1 Nov
2010
1 Nov
'10
8:33 a.m.
Hi all,
I am hosting a public asterisk box as backup support for some clients.
Most annoyingly since a few days I get hundreds of sip register probes
per minute.
I have fail2ban active which bans the ip, but it seems to be some sort
of bot network which immediately switches to another IP.
Needless to say, it is a pain.
As clients' phones register against the server (coming from dynamic ips)
I can't easily move to a different port or so ;(
Has anyone got any good suggestions?
Conrad
1 Nov
1 Nov
8:41 a.m.
On Mon, 2010-11-01 at 09:33 +0100, Conrad Wood wrote:
As clients' phones register against the server
(coming from dynamic ips)
I can't easily move to a different port or so ;(
Has anyone got any good suggestions?
If the clients use ISPs known to you, you could firewall off most of the
internet and just let through the netblocks for those given ISPs - you'd
occasionally get faults with phones not being able to register when they
appear on a new block, but it would deal with dynamic IPs for the most
part.
Alternatively, you could range-block foreign ISPs quite liberally -
again not perfect, but if your customers are UK-based and the scanning
is mostly foreign, then it would help at least cut some scanning out
before it gets to fail2ban.
Other than that, there aren't many great defences in your situation that
I can think of. Phone fraud, sadly, is a costly as it is valuable, and
makes it a very worthwhile target for crackers to go after.
Cheers
Alex.
--
This message was scanned by Better Hosted and is believed to be clean.
http://www.betterhosted.com
10:29 a.m.
As a service provider who offer (amongst other things) VoIP accounts,
I've seen this a lot, recently.
a few things I would advise:
1. If using Asterisk, don't allow incoming connections from the whole
internet on port 5060. If you need something to handle SIP
registrations from unpredictable public addresses, consider OpenSIPS,
if not, just restrict access to port 5060 / asterisk via iptables to
lists of known network ranges and addresses.
2. Configure OpenSIPS to send no response to the SIP probes from
sipvicious (UA string 'friendly-scanner')
If the scanner gets no response back it will stop and move on. If it
detects the box at the other end is Asterisk, then expect brute force
attacks to follow (the last one we had was ~2Mbps of repeated Register
attempts..before the measures above were taken)
8:46 a.m.
just a thought:
<http://www.velocityreviews.com/forums/t160495-ip-address-for-uk.html>
order deny,allow
deny from all
allow from whitelist
________________________________
From: Conrad Wood <cnw(a)conradwood.net>
To: users(a)lists.bitfolk.com
Sent: Mon, November 1, 2010 8:33:37 AM
Subject: [bitfolk] SIP scans
Hi all,
I am hosting a public asterisk box as backup support for some clients.
Most annoyingly since a few days I get hundreds of sip register probes
per minute.
I have fail2ban active which bans the ip, but it seems to be some sort
of bot network which immediately switches to another IP.
Needless to say, it is a pain.
As clients' phones register against the server (coming from dynamic ips)
I can't easily move to a different port or so ;(
Has anyone got any good suggestions?
Conrad
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
12:39 p.m.
Hi Conrad,
On Mon, Nov 01, 2010 at 09:33:37AM +0100, Conrad Wood wrote:
I am hosting a public asterisk box as backup support
for some clients.
Is that on your BitFolk VPS? Does that work okay?
I often have people ask me if Asterisk works on a VPS, but I don't
use it so can't comment.
Most annoyingly since a few days I get hundreds of sip
register probes
per minute.
I have fail2ban active which bans the ip, but it seems to be some sort
of bot network which immediately switches to another IP.
Needless to say, it is a pain.
What's the impact of a failed register?
If you can't restrict the valid source IPs with firewalling then
you're going to have to put with a constant background noise of
unauthenticated activity. Fail2Ban may actually be the best you can
do.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
"I am the permanent milk monitor of all hobbies!" -- Simon Quinlank
2 Nov
2 Nov
5:24 a.m.
Andy Smith wrote:
I often have people ask me if Asterisk works on a VPS,
but I don't
use it so can't comment.
In general it works ok, assuming enough hardware so there isn't too much
latency etc, some things need a special kernel module like conference
calling because Asterisk normally uses PCI interrupts instead of RTC as
a timing source.
What's the impact of a failed register?
You don't get calls routed to your sip handset for one :)
If you can't restrict the valid source IPs with
firewalling then
you're going to have to put with a constant background noise of
unauthenticated activity. Fail2Ban may actually be the best you can
do.
In general you are best to use some other port other than 5060, even if
you do run things like fail2ban, asterisk isn't/wasn't the best option
for handling sip clients, I forget which version but hitting 200 sip
clients used to make the whole system run very slow and this was on
dedicated hardware, any more than a dozen clients it's usually best to
put SER/OpenSER in front of asterisk...
--
Best regards,
Duane
http://www.freeauth.org - Enterprise Two Factor Authentication
http://www.nodedb.com - Think globally, network locally
http://www.sydneywireless.com - Telecommunications Freedom
http://e164.org - Global Communication for the 21st Century
"In the long run the pessimist may be proved right,
but the optimist has a better time on the trip."
3 Nov
3 Nov
6:43 p.m.
On Tue, 2010-11-02 at 15:24 +1000, Duane at e164 dot org wrote:
Andy Smith wrote:
> I often have people ask me if Asterisk works on a VPS, but I don't
> use it so can't comment.
Works well for my clients ;-)
Bit of minor tweaking, e.g. avoiding transcoding, and very little agi
scripting make it work nicely.
Thanks for all your responses to the SIP scans.
Conrad
4 Nov
4 Nov
10:02 p.m.
On 01/11/10 08:33, Conrad Wood wrote:
Hi all,
I am hosting a public asterisk box as backup support for some clients.
Most annoyingly since a few days I get hundreds of sip register probes
per minute.
I have fail2ban active which bans the ip, but it seems to be some sort
of bot network which immediately switches to another IP.
Needless to say, it is a pain.
As clients' phones register against the server (coming from dynamic ips)
I can't easily move to a different port or so ;(
Has anyone got any good suggestions?
Are you using something like this?
http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk
I've just moved out of VoIP but I'd suggest banning any IP that fails
registrations after say 10 attempts. Ban them for at least a day.
Last time I had to do this, I just debianised the script on the above
link and started using it. It worked pretty well.
Generally, I didn't think there were any other ways of screening - you
could perhaps try blocking registrations from non-UK IPs with iptables -
that might help you?
5161
days inactive
5164
days old
7 comments
7 participants
participants (7)
-
Alex Hudson -
Andy Smith -
Conrad Wood -
Duane at e164 dot org -
Max B -
Philip Veale -
Tim Dobson