Being attacked eve with firewall?

[agidi1]

Hello guys

We setup a new PBX, we do fail2ban and only SIP and RTP ports open to the internet as it has external etc.

We are seing this on the reports.

2012-12-30 11:01:09 5550000 sSIP/5060-099e8590 ANSWERED 0s
2012-12-30 07:52:38 smallgw sSIP/5060-099e8590 ANSWERED 1s

over and over sometimes its 5550000, smallgq, then 101, then 1001, etc.

We show "stuck" channels with sip show peers, but no activity on dahdi, (this pbx does not have SIP trunks)

Is it an attack?

Is elastix ever going to be secure? Its a yum updated 1.6-XX version

all pointers and ideas are welcomed.

 

[danardf]

Hi.

Yes, seems an attack. :huh:

Have you some SIP extensions remote?
For all local extensions, prefer to setting "deny/permit" informations for each one.

If you have some remote extensions, try to setting any rules within iptables (if possible in the case where a static public IP is used). Otherewise, you could making rules with a network like this : x.x.x.0/255.255.255.0

You could try to drop every untrusted ip address and set all others which should be trusted.

Or else, you could install CSF firewall.

Or, you could configure a VPN secure access (OpenVPN for example).

Try to change all SIP passwords after modifications or security installations.

There's several threads about security into this forum.

Regards

 

[agidi1]

I appreciate your reply. Happy new year.

This box does have three remote exts, all other exts have permit/deny settings and all have long alfanumerics passes
It also has fail2ban running and does report some attacks.

The router only exposes 5060 and rtp on udp. To the PBX

This is what I got on the asterisk logs for today. Seems just at attempt that last for some seconds and then leaves.
They are NOT using an existing extension, monitoring does not record anything, and I can't tell their calls actually went out thru dadhi.

All ideas and comments are appreciated.
How would CSF firewall help on this? We have not tested this firewall.

[2013-01-01 09:38:51] VERBOSE[19557] logger.c:     -- Executing [s@from-sip-external:2] Set("SIP/5060-0995ba78", "TIMEOUT(absolute)=15") in new stack
 	 	 	
[2013-01-01 09:38:51] VERBOSE[19557] logger.c:     -- Channel will hangup at 2013-01-01 14:39:06 UTC.
 	 	 	
[2013-01-01 09:38:51] VERBOSE[19557] logger.c:     -- Executing [s@from-sip-external:3] Answer("SIP/5060-0995ba78", "") in new stack
 	 	 	
[2013-01-01 09:38:51] VERBOSE[19557] logger.c:   == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/5060-0995ba78'
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [9011441904891387@from-sip-external:1] NoOp("SIP/5060-0995ba78", "Received incoming SIP connection from unknown peer to 9011441904891387") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [9011441904891387@from-sip-external:2] Set("SIP/5060-0995ba78", "DID=9011441904891387") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [9011441904891387@from-sip-external:3] Goto("SIP/5060-0995ba78", "s|1") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Goto (from-sip-external,s,1)
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:1] GotoIf("SIP/5060-0995ba78", "0?from-trunk|9011441904891387|1") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:2] Set("SIP/5060-0995ba78", "TIMEOUT(absolute)=15") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Channel will hangup at 2013-01-01 14:39:45 UTC.
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:3] Answer("SIP/5060-0995ba78", "") in new stack
 	 	 	
[2013-01-01 09:39:30] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:4] Wait("SIP/5060-0995ba78", "2") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:   == Spawn extension (from-sip-external, s, 4) exited non-zero on 'SIP/5060-0995ba78'
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [h@from-sip-external:1] NoOp("SIP/5060-0995ba78", "Hangup") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [h@from-sip-external:2] Set("SIP/5060-0995ba78", "DID=s") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [h@from-sip-external:3] Goto("SIP/5060-0995ba78", "s|1") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Goto (from-sip-external,s,1)
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:1] GotoIf("SIP/5060-0995ba78", "0?from-trunk|s|1") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:2] Set("SIP/5060-0995ba78", "TIMEOUT(absolute)=15") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Channel will hangup at 2013-01-01 14:39:46 UTC.
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:     -- Executing [s@from-sip-external:3] Answer("SIP/5060-0995ba78", "") in new stack
 	 	 	
[2013-01-01 09:39:31] VERBOSE[19558] logger.c:   == Spawn extension (from-sip-external, s, 3) exited non-zero on 'SIP/5060-0995ba78'
 	 	 	
[2013-01-01 09:39:46] WARNING[2714] chan_sip.c: Host '204.236.220.22' does not implement 'NOTIFY'
 	 	 	
[2013-01-01 09:39:59] VERBOSE[19559] logger.c:     -- Executing [900441904891387@from-sip-external:1] NoOp("SIP/5060-09987240", "Received incoming SIP connection from unknown peer to 900441904891387") in new stack
 	 	 	
[2013-01-01 09:39:59] VERBOSE[19559] logger.c:     -- Executing [900441904891387@from-sip-external:2] Set("SIP/5060-09987240", "DID=900441904891387") in new stack
 	 	 	
[2013-01-01 09:39:59] VERBOSE[19559] logger.c:     -- Executing [900441904891387@from-sip-external:3] Goto("SIP/5060-09987240", "s|1") in new stack
 	 	 	
[2013-01-01 09:39:59] VERBOSE[19559] logger.c:     -- Goto (from-sip-external,s,1)

 

[danardf]

No dahdi trace, ok good!

Like i said, "There's several threads about security into this forum. ". Just read them. And sure, also you have some documents dowloadable from Elastix website.
There's any links about CSF to explain how to use it and install it.

Regards

 

[agidi1]

I've read them all im a big fan of them

This new method is "impersonating" a trusted ... i cant call it extension, because it does not fully authenticate. But it shows as the sip port. This box only had 5060 and rtp open. So it is going only thru SIP. Fail2Ban did not catch a thing. We'll try CSF this week.
thanks