On Mon, 2010-11-01 at 09:33 +0100, Conrad Wood wrote: If the clients use ISPs known to you, you could firewall off most of the internet and just let through the netblocks for those given ISPs - you'd occasionally get faults with phones not being able to register when they appear on a new block, but it would deal with dynamic IPs for the most part. Alternatively, you could range-block foreign ISPs quite liberally - again not perfect, but if your customers are UK-based and the scanning is mostly foreign, then it would help at least cut some scanning out before it gets to fail2ban. Other than that, there aren't many great defences in your situation that I can think of. Phone fraud, sadly, is a costly as it is valuable, and makes it a very worthwhile target for crackers to go after. Cheers Alex. -- This message was scanned by Better Hosted and is believed to be clean. http://www.betterhosted.com

As a service provider who offer (amongst other things) VoIP accounts, I've seen this a lot, recently. a few things I would advise: 1. If using Asterisk, don't allow incoming connections from the whole internet on port 5060. If you need something to handle SIP registrations from unpredictable public addresses, consider OpenSIPS, if not, just restrict access to port 5060 / asterisk via iptables to lists of known network ranges and addresses. 2. Configure OpenSIPS to send no response to the SIP probes from sipvicious (UA string 'friendly-scanner') If the scanner gets no response back it will stop and move on. If it detects the box at the other end is Asterisk, then expect brute force attacks to follow (the last one we had was ~2Mbps of repeated Register attempts..before the measures above were taken)

Andy Smith wrote: In general it works ok, assuming enough hardware so there isn't too much latency etc, some things need a special kernel module like conference calling because Asterisk normally uses PCI interrupts instead of RTC as a timing source. You don't get calls routed to your sip handset for one :) In general you are best to use some other port other than 5060, even if you do run things like fail2ban, asterisk isn't/wasn't the best option for handling sip clients, I forget which version but hitting 200 sip clients used to make the whole system run very slow and this was on dedicated hardware, any more than a dozen clients it's usually best to put SER/OpenSER in front of asterisk... -- Best regards, Duane http://www.freeauth.org - Enterprise Two Factor Authentication http://www.nodedb.com - Think globally, network locally http://www.sydneywireless.com - Telecommunications Freedom http://e164.org - Global Communication for the 21st Century "In the long run the pessimist may be proved right, but the optimist has a better time on the trip."

On 01/11/10 08:33, Conrad Wood wrote: Are you using something like this? http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk I've just moved out of VoIP but I'd suggest banning any IP that fails registrations after say 10 attempts. Ban them for at least a day. Last time I had to do this, I just debianised the script on the above link and started using it. It worked pretty well. Generally, I didn't think there were any other ways of screening - you could perhaps try blocking registrations from non-UK IPs with iptables - that might help you?