<div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im"><br>
</div>I understand your position, but I think there is still possible to use some<br>
(maybe a bit more complicated) heuristic to detect attacks. Please remember<br>
that VoIP/SIP is not as simple as for example ssh or telnet. SIP attacks may<br>
use relatively rich set of techniques, which will never cause generation of<br>
just one unified message in the "Hey! There's an attack!" style.<br>
<font color="#888888"><br></font></blockquote><div>Thanks very much for the input Pavel. I see your point on the messages being the same and I take my objection back on #1. </div><div><br></div><div>But showing the source IP address in all logs CAN be standardized by Asterisk and it should be done despite whatever sophisticated types of attacks might come through because source IP is always an IP and has nothing to do with what the attack format looks like. </div>
<div><br></div><div>If no source IP is sent in the SIP packet then one doesn't have to worry because the response won't go anywhere any-ways. In that case maybe Asterisk can pull the IP from network layer of the OS?! </div>
<div><br></div><div>Shouldn't it be upto chan_sip.c to always record that IP address? Why not do it if the benefit greatly outweighs not doing it? Just that is done in the registration attemtps:</div><div><i>NOTICE[10331] chan_sip.c: Registration from 'Eyebeam-Softphone<<a href="mailto:sip%3A9999@192.168.0.170">sip:9999@192.168.0.170</a>>' failed for '<b>172.16.0.6</b>:8347' - No matching peer found</i></div>
<div><br></div><div>Above shows "172.16.0.6" which is the source IP and it can be used with Fail2ban to block rather than resorting to CDRs. I really can't think of using CDRs for security reasons as it will be way to complex. Log are always used for security parsing in any system I know of and CDRs are not really system logs bur rather dynamic logs...I appreciate and understand that Asterisk is a PBX and security shouldn't be it's concern but it should provide the basic standardized logging for security tools to use it comfortably without being scared that it might changed over night with a new build. I think once the logs are universalized for core things like this then security issues would be much easier to tackle. </div>
<div><br></div><div>Best,</div><div><br></div><div><br></div><div> </div></div>