I saw multiple attacks from <a href="http://OVH.NET">OVH.NET</a> IP addresses over the last few weeks as well. I have used a few of the tips in this article to secure PBXs before as well <a href="http://nerdvittles.com/?p=580">http://nerdvittles.com/?p=580</a> (fail2ban/IPTables). <br>
<br>For switchvox the root account seems to have a key, not a password to login. You can always boot in single user mode, create a new user and add that user to the sudoers file then disable root from being able to login via ssh.conf.<br>
<br>You should be able to then setup IPTables on Switchvox as well after going in and creating the second account.<br><br>However what I'm not sure of is if this will last during software upgrades that Switchvox may push out.<br>
<br>Good luck, its a pain in the rear staying ahead of the game, but hopefully these tips will give you the upper hand.<br><br><br><div class="gmail_quote">On Sun, Feb 8, 2009 at 2:29 PM, VIP Carrier <span dir="ltr"><<a href="mailto:vipcarrier@gmail.com">vipcarrier@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">As Andrew from Anteli have mentioned there is no way to access switchvox via SSH only web gui! and there is no way to read a logs as well.<br>
So we are stock Digium can't help us! they just simply said just use a CD to reinstall the system! how f@cking nice tech support.<div><div></div><div class="Wj3C7c"><br>
<br><br><div class="gmail_quote">On Sun, Feb 8, 2009 at 10:19 AM, Andrew M. Lauppe <span dir="ltr"><<a href="mailto:alauppe@anteil.com" target="_blank">alauppe@anteil.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
I'm not standing up for SwitchVOX but I would point out that, on that
platform, the root password is both unknown/undocumented, and there is
no way to activate it for end-user access short of booting from a
recovery CD and using single-user mode or chroot and running passwd. <br>
<br>
In other words, SSH is useless on that platform so this machine had to
be hacked some other way. Also - with no shell access, there is no
access to the apache or asterisk logs, and no way to install fail2ban.
If you're running switchvox, you <b>NEED </b>to put it behind a
firewall with logging. <br>
<br>
If you need help securing switchvox, or building a firewall with proper
logging support, let us know. Anteil is happy to help.<br>
<br>
Andy<br>
<div>
<p align="left"><font size="1" face="Times New Roman, Times, serif">
<table border="0" width="317">
<tbody>
<tr>
<td>
<div align="center"> <a href="http://www.anteil.com" target="_blank"><img src="cid:part1.06010109.00000507@anteil.com" alt="Anteil, Inc." border="0"></a>
<table border="0" width="317">
<tbody>
<tr>
<td colspan="3">
<div align="center">
<table width="270">
<tbody>
<tr>
<td>
<hr></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr valign="top">
<td width="134">
<div align="right"><font color="#000000" size="2" face="Times New Roman, Times, serif"> <b>Andrew M.
Lauppe<br>
</b> <i>Consultant</i> </font>
</div>
</td>
<td width="11"><br>
</td>
<td width="148"><font face="Times New Roman, Times, serif"><font color="#666666" size="1">4051B Executive Park Dr.<br>
Harrisburg, PA 17111<br>
<hr align="left" width="105">+1 (877) OS-LINUX x23<br>
+1 (484) 421-9919 direct </font></font></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</font></p>
</div><div><div></div><div>
<br>
<br>
<a href="mailto:voip-asterisk@maximumcrm.com" target="_blank">voip-asterisk@maximumcrm.com</a> wrote:
<blockquote type="cite">
<blockquote type="cite">
<pre>On Sat, 2009-02-07 at 21:54 -0500, Alex Balashov wrote:
</pre>
<blockquote type="cite">
<pre>Agreed strongly.
1) For one, it sounds like you allowed remote root logins directly via
SSH via password. Many people seem to do this for convenience. This is
VERY BAD and should NEVER, EVER be allowed under any circumstances.
Only password access to user accounts should be permitted 100% of the time.
2) Secondly, SSH should really not be open to the public at all. With
some hosts, that just can't be helped (public access boxes). For a PBX,
there is absolutely no reason why SSH should be open to anyone but you.
My SSH on all servers is firewalled to everyone in the world and I can
only get in through an OpenVPN management VPN. If for some reason that
fails or I am on a host that doesn't have a client, there are a few IPs
that are allowed in as a back door. That's it.
</pre>
</blockquote>
<pre>Having the ssh server at the default port and accepting password
authentication its a security problem waiting to happen.
Looking at firewall logs you can see that the ssh port is scanned
routinely and brute force attacks happen all the time.
If you need to have ssh access open, move it a another port,disable
password auth and use only publickey auth.
Also as I see more and more companies implementing a strict "no incoming
ports open" policy (which is good), an option is to have a reverse ssh
tunnel.
<a href="http://skoroneos.blogspot.com/2009/01/doing-reverse-ssh-tunnel-embedded-way.html" target="_blank">http://skoroneos.blogspot.com/2009/01/doing-reverse-ssh-tunnel-embedded-way.html</a>
I have implemented this in our embedded asterisk distro and now works
with the dialplan also.
i.e you trigger the connection from inside by dialing a number
</pre>
</blockquote>
<pre>There are other ways too, including port knocking.
For SIP bruteforce attack, I use fail2ban to monitor the logs and firewall
any attacks,in addition to having strong passwords and long sip user ids.
_______________________________________________
--Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
</div></div></div>
<br>_______________________________________________<br>
--Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
<br>
asterisk-biz mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br></blockquote></div><br>
</div></div><br>_______________________________________________<br>
--Bandwidth and Colocation Provided by <a href="http://www.api-digital.com--" target="_blank">http://www.api-digital.com--</a><br>
<br>
asterisk-biz mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-biz" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-biz</a><br></blockquote></div><br>