewall them out. I also posted a very effective iptables script some weeks ago if you care to search the archives. It works and is extremely effective in blocking these types of attacks - however, it will not stop a broken sipvicious from continuing to send data to your server, and that's the issue I have at present. Any attacking site is trivial to firewall out once you've detected it, but firewalling it out is not going to protect you or your customers from the incoming data if you have to pay for it, or have a capped Internet connection, and the attacking site doesn't give up, even when it's firewalled. A typical setup I might use for a customer in the UK is to set them up with an ADSL service with a 15GB/month cap. That's OK for a small office, or a bigger one with a line dedicated to VoIP. The attack I posted about earlier used up nearly 15GB of data in 3 days. Fortunately most of it was off-peak/weekend when it's unmetered. I arranged for their router to drop the packets, but the ISP still counted them. Try it for yourself - get an early copy of SV, point it at one of your servers, then firewall the server against your attacking machine. svcrack.py will not give up. What your script needs to do is not only get the IP address, but also the calling port, then launch an svcrash against that site... ... and hope that the hackers aren't getting clever and putting svcrack in a script that automatically re-starts it... (which I think some of them are now) Gordon -- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users