<div dir="ltr">Exactly.<div><br></div><div> If one's external access control is set correctly, you should basically never see any outside attack traffic at your Asterisk box (you've see it in the firewall logs instead).</div><div><br></div><div>Following the concept of "least privileges" is where you should start if you have Asterisk attached to a SIP service you pay for. If you have one SIP provider, the only IP address (or IP pool/range) that should talk to your Asterisk box from outside your firewall is exclusively the servers of your SIP provider. Everything else should be "dropped" (no response at all).</div><div><br></div><div>Google "GRC Shields Up" and run that free port scanner to see what you have open, closed or what they call "stealth" (dropped). If a firewall is setup correctly, port 5060 should appear "stealth" from any IP address other than your service provider.</div><div><br></div><div>You can also Shodan yourself: "<a href="https://www.shodan.io/host{yourPublicIP}">https://www.shodan.io/host{yourPublicIP}</a>" - but Shodan doesn't tell you whether the packets are dropped or rejected. In general you want your public IP to only show services on Shodan that you intend every random request to get access to - for example a public web server on port 80 and 443.</div><div><br></div><div>It's a good idea to review these resources often (once a quarter, once a month, once a week - your choice), especially after any software or hardware changes on your network. You may find something has been misconfigured at installation, that you would need to address.</div><div><br></div><div>Best</div><div><br></div><div>-Tim<br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 21, 2017 at 9:53 AM, Victor Villarreal <span dir="ltr"><<a href="mailto:mefhigoseth@gmail.com" target="_blank">mefhigoseth@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div>Hi David, Tim,<br><br></div>Try to use Bail2Ban at last resort. Fail2Ban is a ractive approach, that permit the traffinc AND ONLY BLOCK them after certain level triggered.<br><br><br></div><div>Use iptables to block the unused services faced to public networks like Internet. And configure these services properly, so they listen only selected interfaces and IPs, and not from 0.0.0.0<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-04-21 13:47 GMT-03:00 Tim S <span dir="ltr"><<a href="mailto:tim.strommen@gmail.com" target="_blank">tim.strommen@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Is that IP in your network or outside (I can ping it so I'm guessing it's outside your network)? Do you have a firewall between your asterisk box and the internet? Is there a WHITELIST of IP addresses that only allow your provider's limited IP pool to connect to your asterisk box from outside?<div><br></div><div>If you are getting TFTP requests hitting your Asterisk box, they are not properly being filtered at your firewall - ftp and tftp are considered insecure communication methods, that port (69 I think) should be closed on your firewall unless you have a really good reason to have it opened (and unless you run a public FTP site, THERE IS NO GOOD REASON).<br><div><br></div><div>Fail2Ban is a BLACKLIST method, blacklists are most effective after good network hygiene is implemented, as you drastically limit the pool of potential bad actors with a whitelist.</div></div><div><br></div><div>Best,</div><div><br></div><div>-Tim</div><div class="gmail_extra"><br><div class="gmail_quote"><span>On Fri, Apr 21, 2017 at 9:38 AM, Dovid Bender <span dir="ltr"><<a href="mailto:dovid@telecurve.com" target="_blank">dovid@telecurve.com</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span><div dir="ltr">This is old news. They use Shodan and then try to connect. Set up Fail2Ban that say after 10 404's to ban the IP.<div><br></div></div></span><div class="gmail_extra"><br><div class="gmail_quote"><span>On Fri, Apr 21, 2017 at 12:27 PM, Jerry Geis <span dir="ltr"><<a href="mailto:jerry.geis@gmail.com" target="_blank">jerry.geis@gmail.com</a>></span> wrote:<br></span><div><div class="gmail-m_-5403071273828509011h5"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I "justed" happened to look at /var/log/messages...<div><br></div><div>I saw:</div><div><div>Apr 21 12:18:40 in.tftpd[22719]: RRQ from 69.64.57.18 filename 0004f2034f6b.cfg</div><div>Apr 21 12:18:40 in.tftpd[22719]: Client 69.64.57.18 File not found 0004f2034f6b.cfg</div><div>Apr 21 12:18:40 in.tftpd[22720]: RRQ from 69.64.57.18 filename 0004f2034f6c.cfg</div><div>Apr 21 12:18:40 in.tftpd[22720]: Client 69.64.57.18 File not found 0004f2034f6c.cfg</div><div>Apr 21 12:18:40 in.tftpd[22721]: RRQ from 69.64.57.18 filename 0004f2034f6d.cfg</div><div>Apr 21 12:18:40 in.tftpd[22721]: Client 69.64.57.18 File not found 0004f2034f6d.cfg</div><div>Apr 21 12:18:40 in.tftpd[22722]: RRQ from 69.64.57.18 filename 0004f2034f6e.cfg</div></div><div><br></div><div>so basically an sequential read of polycom MAC address config files.</div><div>Some is trying to read to determine if I have any polycom files just sequential read after read.</div><div>And if so - it would get any extension and password at that time.</div><div>Luckily I have none.</div><div><br></div><div>However - how does one block attempts like this ?</div><div><br></div><div>Thanks!</div><span class="gmail-m_-5403071273828509011m_7400739519951349318m_7476294809382659296HOEnZb"><font color="#888888"><div><br></div><div>Jerry</div></font></span></div><span class="gmail-m_-5403071273828509011m_7400739519951349318HOEnZb"><font color="#888888">
<br>--<br>
______________________________<wbr>______________________________<wbr>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.org<wbr>/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/wiki<wbr>/display/AST/Getting+Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/mailm<wbr>an/listinfo/asterisk-users</a><br></font></span></blockquote></div></div></div><br></div><div><div class="gmail-m_-5403071273828509011h5">
<br>--<br>
______________________________<wbr>______________________________<wbr>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.org<wbr>/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/wiki<wbr>/display/AST/Getting+Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/mailm<wbr>an/listinfo/asterisk-users</a><br></div></div></blockquote></div><br></div></div><span class="gmail-HOEnZb"><font color="#888888">
<br>--<br>
______________________________<wbr>______________________________<wbr>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.org<wbr>/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/wiki<wbr>/display/AST/Getting+Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/mailm<wbr>an/listinfo/asterisk-users</a><br></font></span></blockquote></div><span class="gmail-HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div class="gmail-m_-5403071273828509011gmail_signature">GnuPG Key ID: 0x39BCA9D8<br><a href="https://www.github.com/mefhigoseth" target="_blank">https://www.github.com/<wbr>mefhigoseth</a><br>...:::[ God Rulz ! ]:::...</div>
</font></span></div>
<br>--<br>
______________________________<wbr>______________________________<wbr>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" rel="noreferrer" target="_blank">http://www.api-digital.com</a> --<br>
<br>
Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" rel="noreferrer" target="_blank">https://community.asterisk.<wbr>org/</a><br>
<br>
New to Asterisk? Start here:<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" rel="noreferrer" target="_blank">https://wiki.asterisk.org/<wbr>wiki/display/AST/Getting+<wbr>Started</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" rel="noreferrer" target="_blank">http://lists.digium.com/<wbr>mailman/listinfo/asterisk-<wbr>users</a><br></blockquote></div><br></div></div></div>