<div dir="ltr">Hi Arthur<div><br></div><div>It was a fail2ban based query and fail2ban is still working fine. </div><div><br></div><div>I was just trying to find out if the change was intentional or not.</div><div><br></div>
<div>Regards</div><div><br></div><div>Ish</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 4 November 2013 15:52, Arthur J. Stanfield <span dir="ltr"><<a href="mailto:aj@dmcip.com" target="_blank">aj@dmcip.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Ish,<br>
<br>
I assume you are using Fail2Ban to monitor the logs for dictionary attacks - If so, the following regex should work for 1.8:<br>
<br>
Registration from '.*' failed for '<HOST>(:[0-9]{1,5})?' - Wrong password<br>
Registration from '.*' failed for '<HOST>(:[0-9]{1,5})?' - No matching peer found<br>
Registration from '.*' failed for '<HOST>(:[0-9]{1,5})?' - Username/auth name mismatch<br>
Registration from '.*' failed for '<HOST>(:[0-9]{1,5})?' - Device does not match ACL<br>
Registration from '.*' failed for '<HOST>(:[0-9]{1,5})?' - Peer is not supposed to register<br>
<br>
<br>
<br>
-<br>
Regards,<br>
AJ Stanfield<br>
<br>
t: 0161-850-4001<br>
e: <a href="mailto:aj@dmcip.com">aj@dmcip.com</a><br>
w: <a href="http://www.dmcip.com" target="_blank">http://www.dmcip.com</a><br>
<div class="HOEnZb"><div class="h5"><br>
----- Original Message -----<br>
From: "Ishfaq Malik" <<a href="mailto:ish@pack-net.co.uk">ish@pack-net.co.uk</a>><br>
To: "Asterisk Users Mailing List - Non-Commercial Discussion" <<a href="mailto:asterisk-users@lists.digium.com">asterisk-users@lists.digium.com</a>><br>
Sent: Monday, 4 November, 2013 3:36:06 PM<br>
Subject: Re: [asterisk-users] No matching peers message has gone (1.8.23.1)<br>
<br>
<br>
<br>
Hi<br>
<br>
<br>
Thanks for the quick response. I'll read all the change logs from now on, I promise!<br>
<br>
<br>
Ish<br>
<br>
<br>
<br>
On 4 November 2013 15:29, Joshua Colp < <a href="mailto:jcolp@digium.com">jcolp@digium.com</a> > wrote:<br>
<br>
<br>
<br>
Ishfaq Malik wrote:<br>
<br>
<br>
Hi<br>
<br>
Ever since we upgraded our asterisk servers to 1.8.23.1, we no longer<br>
get the 'no matching peer' error when we get a dictionary SIP attack.<br>
<br>
Now the logs always show a 'wrong password' when there actually isn't a<br>
matching peer.<br>
<br>
We even have alwaysauthreject = yes in our sip.conf.<br>
<br>
Has anyone else noticed this phenomenon?<br>
<br>
This is on purpose. To fix some exposure issues the code was changed to have an internal peer (albeit one that can never successfully be authenticated against) that gets used if no real peer is found. This reduces the chance (by a lot) of the code exposing information in some off nominal cases.<br>
<br>
--<br>
Joshua Colp<br>
Digium, Inc. | Senior Software Developer<br>
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA<br>
Check us out at: <a href="http://www.digium.com" target="_blank">www.digium.com</a> & <a href="http://www.asterisk.org" target="_blank">www.asterisk.org</a><br>
<br>
--<br>
______________________________ ______________________________ _________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/" target="_blank">http://lists.digium.com/</a> mailman/listinfo/asterisk- users<br>
<br>
<br>
<br>
<br>
--<br>
<br>
Ishfaq Malik<br>
Department: VOIP Support<br>
Company: Packnet Limited<br>
t: <a href="tel:%2B44%20%280%29845%20004%204994" value="+448450044994">+44 (0)845 004 4994</a><br>
f: <a href="tel:%2B44%20%280%29161%20660%209825" value="+441616609825">+44 (0)161 660 9825</a><br>
e: <a href="mailto:ish@pack-net.co.uk">ish@pack-net.co.uk</a> w: <a href="http://www.pack-net.co.uk" target="_blank">http://www.pack-net.co.uk</a> Registered Address: PACKNET LIMITED, Duplex 2, Ducie House<br>
37 Ducie Street<br>
Manchester, M1 2JW<br>
COMPANY REG NO. 04920552<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><pre>Ishfaq Malik
Department: VOIP Support
Company: Packnet Limited
t: +44 (0)845 004 4994
f: +44 (0)161 660 9825
e: <a href="mailto:ish@pack-net.co.uk" target="_blank">ish@pack-net.co.uk</a>
w: <a href="http://www.pack-net.co.uk" target="_blank">http://www.pack-net.co.uk</a>
Registered Address: PACKNET LIMITED, Duplex 2, Ducie House
37 Ducie Street
Manchester, M1 2JW
COMPANY REG NO. 04920552
</pre></div>
</div>