[asterisk-bugs] [JIRA] (ASTERISK-24506) 403 Forbidden Fix for Big Loaded systems
HZMI8gkCvPpom0tM (JIRA)
noreply at issues.asterisk.org
Fri Nov 7 03:14:28 CST 2014
HZMI8gkCvPpom0tM created ASTERISK-24506:
-------------------------------------------
Summary: 403 Forbidden Fix for Big Loaded systems
Key: ASTERISK-24506
URL: https://issues.asterisk.org/jira/browse/ASTERISK-24506
Project: Asterisk
Issue Type: Improvement
Security Level: None
Components: Channels/chan_sip/Security Framework
Affects Versions: 13.0.0-beta3, 13.0.0-beta2
Reporter: HZMI8gkCvPpom0tM
Severity: Critical
Attachments: new.patch
On big loaded systems with more than 40k subscribers 403 Forbidden (Bad auth) is only way to detect and block username scans which can create REALTIME database deny of service. As practice show - for frauders absolutely no matter is it 403 Forbidden or 403 Forbidden (Bad auth) they continue to send hundreds thousands registrations and invites with different credentials until finish their list. Usage 403 Forbidden (Bad auth) best style to detect such attacks and stop them on firewall side instead to pass them through whole infrastructure to database. I included patch which return back 403 Forbidden (Bad auth) in chan_sip.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
More information about the asterisk-bugs
mailing list