VoIP Mailing List Archives

[anuragrana31189 at gma...]

Hi All.


Someone is attacking on my SIP server.
There are lot of requests coming in and I am not able to stop it because I am unable to detect the IP address. 
I used wireshark to capture the packets.


Although I am using very strong password for my SIP users but still is there any way to drop these packets and stop this attack.


I tried dropping packet after matching some string (most of the packets from attacker contains string 'VaxSIPUserAgent/3.1' ) but it failed. Packets are still flowing in. 

[arunvsadnikov at gmail...]

Hi,
    Change the protocol from tcp to udp in iptables.

~Arun On 27 Jun 2014 20:07, "Anurag Rana" <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[prakash.n at tevatel.com]

Hi,

Install fail2band and change sip listen port to avoid attack

With regards

N.Prakash

From: Anurag Rana (anuragrana31189@gmail.com)
Sent: ‎27-‎06-‎2014 08:07 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion (asterisk-users@lists.digium.com)
Subject: [asterisk-users] Attack on Sip server.

[anuragrana31189 at gma...]

I added bot rules TCP as well as UDP.  Still not working.


How changing SIP listen port will prevent it. Please explain.


I will try fail2band.



On Fri, Jun 27, 2014 at 8:16 PM, Prakash N <prakash.n@tevatel.com (prakash.n@tevatel.com)> wrote:

[anuragrana31189 at gma...]

Both Rules* (typo in last mail)



On Fri, Jun 27, 2014 at 8:19 PM, Anurag Rana <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[steve-lists at geekint...]

On 27 Jun 2014, at 15:37, Anurag Rana <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[EWieling at nyigc.com]

This is a common issue and is covered in the mailing list archives multiple times.

Do a Google search for something like:

site:lists.digium.com fail2ban


From: asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of Steven Howes
Sent: Friday, June 27, 2014 10:58 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Attack on Sip server.



On 27 Jun 2014, at 15:37, Anurag Rana <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[markus_weiler at mailw...]

very simple,
yet effective

http://www.palner.com/blog/171/asterisk-no-matching-peer-found-block/



Am 27.06.2014 16:58, schrieb Steven Howes:

[rwheeler at artifact-s...]

+1 fail2ban
Very easy and very effective.
On 27/06/2014 10:52 AM, Anurag Rana wrote:

[prakash.n at tevatel.com]

In sip.conf change listen  port 5060 to some other number like 7242 any number ,then restart asterisk . Register sip phone with listen port (7242)

Example 
Domain: 192.168.1.10:7242

With regards

N.Prakash

From: Anurag Rana (anuragrana31189@gmail.com)
Sent: ‎27-‎06-‎2014 08:19 PM
To: Prakash N (prakash.n@tevatel.com)
Cc: Asterisk Users Mailing List - Non-Commercial Discussion (asterisk-users@lists.digium.com)
Subject: Re: [asterisk-users] Attack on Sip server.

[andrew at vsave.co.za]

Block the ip?


You should only enable sip for your specific clients in iptables.




Sent from Samsung Mobile




-------- Original message --------
From: arun kumar
Date:27/06/2014 4:42 PM (GMT+02:00)
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Attack on Sip server.



Hi,
Change the protocol from tcp to udp in iptables.

~Arun On 27 Jun 2014 20:07, "Anurag Rana" <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[jprangi at didforsale.com]

Anurag,


Here is small script, that will check your logs and will block the IPs.

http://www.didforsale.com/blog/is-your-asterisk-system-under-heavy-attack


This is good if you dont expect any registration. If you do have some valid registration, you might want to add some counter to see how time IP need to fail or how many different users IP is trying to register on before blocking the IP.


Jai Rangi

www.didforslae.com






On Fri, Jun 27, 2014 at 7:37 AM, Anurag Rana <anuragrana31189@gmail.com (anuragrana31189@gmail.com)> wrote:

[mitul at enterux.in]

I think your asterisk server is behind firewall or some sort of NAT where the out to in packets are getting masqueraded with local or DMZ  IP of your firewall / gateway box.
Fix this first to get fail2ban detect the correct public IP.
Otherwise fail2ban will ban your local GW IP due to which you won't be able to access the box even from your local network for ssh.
Hope u know how to fix the firewall snat. 
Mitul On 27-Jun-2014 9:51 PM, "Jai Rangi" <jprangi@didforsale.com (jprangi@didforsale.com)> wrote:

[prakash.n at tevatel.com]

Fail2band installation
http://striker24x7.blogspot.in/2011/07/fail2ban-in-asterisk.html?m=1

Iptables
http://striker24x7.blogspot.in/2014/03/simple-iptables-script.html?m=1
With regards

N.Prakash

From: Anurag Rana (anuragrana31189@gmail.com)
Sent: ‎27-‎06-‎2014 08:22 PM
To: Prakash N (prakash.n@tevatel.com)
Cc: Asterisk Users Mailing List - Non-Commercial Discussion (asterisk-users@lists.digium.com)
Subject: Re: [asterisk-users] Attack on Sip server.

[anuragrana31189 at gma...]

Right Mitul. System is behind some gateway.



On Fri, Jun 27, 2014 at 10:06 PM, Mitul Limbani <mitul@enterux.in (mitul@enterux.in)> wrote: