ChanSip error

Hi everybody,

i hope you can help me.
I see this notice in asterisk

[2020-04-15 10:39:40] NOTICE[2745][C-000000b1]: chan_sip.c:25904 handle_request_invite: Failed to authenticate device sip:[email protected]:5060;tag=d11f24229f52d2472c23756e2e0effbc

i don’t understant why because right now i don’t have any sip or device with number 1001.
I restarted all the system but this notice persistes.

Can you help me please what should i do?

are you getting many attempts with different different extensions ?, is there any kind of brute attack on server ?, please check logs…

Disable anonymous call to - NO
Allow Guest - NO

One other bit of advice that some people don’t think about is that if you don’t have a good reason for your PBX to be connected to the public internet, it’s a good idea just to keep it behind your firewall (if possible). Some use cases require external public access, but you definitely minimize a whole class of potential problems if you don’t have it publicly accessible.

2 Likes

i have all this options like this. i see on sip debug some attacks, here an example:

Retransmitting #2 (NAT) to 54.36.109.91:58860:
SIP/2.0 403 Forbidden
Via: SIP/2.0/UDP 0.0.0.0:58860;branch=z9hG4bK1273017248;received=54.36.109.91;rport=58860
From: sip:[email protected];tag=880232777
To: sip:[email protected];tag=as78c87b0d
Call-ID: 1787486076-1250462066-1671686173
CSeq: 2 INVITE
Server: IPBX-2.11.0(11.25.3)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0

I have my PBX on a vps server so it have external public access. i tryed to used issabel firewall rules but dont works fine. when i ennable firewalld from Centos i dont have access to the vps

Fail2ban running on server ?

Yes, it is. I can see a lot of banished ip in the log. Is there anything else i should do?

Most VPS providers have some “firewall” service they offer, it might be simple forwarding rules.

Also, take a look at the FreePBX firewall, allow access only from trusted sources.

If you’re using Issabel you need to be asking these questions on their forums. It’s their PBX release.

3 Likes

the solution was deny all ips and only allow operators to be able to login in their extensions. i use issabel firewall and now works fine. Thank you to all

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.