<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} .ms-cui-menu {background-color:#ffffff;border:1px rgb(171, 171, 171) solid;font-family:'Segoe UI WPC', 'Segoe UI', Tahoma, 'Microsoft Sans Serif', Verdana, sans-serif;font-size:11pt;color:rgb(51, 51, 51);} .ms-cui-menusection-title {display:none;} .ms-cui-ctl {vertical-align:text-top;text-decoration:none;color:rgb(51, 51, 51);} .ms-cui-ctl-on {background-color:rgb(223, 237, 250);opacity: 0.8;} .ms-cui-img-cont-float {display:inline-block;margin-top:2px} .ms-cui-smenu-inner {padding-top:0px;} .ms-owa-paste-option-icon {margin: 2px 4px 0px 4px;vertical-align:sub;padding-bottom: 2px;display:inline-block;} .ms-rtePasteFlyout-option:hover {background-color:rgb(223, 237, 250) !important;opacity:1 !important;} .ms-rtePasteFlyout-option {padding:8px 4px 8px 4px;outline:none;} .ms-cui-menusection {float:left; width:85px;height:24px;overflow:hidden}
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
span.EmailStyle19
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
-->
--></style>
</head>
<body>
<div style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>You can also take a look at SecAst (www.generationd.com). The free version is a drop-in replacement for fail2ban but also add a lot more intelligence (and no need to update regex's etc). There's also geographic IP fencing so you can block attacks by country
/ region / city etc., only allow access by geography, etc. And a whole lot more (including detection of breached but valid credentials to halt ongoing fraud, etc)<br>
</p>
<p><br>
</p>
<p>-=M=-<br>
</p>
<p><br>
</p>
<p>The opinions above are my own, and don't necessarily represent those of my employer. Since I'm employed by Generation D however you can bet that I have a serious bias :) <br>
</p>
<p><br>
</p>
<div style="color: #282828;">
<hr tabindex="-1" style="display: inline-block; width: 98%;">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;"><b>From:</b> asterisk-users-bounces@lists.digium.com <asterisk-users-bounces@lists.digium.com> on behalf of Eric Wieling <EWieling@nyigc.com><br>
<b>Sent:</b> Thursday, September 4, 2014 11:58 AM<br>
<b>To:</b> Asterisk Users List<br>
<b>Subject:</b> Re: [asterisk-users] Asterisk secure fine tune - stop attack</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;">If we don’t need to allow access from outside the USA we block access from all non-ARIN IP addresses by using iptables. This takes care of at least 80% of
attacks.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;">I enabled guest access and pointed all guest calls to an IVR which auto disconnects the call after a while (2 min seems good) if there is no response. That
took care of most of the remaining attacks.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;">I’m considering enabling auto create peer and routing calls to the same IVR as above.
</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;">We also use fail2ban, but mostly for non-SIP attacks.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;">Before enabling any guest access be ABSOLUTELY SURE you know how to do it without causing security issues.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: calibri, sans-serif; color: #1f497d;"> </span></p>
<div>
<div style="border-style: solid none none; border-top-color: #b5c4df; border-top-width: 1pt; padding: 3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: tahoma, sans-serif;"> asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com]
<b>On Behalf Of </b>Hashmat Khan<br>
<b>Sent:</b> Thursday, September 04, 2014 3:45 PM<br>
<b>To:</b> Asterisk Users Mailing List - Non-Commercial Discussion<br>
<b>Subject:</b> Re: [asterisk-users] Asterisk secure fine tune - stop attack</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">dont forgot to put your "trusted IPs" into "ignoreip" list while configuring fail2ban</span></p>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">its very important when a customer (may be 100+ extns) are behind NAT and only present single public IP</span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">Rgds</span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-family: calibri, sans-serif;">Hash</span></p>
<div>
<div class="MsoNormal" align="center" style="text-align: center;"><span style="font-family: calibri, sans-serif;">
<hr size="2" width="100%" align="center" id="stopSpelling">
</span> </div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-family: calibri, sans-serif;">Date: Thu, 4 Sep 2014 08:42:11 -0700<br>
From: <a href="mailto:motty.cruz@gmail.com">motty.cruz@gmail.com</a><br>
To: <a href="mailto:asterisk-users@lists.digium.com">asterisk-users@lists.digium.com</a><br>
Subject: Re: [asterisk-users] Asterisk secure fine tune - stop attack</span></p>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">Hi A J, </span></p>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">believe me, I wish i do as you suggested, however I have a few extensions outside the office with dynamic IPs, so that is not a possibility. Thanks for your suggestions, I will try fail2ban.
I don't know how complicated is to implement that on production server. </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"> </span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">Thanks, <br>
-Motty</span></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-family: calibri, sans-serif;"> </span></p>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">On Thu, Sep 4, 2014 at 8:19 AM, A J Stiles <<a href="mailto:asterisk_list@earthshod.co.uk" target="_blank">asterisk_list@earthshod.co.uk</a>> wrote:</span></p>
<div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-family: calibri, sans-serif;">On Thursday 04 Sep 2014, motty cruz wrote:<br>
> Hi All,<br>
> I see this kind of attack on our Asterisk Server, do you know how to block<br>
> that IP?</span></p>
</div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;">Instead of blocking unwanted IPs, you should be permitting only wanted IPs.<br>
<span style="color: #888888;"><br>
<span class="ecxhoenzb">--</span><br>
<span class="ecxhoenzb">AJS</span><br>
<br>
<span class="ecxhoenzb">Note: Originating address only accepts e-mail from list! If replying off-</span><br>
<span class="ecxhoenzb">list, change address to asterisk1list at earthshod dot co dot uk .</span></span></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"><br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com/" target="_blank">
http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"> </span></p>
</div>
<p class="MsoNormal"><span style="font-family: calibri, sans-serif;"><br>
-- _____________________________________________________________________ -- Bandwidth and Colocation Provided by
<a href="http://www.api-digital.com/">http://www.api-digital.com</a> -- New to Asterisk? Join us for a live introductory webinar every Thurs:
<a href="http://www.asterisk.org/hello">http://www.asterisk.org/hello</a> asterisk-users mailing list To UNSUBSCRIBE or update options visit:
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users">http://lists.digium.com/mailman/listinfo/asterisk-users</a></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>