<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
We discussed this on freenode #freepbx today, and someone did the
following math.<br>
<br>
A 20 digit numerical password/secret (numerical meaning only 0-9 -
obviously), attacked via brute force at 5,000,000 passwords per second,
would take more than 600,000+ years to crack. I didn't verify but it
looks about right.<br>
<br>
Lesson of the day? Sure, more secure passwords aren't THE solution, but
they sure help. I'm pretty sure any attempt to brute force a SIP
password on an asterisk box at anything approching 5 million passwords
per second would have side effects that would bring the attack to your
attention (like bringing your sip stack to it's knees perhaps?)<br>
<br>
Remember, as nice as fail2ban is, it is vulnerable to denial of service
attacks. It is possible (even easy) to use it against the actual
intended users of a system - blocking them from accessing their own
system via iptables. <br>
<br>
With most phones being auto-provisioned, the length of the password
shouldn't be a limiting factor. Make your passwords/secrets more
complex and we can be done with this conversation. Please.<br>
<br>
Andy<br>
<br>
<br>
<br>
<div class="moz-signature">
<p align="left"><font face="Times New Roman, Times, serif" size="1">
<table border="0" width="317">
<tbody>
<tr valigh="top">
<td>
<div align="center"> <a href="http://www.anteil.com"><img
moz-do-not-send="false" src="cid:part1.03000004.02040606@anteil.com"
alt="Anteil, Inc." border="0"></a>
<table border="0" width="317">
<tbody>
<tr>
<td colspan="3">
<div align="center">
<table width="270">
<tbody>
<tr>
<td>
<hr></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr valign="top">
<td width="134">
<div align="right"><font color="#000000"
face="Times New Roman, Times, serif" size="2"> <strong>Andrew M.
Lauppe<br>
</strong> <em>Consultant</em> </font>
</div>
</td>
<td width="11"><br>
</td>
<td width="148"><font face="Times New Roman, Times, serif"><font
color="#666666" size="1">4051B Executive Park Dr.<br>
Harrisburg, PA 17111<br>
<hr align="left" width="105">+1 (877) OS-LINUX x23<br>
+1 (484) 421-9919 direct </font></font></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</font></p>
</div>
</body>
</html>