VoIP Mailing List Archives :: View topic - [asterisk-users] Asterisk secure fine tune

Sponsor: VoiceMeUp - Corporate & Wholesale VoIP Services

VoIP Mailing List Archives
Mailing list archives for the VoIP community

[asterisk-users] Asterisk secure fine tune - stop attack

VoIP Mailing List Archives Forum Index -> Asterisk Users

View previous topic :: View next topic

Author

Message

motty.cruz at gmail.com
Guest

Posted: Thu Sep 04, 2014 9:45 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Hi All, I see this kind of attack on our Asterisk Server, do you know how to block that IP? [Sep 4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite: Call from '' (213.136.81.166:9306) to extension '34422' rejected because extension not found in context 'default'. Thanks in advance, -Motty

patrick at laimbock.com
Guest

Posted: Thu Sep 04, 2014 9:56 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

On 04-09-14 16:44, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to
block that IP?

[Sep 4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite:
Call from '' (213.136.81.166:9306 <http://213.136.81.166:9306>) to
extension '34422' rejected because extension not found in context 'default'.

Have a look at Fail2ban:
http://www.fail2ban.org/wiki/index.php/Main_Page

HTH,
Patrick

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

tg at ovm-group.com
Guest

Posted: Thu Sep 04, 2014 9:59 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Am 04.09.2014 16:44, schrieb motty cruz:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block that IP?

[Sep 4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite: Call from '' (213.136.81.166:9306) to extension '34422' rejected because extension not found in context 'default'.

You should not invest time in blocking single IPs. Take a look at "fail2ban".
http://www.fail2ban.org/wiki/index.php/Asterisk

-Thorsten-

motty.cruz at gmail.com
Guest

Posted: Thu Sep 04, 2014 10:12 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Thanks, looks like fail2ban is the way to go, I would prefer a different alternatives if there is one. I tried deny=IP/netmask but did not work for me, in sip.conf. seems like fail2ban is what you all are using, so I will give it a try.

Thanks,

On Thu, Sep 4, 2014 at 7:58 AM, Thorsten Göllner <tg@ovm-group.com (tg@ovm-group.com)> wrote:

Quote:

Am 04.09.2014 16:44, schrieb motty cruz:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block that IP?

[Sep 4 07:41:06] NOTICE[7375]: chan_sip.c:23375 handle_request_invite: Call from '' (213.136.81.166:9306) to extension '34422' rejected because extension not found in context 'default'.

You should not invest time in blocking single IPs. Take a look at "fail2ban".
http://www.fail2ban.org/wiki/index.php/Asterisk

-Thorsten-

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

asterisk_list at earth...
Guest

Posted: Thu Sep 04, 2014 10:20 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

motty.cruz at gmail.com
Guest

Posted: Thu Sep 04, 2014 10:43 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Hi A J, believe me, I wish i do as you suggested, however I have a few extensions outside the office with dynamic IPs, so that is not a possibility. Thanks for your suggestions, I will try fail2ban. I don't know how complicated is to implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles <asterisk_list@earthshod.co.uk (asterisk_list@earthshod.co.uk)> wrote:

Quote:

On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

hykhan at hotmail.com
Guest

Posted: Thu Sep 04, 2014 10:45 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

dont forgot to put your "trusted IPs" into "ignoreip" list while configuring fail2ban

its very important when a customer (may be 100+ extns) are behind NAT and only present single public IP

Rgds
Hash

Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.cruz@gmail.com
To: asterisk-users@lists.digium.com
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

Hi A J, believe me, I wish i do as you suggested, however I have a few extensions outside the office with dynamic IPs, so that is not a possibility. Thanks for your suggestions, I will try fail2ban. I don't know how complicated is to implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles <asterisk_list@earthshod.co.uk (asterisk_list@earthshod.co.uk)> wrote:

Quote:

On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

-- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users

EWieling at nyigc.com
Guest

Posted: Thu Sep 04, 2014 10:58 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

If we don’t need to allow access from outside the USA we block access from all non-ARIN IP addresses by using iptables. This takes care of at least 80% of attacks.

I enabled guest access and pointed all guest calls to an IVR which auto disconnects the call after a while (2 min seems good) if there is no response. That took care of most of the remaining attacks.

I’m considering enabling auto create peer and routing calls to the same IVR as above.

We also use fail2ban, but mostly for non-SIP attacks.

Before enabling any guest access be ABSOLUTELY SURE you know how to do it without causing security issues.

From: asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of Hashmat Khan
Sent: Thursday, September 04, 2014 3:45 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

dont forgot to put your "trusted IPs" into "ignoreip" list while configuring fail2ban

its very important when a customer (may be 100+ extns) are behind NAT and only present single public IP

Rgds

Hash

Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.cruz@gmail.com (motty.cruz@gmail.com)
To: asterisk-users@lists.digium.com (asterisk-users@lists.digium.com)
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack
Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions outside the office with dynamic IPs, so that is not a possibility. Thanks for your suggestions, I will try fail2ban. I don't know how complicated is to implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles <asterisk_list@earthshod.co.uk (asterisk_list@earthshod.co.uk)> wrote:
On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

Instead of blocking unwanted IPs, you should be permitting only wanted IPs.

--
AJS

Note: Originating address only accepts e-mail from list! If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

-- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs: http://www.asterisk.org/hello asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users

asterisk.org at sedwar...
Guest

Posted: Thu Sep 04, 2014 11:20 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Please don't top post.

On Thu, 4 Sep 2014, motty cruz wrote:

Quote:

Hi A J, believe me, I wish i do as you suggested, however I have a few
extensions outside the office with dynamic IPs, so that is not a
possibility.

Do your few extensions travel to China, Russia, Iran, Iraq, North Korea,
etc? (Sorry if I stepped on anybody's toes.)

If you configure iptables to drop all and then only allow the few IP
address ranges you really need, 90% of the problem is solved. Then use
fail2ban to manage the remaining anklebitters.

--
Thanks in advance,
-------------------------------------------------------------------------
Steve Edwards sedwards@sedwards.com Voice: +1-760-468-3867 PST
Newline Fax: +1-760-731-3000
--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

mdupuis at ocg.ca
Guest

Posted: Thu Sep 04, 2014 11:21 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

You can also take a look at SecAst (www.generationd.com). The free version is a drop-in replacement for fail2ban but also add a lot more intelligence (and no need to update regex's etc). There's also geographic IP fencing so you can block attacks by country / region / city etc., only allow access by geography, etc. And a whole lot more (including detection of breached but valid credentials to halt ongoing fraud, etc)

-=M=-

The opinions above are my own, and don't necessarily represent those of my employer. Since I'm employed by Generation D however you can bet that I have a serious bias Smile

From: asterisk-users-bounces@lists.digium.com <asterisk-users-bounces@lists.digium.com> on behalf of Eric Wieling <EWieling@nyigc.com>
Sent: Thursday, September 4, 2014 11:58 AM
To: Asterisk Users List
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

If we don’t need to allow access from outside the USA we block access from all non-ARIN IP addresses by using iptables. This takes care of at least 80% of attacks.

I enabled guest access and pointed all guest calls to an IVR which auto disconnects the call after a while (2 min seems good) if there is no response. That took care of most of the remaining attacks.

I’m considering enabling auto create peer and routing calls to the same IVR as above.

We also use fail2ban, but mostly for non-SIP attacks.

Before enabling any guest access be ABSOLUTELY SURE you know how to do it without causing security issues.

From: asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] On Behalf Of Hashmat Khan
Sent: Thursday, September 04, 2014 3:45 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack

dont forgot to put your "trusted IPs" into "ignoreip" list while configuring fail2ban

its very important when a customer (may be 100+ extns) are behind NAT and only present single public IP

Rgds

Hash

Date: Thu, 4 Sep 2014 08:42:11 -0700
From: motty.cruz@gmail.com (motty.cruz@gmail.com)
To: asterisk-users@lists.digium.com (asterisk-users@lists.digium.com)
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack
Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions outside the office with dynamic IPs, so that is not a possibility. Thanks for your suggestions, I will try fail2ban. I don't know how complicated is to implement that on production server.

Thanks,
-Motty

On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles <asterisk_list@earthshod.co.uk (asterisk_list@earthshod.co.uk)> wrote:
On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi All,
I see this kind of attack on our Asterisk Server, do you know how to block
that IP?

asterisk_list at earth...
Guest

Posted: Thu Sep 04, 2014 11:22 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

On Thursday 04 Sep 2014, motty cruz wrote:

Quote:

Hi A J,
believe me, I wish i do as you suggested, however I have a few extensions
outside the office with dynamic IPs, so that is not a possibility.

If you know what ISPs they are using, then you can allow just those ISPs'
address ranges. That will slow things down, by requiring an attacker to be
using the same ISP as a legitimate user.

Quote:

Thanks
for your suggestions, I will try fail2ban. I don't know how complicated is
to implement that on production server.

It's fairly easy -- but note that physical access to the server's console is
highly desirable, lest you accidentally block yourself out from using ssh
(not a mistake you want to make too many times).

--
AJS

Note: Originating address only accepts e-mail from list! If replying off-
list, change address to asterisk1list at earthshod dot co dot uk .

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

asterisk at lists.mino...
Guest

Posted: Thu Sep 04, 2014 11:26 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

On 4/9/14 4:58 pm, Eric Wieling wrote:

Quote:

If we don't need to allow access from outside the USA we block access from all non-ARIN IP addresses by using iptables. This takes care of at least 80% of attacks.

Likewise here (though RIPE rather than ARIN, since we're the other side
of the pond).

You can also take it a bit further: if, for example, you know what
ISP(s) your dynamic clients are using, you can limit connections to the
IP ranges those ISP(s) use - look up their ranges on he.net's BGP
looking glass if you need to find out what ranges they're using.

Another thing I've been playing with of late is using iptables' string
matching functionality to block user agents of known attack vectors:
'sipcli', 'sipvicious', 'friendly-scanner', etc.

This seems to work remarkably well, though what impact it has on net
performance under load remains to be seen.

Kind regards,

Chris
--
This email is made from 100% recycled electrons

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

motty.cruz at gmail.com
Guest

Posted: Thu Sep 04, 2014 11:33 am Post subject: [asterisk-users] Asterisk secure fine tune - stop attack

Thank you all for your support, your suggestions are welcome. Thanks,

On Thu, Sep 4, 2014 at 9:26 AM, Chris Bagnall <asterisk@lists.minotaur.cc (asterisk@lists.minotaur.cc)> wrote:

Quote:

On 4/9/14 4:58 pm, Eric Wieling wrote:

Quote:

If we don't need to allow access from outside the USA we block access from all non-ARIN IP addresses by using iptables. This takes care of at least 80% of attacks.

Likewise here (though RIPE rather than ARIN, since we're the other side of the pond).

You can also take it a bit further: if, for example, you know what ISP(s) your dynamic clients are using, you can limit connections to the IP ranges those ISP(s) use - look up their ranges on he.net's BGP looking glass if you need to find out what ranges they're using.

Another thing I've been playing with of late is using iptables' string matching functionality to block user agents of known attack vectors: 'sipcli', 'sipvicious', 'friendly-scanner', etc.

This seems to work remarkably well, though what impact it has on net performance under load remains to be seen.

Kind regards,

Chris
--
This email is made from 100% recycled electrons

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

Display posts from previous:

	VoIP Mailing List Archives Forum Index -> Asterisk Users	All times are GMT - 5 Hours
Page 1 of 1

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum