<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>If this is a home system, try the free edition of SecAst (<a href="http://www.telium.ca/?secast">www.telium.ca/?secast</a>). It uses the AMI for detecting simple failed events , but can do more than fail2ban. More importantly it can block at the network edge by talking to you firewall (don’t let the script kiddies onto you LAN).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>If decide to try geofencing using just IP rules than you will really slow your system (as the number of rules and exceptions is massive in order to be useful). There are some open source IP to location services (SaaS) which are free if it’s not for commercial use.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>-Raj-<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>All opinions expressed on the boards/chat groups are my own. As an employee of Telium my views may appear seriously biased – but I hope there’s some helpful info in there for you </span><span style='font-size:11.0pt;font-family:Wingdings;color:#1F497D'>J</span><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> asterisk-users-bounces@lists.digium.com [mailto:asterisk-users-bounces@lists.digium.com] <b>On Behalf Of </b>Mike Diehl<br><b>Sent:</b> Saturday, August 19, 2017 11:54 PM<br><b>To:</b> Asterisk Users Mailing List - Non-Commercial Discussion <asterisk-users@lists.digium.com><br><b>Subject:</b> Re: [asterisk-users] Detecting DoS attacks via SIP<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><div><div><div><div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I appreciate the discussion on the question I asked.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>I currently listen for failed registration attempts via AMI and automatically block the offending IP address at the firewall. I was hoping to find another AMI event that would be the magic bullet I need, but it doesn't sound like that's going to happen.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>I understand that fail2ban is probably not what I want and probably wouldn't detect the attacks I'm seeing.<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>It turns out that not all of the attacks are from the "friendly scanner," but enough of them are that it's a good start.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>So, I really like the idea of the IP geo location firewall rules coupled with the "friendly scanner" filter, as provided by a few of you guys. It was mentioned that this is a broad hammer, but I'm kinda looking for a broad hammer! ;^)<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>Looks like I need to do some research, but I think I have what I need.<o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'>Thanks again,<o:p></o:p></p></div><p class=MsoNormal>Mike Diehl.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Sat, Aug 19, 2017 at 4:36 PM, Telium Technical Support <<a href="mailto:support@telium.ca" target="_blank">support@telium.ca</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>I think you missed the point of the Digium post. Fail2ban can ONLY ban IP’s if Asterisk records a failure to register. Asterisk does not detect malformed SIP packets, buffer overflow attacks, suspicious dialing patterns, connection attempts outside geofenced areas, use of stolen credentials (rapid ramp of calls using one set of credentials), etc.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Asterisk only gives you a rudimentary “failed” message for a failure to register / wrong credentials. And of course fail2ban only responds to Asterisk log messages, so it does little more than ban the annoying script kiddies.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Have a good look at that Voip-Info page and read what actual SIP security systems do. Then compare that to fail2ban and it’s night & day difference. People still think fail2ban is a security system, and Digium is very clear that it is NOT.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> <a href="mailto:asterisk-users-bounces@lists.digium.com" target="_blank">asterisk-users-bounces@lists.digium.com</a> [mailto:<a href="mailto:asterisk-users-bounces@lists.digium.com" target="_blank">asterisk-users-bounces@lists.digium.com</a>] <b>On Behalf Of </b>Kseniya Blashchuk<br><b>Sent:</b> Thursday, August 17, 2017 12:41 AM<br><b>To:</b> Asterisk Users Mailing List - Non-Commercial Discussion <<a href="mailto:asterisk-users@lists.digium.com" target="_blank">asterisk-users@lists.digium.com</a>><br><b>Subject:</b> Re: [asterisk-users] Detecting DoS attacks via SIP</span><o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p>Well, correct me if I'm wrong, but I would say this conversation you have posted is a bit outdated, now fail2ban can be used with asterisk security log <a href="https://wiki.asterisk.org/wiki/display/AST/Asterisk+Security+Event+Logger" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Asterisk+Security+Event+Logger</a>.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Thu, Aug 17, 2017, 4:53 AM Telium Technical Support <<a href="mailto:support@telium.ca" target="_blank">support@telium.ca</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Keep in mind that the attacks you are seeing in the log are ONLY the ones<br>that Asterisk is detecting and rejecting. All other attacks aren't even<br>showing up!<br><br>There's a good discussion of how to secure your PBX here:<br><a href="https://www.voip-info.org/wiki/view/asterisk+security" target="_blank">https://www.voip-info.org/wiki/view/asterisk+security</a><br><br>In general, don't let the malevolent traffic get as far as the PBX (block at<br>the firewall). Also, Digium regularly warns users that fail2ban is NOT a<br>security system: <a href="http://forums.asterisk.org/viewtopic.php?p=159984" target="_blank">http://forums.asterisk.org/viewtopic.php?p=159984</a><br><br>-----Original Message-----<br>From: <a href="mailto:asterisk-users-bounces@lists.digium.com" target="_blank">asterisk-users-bounces@lists.digium.com</a><br>[mailto:<a href="mailto:asterisk-users-bounces@lists.digium.com" target="_blank">asterisk-users-bounces@lists.digium.com</a>] On Behalf Of mdiehl<br>Sent: Tuesday, August 15, 2017 3:38 PM<br>To: <a href="mailto:asterisk-users@lists.digium.com" target="_blank">asterisk-users@lists.digium.com</a><br>Subject: [asterisk-users] Detecting DoS attacks via SIP<br><br>Hi all,<br><br>Lately, I've seen an increase in the number of attacks against my system<br>from the so-called "Friendly Scanner." When one of these script kiddies<br>targets my server, all I see for symptoms is a few of my trunks become<br>lagged due to server load and a stream of messages on the console that<br>resemble this:<br><br>[Aug 2 20:27:50] == Using SIP VIDEO CoS mark 6<br>[Aug 2 20:27:50] == Using SIP RTP TOS bits 24<br>[Aug 2 20:27:50] == Using SIP RTP CoS mark 5<br>[Aug 2 20:32:47] == Using SIP VIDEO TOS bits 24<br>[Aug 2 20:32:47] == Using SIP VIDEO CoS mark 6<br>[Aug 2 20:32:47] == Using SIP RTP TOS bits 24<br>[Aug 2 20:32:47] == Using SIP RTP CoS mark 5<br>[Aug 2 20:34:26] == Using SIP VIDEO TOS bits 24<br>[Aug 2 20:34:26] == Using SIP VIDEO CoS mark 6<br><br><br>I have to turn on sip debugging to find out who's hitting me. However, I<br>can't just leave it on because it would kill my logging system.<br><br>So, how are other people handling this? Is there an AMI event I want watch<br>for? I watch for PeerStatus, but since there's no actual peer in the<br>attack, I don't seem to get an event from AMI.<br><br>Any ideas?<br><br>Mike Diehl.<br><br>--<br>_____________________________________________________________________<br>-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br><br>Check out the new Asterisk community forum at:<br><a href="https://community.asterisk.org/" target="_blank">https://community.asterisk.org/</a><br><br>New to Asterisk? Start here:<br> <a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Getting+Started</a><br><br>asterisk-users mailing list<br>To UNSUBSCRIBE or update options visit:<br> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br><br><br>--<br>_____________________________________________________________________<br>-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br><br>Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" target="_blank">https://community.asterisk.org/</a><br><br>New to Asterisk? Start here:<br> <a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Getting+Started</a><br><br>asterisk-users mailing list<br>To UNSUBSCRIBE or update options visit:<br> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><o:p></o:p></p></blockquote></div></div></div></div></div><p class=MsoNormal><br>--<br>_____________________________________________________________________<br>-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br><br>Check out the new Asterisk community forum at: <a href="https://community.asterisk.org/" target="_blank">https://community.asterisk.org/</a><br><br>New to Asterisk? Start here:<br> <a href="https://wiki.asterisk.org/wiki/display/AST/Getting+Started" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Getting+Started</a><br><br>asterisk-users mailing list<br>To UNSUBSCRIBE or update options visit:<br> <a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>