[asterisk-users] Failed to authenticate user 1000<sip:1000 at MY_OWN_IP_ADDRESS>; tag=03f82bb9

[gincantalupo]

Hi Ricardo,

we are already using fail2ban but it bans my own ip address not the real 
original ip of the attacker. How can I find it?

Thank you

Giorgio


On 10/01/2013 02:16 PM, Ricardo Saffi Marques wrote:
> Well, you could use some software like denyhosts or fail2ban to block 
> an IP after a predefined number of (failed) authentication attempts.
>
> Regards,
>
> Ricardo
>
>
> On Tue, Oct 1, 2013 at 5:07 AM, gincantalupo 
> <gincantalupo at fgasoftware.com <mailto:gincantalupo at fgasoftware.com>> 
> wrote:
>
>     Hi,
>
>     I get a lot of these messages on my Asterisk CLI:
>
>     "Failed to authenticate user
>     1000<sip:1000 at MY_OWN_IP_ADDRESS>;tag=03f82bb9"
>
>     as if my PBX machine is trying to authenticate to itself. It seems
>     someone is attacking my asterisk PBX.
>
>     Is there a way to fix this problem?
>
>     Thank you.
>
>     Giorgio Incantalupo
>
>
>     -- 
>     _____________________________________________________________________
>     -- Bandwidth and Colocation Provided by http://www.api-digital.com --
>     New to Asterisk? Join us for a live introductory webinar every Thurs:
>     http://www.asterisk.org/hello
>
>     asterisk-users mailing list
>     To UNSUBSCRIBE or update options visit:
>     http://lists.digium.com/mailman/listinfo/asterisk-users
>
>
>
>
> -- 
> *Ricardo Saffi Marques*
> [Linux SysAdmin]
> *
> *
> *São Paulo/SP:* (11) 2104-0005
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20131001/227486e4/attachment.html>