電訊茶室 - Powered by Discuz! Board

標題: Asterisk Server Security [打印本頁]

作者: lamsoft 時間: 2014-2-10 20:34 標題: Asterisk Server Security

希望大家有時候會留意下d log
小弟server就會有cron job 去定時睇返個log, 撞password過5次就會iptables rule INPUT add DROP..

[Feb 10 13:37:29] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"111" <sip:111@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:507                                                                               1' - Wrong password
[Feb 10 13:39:18] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"999" <sip:999@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:507                                                                               0' - Wrong password
[Feb 10 13:41:39] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"302" <sip:302@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               7' - Wrong password
[Feb 10 13:42:26] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"444" <sip:444@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               0' - Wrong password
[Feb 10 13:43:32] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"700" <sip:700@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               8' - Wrong password
[Feb 10 13:44:11] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"44" <sip:44@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5068'                                                                               - Wrong password
[Feb 10 13:44:12] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"555" <sip:555@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               9' - Wrong password
[Feb 10 13:44:26] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"105" <sip:105@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               9' - Wrong password
[Feb 10 13:45:18] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"6006" <sip:6006@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               073' - Wrong password
[Feb 10 13:45:19] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"100" <sip:100@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:507                                                                               6' - Wrong password
[Feb 10 13:45:23] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"2001" <sip:2001@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               071' - Wrong password
[Feb 10 13:45:43] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"5003" <sip:5003@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               077' - Wrong password
[Feb 10 13:45:44] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"333" <sip:333@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               8' - Wrong password
[Feb 10 13:45:54] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"3333" <sip:3333@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               076' - Wrong password
[Feb 10 13:45:58] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"10002" <sip:10002@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86                                                                               :5060' - Wrong password
[Feb 10 13:46:24] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"888" <sip:888@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               9' - Wrong password
[Feb 10 13:47:03] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"0" <sip:0@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5060' -                                                                               Wrong password
[Feb 10 13:47:19] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"22" <sip:22@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5063'                                                                               - Wrong password
[Feb 10 13:47:38] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"1" <sip:1@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5064' -                                                                               Wrong password
[Feb 10 13:48:08] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"1111" <sip:1111@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               071' - Wrong password
[Feb 10 13:48:27] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"202" <sip:202@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:506                                                                               0' - Wrong password
[Feb 10 13:48:50] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"2232" <sip:2232@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               068' - Wrong password
[Feb 10 13:49:14] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"11111111" <sip:11111111@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.                                                                               155.86:5068' - Wrong password
[Feb 10 13:49:35] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"73" <sip:73@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5069'                                                                               - Wrong password
[Feb 10 13:50:33] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"7002" <sip:7002@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               073' - Wrong password
[Feb 10 13:51:33] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"4005" <sip:4005@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               060' - Wrong password
[Feb 10 13:53:13] NOTICE[3334]: chan_sip.c:28003 handle_request_register: Registration from '"9090" <sip:9090@MY_ASTERISK_SERVER_IP:5060>' failed for '212.83.155.86:5                                                                               076' - Wrong password

不過佢條友可能知道我封鬼左佢ip... 轉左另一個ip繼續撞~~

作者: Qnewbie 時間: 2014-2-11 00:14

本帖最後由 Qnewbie 於 2014-2-11 04:37 編輯

With white-list in my mikrotik router, I can now skip those problems

作者: alang 時間: 2014-2-13 14:54

https://plus.google.com/110161139630281378550/posts/WfES2bS8jEz

作者: 浮雲1965 時間: 2014-2-13 18:25

請問alang, 我的freepbx是2.8.1.5，需不需要更新呢？我之前試過更新去2.9好像出過問題，就不敢更新freenas去到2.9了。

謝謝！

作者: alang 時間: 2014-2-17 13:41

任何的系統更新都存在有風險，尤其是曾經對系統作過客制化，所以事前的系統完整備份是必要的。

以我客戶的例子，當看到這則訊息後，當下也考慮作更新，只是因為他無法作備份，所以最後我的建議是不作更新，改封鎖 Web 管理介面的外部存取權限，因為這個漏洞是來自於 Web 存取。

作者: 浮雲1965 時間: 2014-2-17 14:15

alang,
您好！我的系統的web管理是加了iptable的，只有某固定ip可以登入。另外，client的登入加了fail2ban, 這樣夠安全了嗎？
謝謝！

作者: alang 時間: 2014-2-19 11:02

這個漏洞只要作到限制 IP 登入 Web 介面，就可以免疫了。

官方論壇有這個相關討論，不妨看看
http://forum.elastix.org/viewtopic.php?f=116&t=128200

歡迎光臨電訊茶室 (http://telecom-cafe.com/forum/)