Disable replies to INVITE messages from any IP

General Help
21

google? then perhaps

vi /etc/asterisk/sip_general_custom.conf

22

ok; but if I’m not wrong you said that you just get the traffic from a different port for remote users. how ?

23

Not the traffic, that is rtp, but the sip signaling, usually something like server = 1.2.3.4:48123 on the client and the extension set to use port 48123 also, same rules for nat/firewall traversal as 5060.

24

ok. but how do I make asterisk listen on that port ?

25

I thought I covered that in my last post . . . Oh yes, I did:-)

26

thanks to everyone giving ideas.
I’ve now secured my ip pbx. Running on a different port and asking authorization from every ip address who is not in trunks.

I would prefer to not have any response for those IP addresses but 407 message is also good.

27

You are welcome.

(For the non paranoids, Just because You have fail2ban installed, it doesn’t mean they are not messing with you ;-))

28

I was not aware of fail2ban. Thanks. I2ll check that as well.

29

Hi,

I’ve installed fail2ban but I couldn’t find an Asterisk log to monitor with fail2ban.
I have everything (warning, notice, error, debug) logged to /var/log /asterisk/full
But I can only see following log format for failing invite authorisation:

“[Dec 1 12:43:22] NOTICE[2345] chan_sip.c: Sending fake auth rejection for device 1004sip:[email protected];tag=a57239b9”

x.x.x.x is my IP address, so this log does not give any idea about the attacking IP.

any ideas ?

30

I have found some information here:
http://www.fail2ban.org/wiki/index.php/Asterisk

But it mostly includes Registration attack logs. In my case, invite attacks are more…

31

what log files and log types can I use ?

32

I suggest you use the one you create especially for intrusion detection.

A very good discsuuion of the how’s and why’s at

http://sourceforge.net/p/raspbx/discussion/tutorials/thread/6288a838/

don’t worry that it’s Debian based, the concept is OS agnostic.

You will have to add your own regex for your particular scenario . . .

33

thanks. but apparently security log of Asterisk is only available after 10.x version. I use 1.8.x
So, does it support ?

I tried adding it. Module is there and I don’t get any errors. But securitylog is empty.

34

No you need >= 10 for SECURITY, but the NOTICE events should be there if you followed it well.