I am using fail2ban on all my asterisk server, but beware, fail2ban can be a dangerous software. The problem rely on the fact that SIP uses UDP, so it is possible to send messages with a forged source IP address. This way the bad guy out there can "ban" all your IP addresses. I say "it is possible" without having investigated in deep details what is really needed to do. <div>
<br></div><div>Leandro<br><br><div class="gmail_quote">2013/1/3 Éder <span dir="ltr"><<a href="mailto:eder@openminds.com.br" target="_blank">eder@openminds.com.br</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Howto fail2ban in asterisk<br>
<br>
<a href="http://www.voip-info.org/wiki/view/Fail2Ban+%28with+iptables%29+And+Asterisk" target="_blank">http://www.voip-info.org/wiki/view/Fail2Ban+%28with+iptables%29+And+Asterisk</a><br>
<div class="im HOEnZb"><br>
<br>
<br>
-----Mensagem original-----<br>
De: <a href="mailto:asterisk-users-bounces@lists.digium.com">asterisk-users-bounces@lists.digium.com</a><br>
[mailto:<a href="mailto:asterisk-users-bounces@lists.digium.com">asterisk-users-bounces@lists.digium.com</a>] Em nome de Frank<br>
Enviada em: quarta-feira, 2 de janeiro de 2013 20:50<br>
Para: Asterisk Users Mailing List - Non-Commercial Discussion<br>
Assunto: [asterisk-users] Auto ban IP addresses<br>
<br>
</div><div class="HOEnZb"><div class="h5">Greetings all,<br>
<br>
I have been seeing a lot of<br>
<br>
[Jan 2 16:36:31] NOTICE[7519]: chan_sip.c:23149 handle_request_invite:<br>
Sending fake auth rejection for device<br>
100<<a href="mailto:sip%3A100@108.161.145.18">sip:100@108.161.145.18</a>>;tag=2e921697<br>
<br>
in my logs lately. Is there a way to automatically ban IP address from<br>
attackers within asterisk ?<br>
<br>
<br>
Thank you<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</div></div></blockquote></div><br></div>