<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Could you please provide the list of Ban IP's doing this fraud?<br>
<br>
Sikander<br>
<br>
John Todd wrote:
<blockquote cite="mid:2844A491-CE43-4C7A-93CF-E5A0CC752469@digium.com"
type="cite">
<pre wrap="">On Feb 27, 2009, at 1:04 PM, <a class="moz-txt-link-abbreviated" href="mailto:voip-asterisk@maximumcrm.com">voip-asterisk@maximumcrm.com</a> wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">I'd suggest to everyone to ban that IP, it's been scanning our
networks
from time to time, in a sequential manner by IP.
</pre>
</blockquote>
<pre wrap="">I've had really good luck with this:
<a class="moz-txt-link-freetext" href="http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk">http://www.voip-info.org/wiki/view/Fail2Ban+(with+iptables)+And+Asterisk</a>
Basically, it automatically blackhols via IPtables any host that
fails a
certain number of registration attempts in a given period.
</pre>
</blockquote>
<pre wrap="">Yeah we're actually rolling it out on all of our production servers,
it's
a great application to run.
I'm working on some scripts to propagate the bans to the firewall so
that
all of the servers get protected as soon as possible.
</pre>
<blockquote type="cite">
<pre wrap="">[default]
; Send any unauthenticated calls to the local FBI office
context=local-fbi-office
I've got a honeypot server that pretty much accepts any calls that
come
through, and plays a "Thank you for calling the Telecommunications
Fraud
hotline. Please stay online for the next available representative."
If they
stay online for more than 20 seconds, it connects them to an agent
at the
FBI that we have been working with.
I've been meaning to add some code in that pulls out the
originating IP
address of the call and tells it to the agent when we call. :)
</pre>
</blockquote>
<pre wrap="">That would be great to have!
</pre>
</blockquote>
<pre wrap=""><!---->
This sounds very much like the framework I discussed at the last
astridevcon in September. I've had no time to work on it, but it
sounds like you're already making progress.
<a class="moz-txt-link-freetext" href="http://astridevcon.pbwiki.com/Network-Security-Framework">http://astridevcon.pbwiki.com/Network-Security-Framework</a>
Would you be interested in making your work more integral to Asterisk,
so that it can be a generic security policy model for all channel
methods, starting with SIP? Or is the scrape-from-logfile method
sufficient for your needs?
JT
---
John Todd <a class="moz-txt-link-abbreviated" href="mailto:email:jtodd@digium.com">email:jtodd@digium.com</a>
Digium, Inc. | Asterisk Open Source Community Director
445 Jan Davis Drive NW - Huntsville AL 35806 - USA
direct: +1-256-428-6083 <a class="moz-txt-link-freetext" href="http://www.digium.com/">http://www.digium.com/</a>
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
</body>
</html>