Greetings all. FreePBX/Asterisk novice here. I recently installed FreePBX using the RasPBX distro. Got everything up and running with a SIP trunk and handful of PJSIP and legacy SIP devices (Grandstream wifi phones and Cisco 8841s respectively).
When I look at the logs, even when all devices are idle (or even fully disconnected), I see a constant stream of messages like the following:
[2020-10-04 09:42:33] SECURITY[2331] res_security_log.c: SecurityEvent="SuccessfulAuth",EventTV="2020-10-04T09:42:33.064-0700",Severity="Informational",Service="AMI",EventVersion="1",AccountID="admin",SessionID="0xb4302228",LocalAddress="IPV4/TCP/127.0.0.1/5038",RemoteAddress="IPV4/TCP/127.0.0.1/59352",UsingPassword="0",SessionTV="2020-10-04T09:42:33.064-0700"
[2020-10-04 09:42:43] ERROR[2272] pjproject: sip_inv.c .Error parsing/validating SDP body: Missing SDP rtpmap for dynamic payload type (PJMEDIA_SDP_EMISSINGRTPMAP)
[2020-10-04 09:42:55] ERROR[2272] pjproject: sip_inv.c .Error parsing/validating SDP body: Missing SDP rtpmap for dynamic payload type (PJMEDIA_SDP_EMISSINGRTPMAP)
[2020-10-04 09:42:56] ERROR[2272] pjproject: sip_inv.c .Error parsing/validating SDP body: Missing SDP rtpmap for dynamic payload type (PJMEDIA_SDP_EMISSINGRTPMAP)
[2020-10-04 09:42:59] ERROR[2272] pjproject: sip_inv.c .Error parsing/validating SDP body: Missing SDP rtpmap for dynamic payload type (PJMEDIA_SDP_EMISSINGRTPMAP)
This occurs about once a minute. The LocalAddress is always 127.0.0.1/5038 while the remote address is also localhost but on a random port above 50000.Edit: it appears the security warning is benign and unrelated to the SIP errors.
I don’t know that this is a material issue but it bothers me (in addition to clogging the logs), so if anyone has suggestions on how to rectify it I’d appreciate the insight.
@sorvani The Cisco devices need an Asterisk patch to add some Cisco-specific commands, as detailed at usecallmanager.nz. However, I had this same issue when using the unpatched Asterisk 16 distro included with RasPBX (which is managed by apt).
It’s conventional to disable SECURITY level logging to the Asterisk full log since it tends to be verbose. Unless you require it for intrusion detection (in which case it’s better to have a log file specifically for ID) you will find it easier to only enable when you need it.
Thanks, @lgaetz. I understand that and do have a separate fail2ban log. It appears that the errors I am seeing are unrelated to the security warnings which I will remove from the main log.
Okay, so this seems to be an attack. I turned on PJSIP history and waited for a couple of the errors to come through, then ran pjsip show history. The relevant rows in the table:
The requested extension is invalid so obviously the intent here is fishy.
Manually adding the offending IP to fail2ban slowed down the frequency of these errors, but running pjsip history shows that they are still happening. They don’t seem to generate a parseable error in the log (there is no IP address to pass to fail2ban), so I’m not sure how I can prevent these other than by whitelisting the trunk IPs.
If you were on the distro version, the built in firewall does that by default. All things are blocked and thunk IP’s are automatically whitelisted. Even so far as to using SRV records.
I would highly recommend implementing some kind of firewall. Fail2ban is not a firewall, it is reactive.
Thanks @sorvani. I have a hardware firewall so will whitelist the SIP trunk provider IPs for 5060 and the RTP ports. I am also going to add deny/permit rules to all my extensions.