[asterisk-users] Security AccountID unknown - PJSIP
admin at tootai.net
Mon Sep 30 08:52:32 CDT 2019
Le 30/09/2019 à 11:45, Joshua C. Colp a écrit :
> On Fri, Sep 27, 2019, at 11:31 AM, Administrator TOOTAI wrote:
>> Hi list,
>> I would like to now what is the sense of such type of entry in security.log
>> [2019-09-27 15:12:24] SECURITY res_security_log.c:
>> SessionID="56b0ca9-d967a90d16411209-a1b0fae1 at 22.214.171.124",LocalAddress="IPV4/UDP/<MyAddress>/5060",
>> We have a lot of such tries coming from IPs not allowed and fail2ban
>> fail to ban them because of SecurityEvent not treated and Severity
>> We add a fail2ban filter to ban those IPs which is OK on our side but
>> also means that attacker knows that account is not existing.
>> Any comment appreciate
> SIP uses a challenge/response mechanism for authentication. The above indicates that a challenge was sent. The remote side is under no obligation to retry with authentication and may choose not to. If they did and failed another message would occur.
From security logs 26/09/2019 before we add our fail2ban rule:
In 2 minutes, the same IP address. We count 28862 tries from 11/09/2019
to 26/09/2019 coming *ONLY* from this IP address :(, average being 80
If I understand you, there is no check between 2 authentication tries
coming from the same IP address which doesn't reply to a challenge ?
Thanks for your support
More information about the asterisk-users