help against hacking please!!

[ahmed_gaffar]

Hello Folks,

i have in my system for 2 weeks now this message in my Asterisk log:

Aug 17 10:34:21 NOTICE[2921] chan_sip.c:Registration from '<sip:5017@MyServerIP>' failed for '217.253.201.114:5063' - No matching peer found

and i dont have this this extinsion at all, and i dont even know this add 217.253.201.114:5063 how can i stop this notice? because it is written in my system every 2 seconds, is some kind of hacking?

thanks

 

[DaveD]

Refer here http://elastix.org/index.php/en/compone ... urity.html

Use the search function this has been covered alot

 

[NellyB]

Hi Ahmed, this is a brute force attack on your phone system. Someone is trying to get access by guessing your extensions and password.

If you install something like fail2ban it will help stop this.

Neil

 

[ahmed_gaffar]

hi NellyB, and thanks for your fast answer

i already did now ... i installed fail2ban after the answer of DaveD and every thing is ok with the installation i can also get MSG from fail2ban at my email but can i change the jail file manually?? because this addr: still want to connect to my server :

[2011-08-17 13:15:12] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found
[2011-08-17 13:15:13] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found
[2011-08-17 13:16:15] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found
[2011-08-17 13:16:19] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found
[2011-08-17 13:16:19] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found
[2011-08-17 13:16:23] NOTICE[2921] chan_sip.c: Registration from '<sip:5017@MYIP>' failed for '217.253.201.114:5063' - No matching peer found

and i dont know after i install the fail2ban the Reports for Asterisk Log in the site are moved about 4cm to the right ?? is this normal? which php file is that ... so i can see where to prepair the code?

 

[NellyB]

A lot of the documentation around for fail2ban has a misconfigured asterisk.conf. It should look like this or the failed logon won't be triggered. I can't paste it here as some of the commands are processed by the web server so I have attached a copy of my asterisk.conf http://forum.elastix.org/old_files/asterisk.txt

 

[danardf]

Hi.

From my side, i've F2B installed and i accept only every IP address needed, the others are dropped.
Next, use permit/deny in your trunk parameters and every extensions.

That's all.