Authentication fail request keeps happening

[John14]

Hi,

I keep getting these messages on the activity log of one of our clients. Not sure if it could be a hacker trying to authenticate to our PBX. There isn't any extension 300 aswell.

09/18/2019 10:01:10 AM - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 68.183.42.106:6819 tid=ef4e4a85-5414-4be0-8687-dc8fbe73434d Call-ID=exxxccjtgeuvvhpvdhrxtetatqmourbmlqhucmsjjqwuugvmui: REGISTER sip:52.187.213.160 SIP/2.0 Via: SIP/2.0/UDP 68.183.42.106:6819;branch=z9hG4bKef4e4a85-5414-4be0-8687-dc8fbe73434d;rport=6819 Max-Forwards: 70 Contact: <sip:[email protected]:6819;rinstance=015b79d5355b554b> To: "300"<sip:[email protected]> From: "300"<sip:[email protected]>;tag=bkbidaex Call-ID: exxxccjtgeuvvhpvdhrxtetatqmourbmlqhucmsjjqwuugvmui CSeq: 2 REGISTER Expires: 3600 Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE Proxy-Authorization: Digest username="300",realm="3CXPhoneSystem",nonce="414d53595d8173c689:5e1f0b23be8f3097e2bb0aa1a83ae854",response="4a5715ba08f31a03e0e2531098a7a5cd",uri="sip:52.187.213.160",algorithm=MD5 Supported: 100rel User-Agent: IPOffice Content-Length: 0 ; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

09/18/2019 9:18:30 AM - [CM102001]: Authentication failed for AuthFail Recv Req INVITE from 67.205.156.200:60722 tid=1021079706 Call-ID=1969366521-2117021313-221709564: INVITE sip:[email protected] SIP/2.0 Via: SIP/2.0/UDP 67.205.156.200:60722;branch=z9hG4bK1021079706 Max-Forwards: 70 Contact: <sip:[email protected]:60722> To: <sip:[email protected]> From: <sip:[email protected]>;tag=860237185 Call-ID: 1969366521-2117021313-221709564 CSeq: 2 INVITE Allow: ACK, BYE, CANCEL, INFO, INVITE, MESSAGE, NOTIFY, OPTIONS, PRACK, REFER, REGISTER, SUBSCRIBE, UPDATE, PUBLISH Content-Type: application/sdp Proxy-Authorization: Digest username="1876382",uri="sip:[email protected]",algorithm=MD5,realm="3CXPhoneSystem",nonce="414d53595d8169c650:79c009e2241c6f8c0c212aaede01a951",response="29d4004967b0b4ef519ac060fd3f8071" User-Agent: Linksys-SPA942 Content-Length: 211 v=0 o=1876382 16264 18299 IN IP4 192.168.1.83 s=call c=IN IP4 192.168.1.83 t=0 0 m=audio 25282 RTP/AVP 0 101 a=rtpmap:0 pcmu/8000 a=rtpmap:8 pcma/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-11 ; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

thanks

 

[AWS2P]

In security settings, do you use automatic global 3cx ip blacklist?

In failed authentication protection, reduce value to 3.

 

[John14]

In security settings, do you use automatic global 3cx ip blacklist?

In failed authentication protection, reduce value to 3.

It was set to 25 and have reduce it to 3. I think by default its 25. is it best practice to change that to 3?

 

[AWS2P]

You are free to set like you want ,IMO I think all security settings can support reduced values from 3CX default.
When set to 25, you let 25 chances for users to login but also for hack attempts tries, so for now, set to 3, you reduce to minimum try , of course PBX users have to to enter good password in max 3 tries before being blacklisted.