New install: Sipstaion trunks security and permissions (anonymous users etc)

General Help
1

Hey all,

Recently had to do a fresh install because of a potentially compromised system and now running into a “maybe” issue.

I have successfully managed to get my trunks registered and have my system to the point that I can make/receive calls. To do this I had to set my security settings in “SIP Settings” to allow anonymous inbound calls. With this disabled all inbound calls were bounced.

With it disabled I am getting TONS of “in use” trunks showing up in my statistics page.

Am I missing something?

2

Did you use the SIPStation module to automatically configure your trunks?

3

Yes, the SIPStation module did its thing and did the trunk config automatically.

4

When I pull the logs I’m getting this:

Tue, Jun 11, 2019 10:40 AM 202020 9441144630211 - -
Tue, Jun 11, 2019 10:39 AM 202020 9011441144630211 22 -
Tue, Jun 11, 2019 10:39 AM 202020 011441144630211 20 -
Tue, Jun 11, 2019 10:38 AM 101010 9441144630211 18 -
Tue, Jun 11, 2019 10:37 AM 101010 9011441144630211 21 -
Tue, Jun 11, 2019 10:36 AM 101010 011441144630211 20 -
Tue, Jun 11, 2019 10:36 AM 222200 9441144630211 19 -
Tue, Jun 11, 2019 10:35 AM 222200 9011441144630211 21 -
Tue, Jun 11, 2019 10:34 AM 2001 0000000913392053481 24 -
Tue, Jun 11, 2019 10:34 AM 222200 011441144630211 21 -
Tue, Jun 11, 2019 10:33 AM 3001 9441144630211 19 -
Tue, Jun 11, 2019 10:33 AM 3001 9011441144630211 21 -
Tue, Jun 11, 2019 10:32 AM 3001 011441144630211 20 -
Tue, Jun 11, 2019 10:31 AM 2001 000000913392053481 22 -
Tue, Jun 11, 2019 10:31 AM 90001 9441144630211 19 -
Tue, Jun 11, 2019 10:30 AM 90001 9011441144630211 22 -
Tue, Jun 11, 2019 10:30 AM 222 8011442032892011 20 -
Tue, Jun 11, 2019 10:30 AM 90001 011441144630211 20 -
Tue, Jun 11, 2019 10:29 AM 6666600000 9441144630211 18 -
Tue, Jun 11, 2019 10:28 AM 2001 9000713392053481 13 -
Tue, Jun 11, 2019 10:28 AM 6666600000 9011441144630211 12 -
Tue, Jun 11, 2019 10:27 AM 6666600000 011441144630211 13 -
Tue, Jun 11, 2019 10:27 AM 12508801397 8889957050 12 -
Tue, Jun 11, 2019 10:27 AM 80001 9441144630211 19 -
Tue, Jun 11, 2019 10:26 AM T444 011441294507639 20 -
Tue, Jun 11, 2019 10:26 AM 80001 9011441144630211 21 -
Tue, Jun 11, 2019 10:26 AM HSUK2Q +441294507639 19 -
Tue, Jun 11, 2019 10:26 AM SALEM +441376386418 18 -
Tue, Jun 11, 2019 10:26 AM SALEM 011441376386418 21 -
Tue, Jun 11, 2019 10:25 AM VLAN193 +441376386418 18 -
Tue, Jun 11, 2019 10:25 AM wei 011441356228137 20 -
Tue, Jun 11, 2019 10:25 AM 2001 9000213392053481 21 -
Tue, Jun 11, 2019 10:25 AM 80001 011441144630211 21 -
Tue, Jun 11, 2019 10:25 AM uswest +441294507639 18 -
Tue, Jun 11, 2019 10:25 AM pbx1803 +441376386418 18 -
Tue, Jun 11, 2019 10:25 AM uswest 011441294507639 20 -
Tue, Jun 11, 2019 10:25 AM j45l29z9 011441356228137 20 -
Tue, Jun 11, 2019 10:25 AM BackAdmin +441356228137 18 -
Tue, Jun 11, 2019 10:25 AM pbx1803 011441376386418 20 -
Tue, Jun 11, 2019 10:25 AM BackAdmin 011441356228137 20 -
Tue, Jun 11, 2019 10:24 AM Cheles +441356228137 18 -
Tue, Jun 11, 2019 10:24 AM 3001 9441144630211 19 -

Drilling down into one it shows something like:

Tue, Jun 11, 2019 10:40 AM HANGUP 1560274783.112 1560274783.112 202020 h from-trunk PJSIP/anonymous-0000006f
Tue, Jun 11, 2019 10:40 AM CHAN_END 1560274783.112 1560274783.112 202020 h from-trunk PJSIP/anonymous-0000006f
Tue, Jun 11, 2019 10:40 AM LINKEDID_END 1560274783.112 1560274783.112 202020 h from-trunk PJSIP/anonymous-0000006f
Tue, Jun 11, 2019 10:39 AM CHAN_START 1560274783.112 1560274783.112 202020 9011441144630211 from-sip-external PJSIP/anonymous-0000006f
Tue, Jun 11, 2019 10:39 AM ANSWER 1560274783.112 1560274783.112 202020 s from-trunk PJSIP/anonymous-0000006f

I’m assuming this is just a bot trying to guess passwords or something?

5

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.