<p>Hi J,</p>
<p>When I used FreePBX, I faced these situations occasionally. It is normal to see these entries in your CDR when hackers are trying to misuse your system. There doesn't need to be a real extension for it to appear it in the CDR. Based on what SIP URI the hacker sends, the CDR will display some entry in the 'src' field. In your case it is 3799 because the hacker or his software knows that once it was successful from this particular extension. Eventually you may see 3780, 3781 all the way up.</p>
<p>The 'dst' s is the destination context in which FreePBX is dumping these SIP inbound calls. You can see in the CDR, in table 'dcontext'. If in the General Settings of FreePBX you have setup 'Allow Anonymous SIP Calls = no', which is the default, then this is the [from-sip-external] context, otherwise it is [from-trunk] context. Don't allow anonymous SIP calls and keep it 'no'. The hacker is trying to register on your system and hearing the no service message followed by the congestion tone.</p>
<p>Having said this all, look into Fail2Ban. That would had blocked this hacker already at your kernel level at least.<br></p>
<p>Zeeshan A Zakaria</p>
<p>--<br>
Sent from my Android phone with K-9 Mail.</p>
<p><blockquote type="cite">On 2010-06-08 9:59 AM, "J" <<a href="mailto:jmaurer@2ergo.com">jmaurer@2ergo.com</a>> wrote:<br><br>I'm fairly new to FreePBX/Asterisk/Trixbox, but have Googled myself<br>
into submission here, so any assistance is appreciated.<br>
<br>
We had a user with a weak SIP secret recently that allowed it to be<br>
used by an outside user. The extension was 3799. I could see the<br>
intruder's calls (including the destination phone numbers) in the<br>
trixbox call report log. Because the extension was no longer used, I<br>
went ahead and deleted it, thinking that would solve the problem. I<br>
also discovered approximately the same time that the Asterisk Call<br>
Manager port was open to the outside world, which has since been<br>
closed. The web interface, ssh, etc. have never been exposed to the<br>
outside world. Since taking these actions, I restarted the asterisk<br>
server.<br>
<br>
Now, here's the issue. I don't think deleting the extension helped.<br>
Now I see entries like this in the reports log:<br>
<br>
Calldate Channel Source Clid Dst Disposition Duration<br>
1. 2010-06-07 16:47:38 SIP/206.20... 3799 "asterisk"<br>
<3799> s ANSWERED 00:14<br>
<br>
The "Dst" field being "s", where it used to be the phone number being<br>
dialed. How is this extension able to be used even after it has been<br>
deleted?<br>
<br>
Strangely, what I've done to keep the user out in the mean time is<br>
re-created the 3799 extension with a better secret. This results in<br>
log entries like the following:<br>
<br>
[Jun 7 17:04:16] NOTICE[7422] chan_sip.c: Failed to authenticate user<br>
"asterisk" <<a href="mailto:sip%3A3799@206.205.124.247">sip:3799@206.205.124.247</a>>;tag=as23bacb61<br>
<br>
Why can sip:3799 connect and make calls when the extension doesn't<br>
exist? Is this person somehow using a "user" account? I've checked<br>
both /etc/asterisk and the MySQL tables and am not coming up with<br>
much. What does it mean that their destination is "s", not a phone<br>
number?<br>
<br>
Thanks for any assistance!<br>
J<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</blockquote></p>