Is my PBX being Hacked?

naveedh11 · July 22, 2013, 7:27pm

I am a fairly new user with Asterisk/FreePBX/PIAF. I know enough to get into trouble and I have set up a FreePBX box in the Amazon AWS Ec2 cloud by following a nerdvittles article. I have some google voice accounts set up and am using the service as a “landline” service at one of my retail business locations. I recently got the environment launched and running a few days ago and I saw something in the logs that caught my eye and I wasn’t sure if this is normal or if someone is trying to do some unscrupulous activities via my PBX.
I am seeing SIP connections from unkown peers and DIDs that look to be an international number (starting 0119 etc). Am I crazy or is someone trying to break in?
Keep in mind I do not have any credit cards attached to thsi PBX and it is simply a pilot test for this site - however I am using the free tier on amazon so if usage goes over I’m looking at monetary loss. Not to mention I’m generally concerned about the security of my server.
Here is the output of the logs i am concerned about. Please note I have replaced any instance of my IP address with. I am also seeing multiple failed login attempts for the root accoutn in /var/log/secure.


[size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black][2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]0?from-trunk,011972599309853,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] func_timeout.c: Channel will hangup at 2013-07-22 06:59:50.023 UTC.
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002b'
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [h@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]NoOp[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]Hangup[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [h@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]DID=s[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [h@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Goto[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Goto (from-sip-external,s,1)
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]0?from-trunk,s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] func_timeout.c: Channel will hangup at 2013-07-22 06:59:50.318 UTC.
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002b[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:35] VERBOSE[7477] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002b'
 [2013-07-22 06:59:35] VERBOSE[6358] netsock2.c: == Using SIP VIDEO TOS bits 136
 [2013-07-22 06:59:35] VERBOSE[6358] netsock2.c: == Using SIP VIDEO CoS mark 6
 [2013-07-22 06:59:35] VERBOSE[6358] netsock2.c: == Using SIP RTP TOS bits 184
 [2013-07-22 06:59:35] VERBOSE[6358] netsock2.c: == Using SIP RTP CoS mark 5
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [9011972599309853@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua; background: yellow; mso-highlight: yellow]NoOp[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]Received incoming SIP connection from unknown peer to 9011972599309853[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [9011972599309853@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua; background: yellow; mso-highlight: yellow]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]DID=9011972599309853[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]") in new stack[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [9011972599309853@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Goto[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Goto (from-sip-external,s,1)
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]0?from-trunk,9011972599309853,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:35] VERBOSE[7478] func_timeout.c: Channel will hangup at 2013-07-22 06:59:50.758 UTC.
 [2013-07-22 06:59:35] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002c'
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [h@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]NoOp[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]Hangup[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [h@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]DID=s[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [h@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Goto[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Goto (from-sip-external,s,1)
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]0?from-trunk,s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] func_timeout.c: Channel will hangup at 2013-07-22 06:59:51.063 UTC.
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002c[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:36] VERBOSE[7478] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002c'
 [2013-07-22 06:59:36] VERBOSE[6358] netsock2.c: == Using SIP VIDEO TOS bits 136
 [2013-07-22 06:59:36] VERBOSE[6358] netsock2.c: == Using SIP VIDEO CoS mark 6
 [2013-07-22 06:59:36] VERBOSE[6358] netsock2.c: == Using SIP RTP TOS bits 184
 [2013-07-22 06:59:36] VERBOSE[6358] netsock2.c: == Using SIP RTP CoS mark 5
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [0011972599309853@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua; background: yellow; mso-highlight: yellow]NoOp[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]Received incoming SIP connection from unknown peer to 0011972599309853[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [0011972599309853@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua; background: yellow; mso-highlight: yellow]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]DID=0011972599309853[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]") in new stack[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [0011972599309853@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Goto[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Goto (from-sip-external,s,1)
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua; background: yellow; mso-highlight: yellow]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia; background: yellow; mso-highlight: yellow]0?from-trunk,0011972599309853,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black; background: yellow; mso-highlight: yellow]") in new stack[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] func_timeout.c: Channel will hangup at 2013-07-22 06:59:51.614 UTC.
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002d'
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [h@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]NoOp[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]Hangup[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [h@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]DID=s[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [h@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Goto[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Goto (from-sip-external,s,1)
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:1] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]GotoIf[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]0?from-trunk,s,1[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:2] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Set[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]TIMEOUT(absolute)=15[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] func_timeout.c: Channel will hangup at 2013-07-22 06:59:51.925 UTC.
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: -- Executing [s@from-sip-external:3] [/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: aqua]Answer[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]("[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: fuchsia]SIP/-0000002d[/size][size= 9.5pt; line-height: 115%; font-family: 'Courier New'; color: black]", "") in new stack
 [2013-07-22 06:59:36] VERBOSE[7480] pbx.c: == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/-0000002d'[/size]

naveedh11 · July 22, 2013, 7:32pm

Wow that looked bad - lets try again:

SkykingOH · July 22, 2013, 7:33pm

How kind of you on your first post to post repetitive log entries.

Yes, your completely unsecured PBX is being subject to buffer overflow attacks, code injection and general SIP dictionary type attacks.

naveedh11 · July 22, 2013, 7:38pm

Sorry about the log entries - new to this forum and apprently it doesnt like me copying and pasting logs - and I am total newb.

I have instaleld Incredible PBX but theres so much to take in I’m a bit overwhelmed. I briefly read over the TravelinMan article on NerdVittles but I suppose my installation of it - well obviously didnt work.

So where do I start? This instance has only been up a few days in EC2 - any direction on how to lock this bad boy down?

naveedh11 · July 22, 2013, 8:51pm

also can you specify why my PBX is “completely unsecured”?

I have Fail2Ban installed and running.
IPtables is online.
Amazon EC2 has a built in firewall security group.

I suppose this is due to SIP Extensions allowing any IP to attempt a SIP connection? I am working on getting a static IP for my Retail Store to fix that.

ONce that is in place - what else do I need to do to avoid these types of attacks?

deanot26508 · July 22, 2013, 8:52pm

First off, go to settings / sip settings and turn off (Allow SIP Guests) and (Allow Anonymous Inbound SIP Calls).
Now go to Admin / Sytem Admin and click on (intrusion detection), this should be running and should always run. It is not fool proof but will help to secure you a little.
Make sure all of your system passwords are changed, there is quite a few to do and I hope someone can help you with that, it confuses me…
Close any un-needed ports at your router, never use DMZ on your server unless it is for testing purposes.
Try to make sure your server is NOT accessible to the web, you only need certain ports visible.
This is a start, there are a lot of topics on security around here and you need to make it as tight as you can…

deanot26508 · July 22, 2013, 8:53pm

Also, kill ping requests on your WAN if active… This can help keep the kids out.

naveedh11 · July 22, 2013, 8:59pm

Thanks this is a good start for me.

Ive blocked off access to the Web GUI via the normal port and used an arbritrary number - need to do the same for ssh.

Since this is in Amazon EC2 its pretty much a hosted PBX so i had to open up the SIP ports to allow phones to connect. Surely there are other EC2 users out there that have a solid and secure setup?

deanot26508 · July 22, 2013, 9:47pm

Hosted services… huh, that should be fun to fix… It should be no different then a server in the same room or building as you I guess. Gonna take a step back and let the gurus jump in here.

SkykingOH · July 23, 2013, 12:50am

I think they found his random http port.

What does any of this have to do with FreePBX anyway, it’s not even our distro. They also seem much more tolerant of noobs that try and do what the experts would not attempt (an EC2 instance for a PBX).

We tend to be very conservative around here. Also you have to consider my angle. I am in the hosting business as my day job. With plans starting at $30.00 why would you want to go through all this pain?

reconwireless · July 23, 2013, 1:26am

I believe the PIAF guys played around with EC2 primarily as an experiment, proof of concept, because we can type of thing. The last I saw from Ward on that he stated in a reply on a PBX in a Flash Forum post:
“Amazon Micro instance has burst capacity which gives it the capability to support lots of extensions and numerous calls for short periods of time. Once you start actually using a system heavily, you’ll need a much beefier flavor of EC2 which gets expensive fast because the regular instances don’t have burst capability. A dual-core Atom machine or a quad-core PC then becomes a much better option in terms of operating cost.
To put it less charitably, micro instances give the appearance of limitless capacity which quickly evaporates once you begin to actually need it.” http://pbxinaflash.com/community/index.php?threads/amazon-ec2-and-piaf-anyone-tested-loads-etc.12969/#post-82010
There was a blog post earlier this month where you could get a VPS at FreePBXhosting.com for $24.95… includes sysadmin pro and Commercial EPM licenses, as well as a 30 day money back guarantee… You can also try PROMO CODE FREEPBX2013 for a free month… not sure if that one still works, but you can give it a shot.

naveedh11 · July 23, 2013, 2:40pm

thanks for the feedback - I realize this is probably not the most optimal solution - but if you read my original post you would see that this is a pilot and is mostly for educational purposes.

The PBX instance is currently hosting only one phone and we are using this as a test to determine if VoIP is going to be a good solution for us. I am keeping a close eye on the data usage on my AWS account to ensure I’m not getting charged for unexpected usage.

In regards to using another hosting service - what’s the fun in that? I came here to learn how to implement and maintain a PBX - I’m fairly linux savvy and know enough about PBX’s to be dangerous at this point lol.

Surely the “experts” in this forum started off as some sort of noob as well.

reconwireless · July 23, 2013, 3:47pm

We aren’t trying to discourage you from learning, but EC2 is probably not the best place to be learning, as like you said there could be monetary issues if you go over your “Free” limits. Build a virtualbox install, or look at dedicated hardware, or services such as freepbxhosting.com if you want something serious for your retail stores. FreePBXhosting.com does build the installation for you, but you have root access, and full admin rights to tinker to your hearts content… and if you break something too bad you can easily start over. Freepbxhostings.com basic plan is $24.95 per month, that’s about 80 cents per day, most people spend more on coffee and soda than that.