Blocking Brute Force Hacking attacks on your FreePBX machine

I’m glad you acknowledge your tribalism dicko, its quite confronting to be honest, although people like you do not like it when your tribalism is exposed, its to be expected. I also don’t appreciate the arrogant and condescending tactics that you are using in your replies such as ‘Possible a brain reset needed’. Talk about arrogance… :man_facepalming:

You also asked me “So, respectfully, how does your code improve on fail2ban 's”
Again, ANOTHER ASSUMPTION. Firstly, I never claimed that my script ‘IMPROVES’ on fail2ban’s code, it is YOU that claims I state this, not me. If you think I claimed that, then please enlighten us all with a ‘quote’ on ‘where’ I stated this. Secondly, my script does not require ANY configuration and it doesn’t require any reading of any user manual to know HOW and WHERE to configure it. You just install the script and it works, running off the code I clearly published/shared to which you’ve already taken a look. I also stated that I use my script TOGETHER with fail2ban, I never claimed anywhere that its a replacement or better than. I just stated I made this script because I tried everything I knew and nothing was able to stop the hacking attacks which is the reason why I made the script in the first place. Once I used the script the attacks are all blocked now. What harm can this be? According to you, this is a no no and somehow you’ve managed to ASSUME that I claim my script is better than fail2ban’s script. Absolute nonsense and a total projection. Then you come on here and beat your chest like a gorilla and carry on like a pork chop, throwing insults and all sorts of arrogant comments. I could make another post where I scrutinize every single comment you’ve made, but for fear of writing a magna carta whinge post, I will refrain. This response will be enough to put you in your place. See the end of this post for details.

With regard to your last message… Yeah I ‘walked in two days ago’, although I’ve been present in this forum since a very long time ago, way before Sangoma was even in the picture, I just haven’t posted anything, I posted something yesterday only to help people who have tried everything to stop the hackers and have not succeeded. I didn’t ask anyone for any help, nor did I make any claims my code was ‘better than’ fail2ban, in fact I stated that I use my code ‘together with’ fail2ban, (but looks like you can’t read English because you ignored that fact) yet I was attacked for it, due to arrogance and tribalism and people making assumptions based on their feelings and egos that are the size of the universe.

You made a statement in your earlier post, where I’m not sure if that was directed at me or not, but in case it was directed at me, which was “Your public IP address is obviously ‘well known’ to the bad guys, so would you share it here with the friendly guys, we could ‘suck it and see’ if you want”… then my answer is I will tell you that my ‘IP Address’ is NOT static, I’m on a ‘Dynamic’ service with several varied ranges being used and cycled every X number of hours, thus another one of your assumptions has just been proven nonsense.

Hackers don’t ‘ONLY’ attack known IP Addresses, they attack ranges using automated bots. If you get Kali Linux, these tools are mostly installed in the OS and you can run them yourself, but because you never said anything like that, you made an assumption that hackers are attacking static IP Addresses (if you are going to claim that it can be the same for a dynamic address, then you don’t know anything about networking so don’t try to wiggle out of this one) because 'MY Address" is ‘Well known’ is just total nonsense. They scan ranges with automated bots. How did you not know this? You come onto this thread and act like you are the all-knowing master and professor of hacking… and you didn’t even know that hackers use automated bots to attack ranges, and you make the statement that I’m “pissing on the wrong trees”? (what… because I post some code that will block hackers?) :rofl:

Get off your high horse buddy, your ego is way too big for you to have a proper and logical/rational discussion with anyone. I didn’t piss on anyone’s tree and I never tried to ‘teach the grandmas here to suck eggs’ either and I certainly didn’t post the code here to ‘help my acceptance’. I couldn’t give a rat’s proverbial if you accept the script or not, and I’ve even mentioned in the notes that if you are an expert then you don’t need this script, but you chose to ignore that didn’t you…

But what is puzzling to me is that not only is your behavior tribalistic, it also makes me wonder if you are not a hacker yourself, seeing there is such animosity regarding the script, that just blocks hackers. Does the code make your life hard does it dicko? Looks like it does, for the code to be such a sore point, it obviously annoys you because it blocks hackers. Are you a hacker? (I’m not making an assumption, I’m asking a question, and I hope you understand that and can read English) you seem to know a lot about hacking and pen testing, as noted by your comment in an earlier post. Tell us are you a hacker? is that why you don’t like this script?

Also, seeing you are such a professor and expert in all things security for FreePBX, then I invite you to put your money where your mouth is and Post here the following:

a) A copy of a working fail2ban configuration that you claim stops everything, that YOU configured yourself, so that I can then set this up on my test machine and I’ll pen test it and then post the outcome here for ALL to see, just how good you are at your ‘configuration’ seeing that you are a ‘grandma that knows how to suck eggs’.

b) A copy of the configuration for FreePBX that is security related so that I can pen test it and then post the outcome for all to see.

This way, you can post something that you claim works and HELP the community rather than shoot your fingers off giving the impression you are the all-knowing professor of security.
Do I think you will post anything? Nope. And I know why too, because you are very quick to judge, your ego is the size of the universe and you have no idea what you are talking about, other than you know enough to troll genuine people trying to help the community with arrogant and egotistical rhetoric.
Sorry if your feelings are hurt dicko, no malice intended of course, just plain facts :rofl:

I am now awaiting your configuration for the above-mentioned, not interested in any of your rhetoric.
Perhaps you might also want to start a thread that HELPS people to fight against the hackers, providing configurations and helpful information, rather than spew your nonsense rhetoric about how much you know and how bad other’s code is etc…
Note that posting a ‘link’ to a website or wiki, doesn’t cut it, you have to provide YOUR FULL CONFIGURATION, not a link to a website. Spend time to help people rather than belittle them for a change.

So many people attack others, without providing anything of substance themselves. As I said before, post YOUR fail2ban config, OR ANY OTHER METHOD you have that will stop hackers, go into detail and HELP PEOPLE rather than write nonsense because any sucker can write what you write, I can pick on all your messages non stop until the cows come home, but that doesn’t help anyone does it.
Get off your high horse dicko and start helping people for a change, seeing you claim you are the all knowing master and the ‘grandma that knows how to suck eggs’. :man_facepalming:
Contribute something of value rather than contributing nonsense talk.

too long didn’t read but basically if you only accept TLS transport, you will be happy and f2b will be just a tail sweep, as to your other insecurities, well, they are yours, not mine.

Dicko… dude… post YOUR Fail2Ban configuration, stop trying to look like you know what you are talking about, show us all YOUR CONFIG…

Go on, I’m waiting…

Note: And don’t post a snippet, post it ALL !!!
Then I will pen test it and then post the results here… Put your money where your mouth is, otherwise zip it.

Dude, the ONLY difference between your stuff and unedited f2b is maxretry=1 provided that f2b is watching a well constructed log file , can you understand that?

So why don’t you want to provide your entire Fail2Ban script?

No point in you telling me oh change this to that…
Provide FULL Fail2Ban config, so that Others can also use it IF it checks out after my testing, otherwise you’re just talking rhetoric without any real motive to help.

See this is what I mean… those that commented like you did dicko, always do so without any real substance. In reality, this is why I made the script, so there was no configuration and it just banned hackers that made attempts at registering. Thats how the hackers find voip servers, by sending registration requests and then seeing if they get a response. My script stops that after ONE single attempt, without any need for configuration. Does fail2ban do that? sure, but you have to configure it. Does that mean my script is better than fail2ban? Nope. But its easier to implement because the fact is, since I ran my script, I don’t have more than 2 hack attempts from the same IP Address. Does that mean I won’t get into a situation where there will be ‘millions’ of IP addresses? Well if there are 200,000 known addresses (as stated by another user here) then that’s fine, I can always modify the code to make it better. The main focus here is ZERO config to block the hackers. FreePBX image for raspberry pi does NOT block hackers out of the box, you have to fiddle a lot. Most users don’t know how to fiddle. Simple as that.

I am waiting for your full fail2ban configuration…

In your asterisk filter change maxretry to 1

THAT IS THE ONLY CHANGE YOU NEED TO MAKE FOR F2B TO MATCH AND IMPROVE YOUR CODE.

Please post your ENTIRE Fail2Ban code, then we can discuss this properly, seeing you spent so much time making many replies to me with arrogance and rhetoric…

Posting your ENTIRE Fail2Ban code will no doubt help others, IF its as good as you say.

No point posting snippets or things to change, just post the entire config, then I’ll pen test it.
Until then, I’m going to answer you with the same reply until you post the entire config.

In your asterisk filter change maxretry to 1

THAT IS THE ONLY CHANGE YOU NEED TO MAKE FOR F2B TO MATCH AND IMPROVE YOUR CODE.

Please post your ENTIRE Fail2Ban code, then we can discuss this properly, seeing you spent so much time making many replies to me with arrogance and rhetoric…

Posting your ENTIRE Fail2Ban code will no doubt help others, IF its as good as you say.

No point posting snippets or things to change, just post the entire config, then I’ll pen test it.
Until then, I’m going to answer you with the same reply until you post the entire config.

I will say one more time, fail2ban is best of class if well written , you will not need it with well provisioned TLS,

Your offered code is already in f2b for udp even for Pi’s if you just do that one edit.

Maybe you don’t understand English.

I am telling you, there is no point in you saying which section of the fail2ban configuration to change, that’s not the point of this discussion.

The point is that you claim you know how to block ALL hackers and that you are the all knowing master of IT security when it comes to VoIP, then so in order for you to redeem yourself, you need to post the ENTIRE Fail2Ban configuration that YOU claim is the best, seeing you passed such ruthless judgement on my script.

Lets see how good you are by posting YOUR entire fail2ban script, that way I can pen test it and if the result is good, OTHERS may use it to help their systems too. You gave the impression to everyone that I ‘needed a brain reset’ and that you are soooooooo smart and all-knowing and we must all prostrate to you, so then SHOW US ALL how good your configuration is, put your money where your mouth is, otherwise don’t bother replying.

So in lieu of you not answering my request, I will not reply to you UNTIL you post your ENTIRE fail2ban script. I will leave it in your hands.

You have become offensive, you are now ignored (.maybe check your ritalin intake)

yeah… I’m ‘offensive’ because you don’t want to answer the question, after brutally attacking me for no reason. Funny how you are calling me offensive after you’ve spent the last 12 hours hurling abuse and insults… Give it a rest bro, you won’t post your fail2ban config because you don’t want to be exposed, that’s why.

Oh and… I also don’t know what ‘ritalin’ is, but you seem to know… looks like you are trying to suggest that I need to take some kind of meds? Hmmm more insults! Looks like the Pot calling the kettle black!

Perhaps next time try to behave more civilized before you start attacking people that are only trying to help the community. You should be ashamed of your behavior dicko.

Thanks for the contributions, thread is closed.

7 Likes