Logs Filling Instance

[microedjared]

Hey everyone,

I'm hoping someone can point us in the right direction. We have a 3cx instance that is constantly filling up with logs in the /var/lib/3cxpbc/Instance1/Data/Logs/ it can easily fill up 5GB of space in 2 days.

Current Configuration:
Google Hosted VM
Most Phones connecting via SBC onsite
3cx Version 16.0.2.910

This seems to be the contents of the log:

08/07/2019 1:05:13 PM - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 163.172.199.40:9000 tid=3d22cb8d-ca0f-4ad7-b705-bc67273d5155 Call-ID=xahgpqoweplnikfdoststllebyugeychusvknqhgaufqelblmm:
REGISTER sip:35.201.2.25 SIP/2.0
Via: SIP/2.0/UDP 163.172.199.40:9000;branch=z9hG4bK3d22cb8d-ca0f-4ad7-b705-bc67273d5155;rport=9000
Max-Forwards: 70
Contact: <sip:[email protected]:9000;rinstance=b2fff02fea5db241>
To: "83"<sip:[email protected]>
From: "83"<sip:[email protected]>;tag=jaxclloc
Call-ID: xahgpqoweplnikfdoststllebyugeychusvknqhgaufqelblmm
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Proxy-Authorization: Digest username="83",realm="3CXPhoneSystem",nonce="414d53595d4a3fe812:bf50f8337b6454e5434d9bcf7687cb20",response="a5e77308f394e11a3b8e32b48cf6eeff",uri="sip:35.201.2.25",algorithm=MD5
Supported: 100rel
User-Agent: 3CXPhoneSystem 12.5.44178.1002  38810
Content-Length: 0

; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings
08/07/2019 1:05:12 PM - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 163.172.199.40:8949 tid=2fe8534d-5450-4385-ad8b-49a04200c041 Call-ID=ahtjqwcjnlcnklkjuchvoitbjhegxunuhfooplieothkvgyqif:
REGISTER sip:35.201.2.25 SIP/2.0
Via: SIP/2.0/UDP 163.172.199.40:8949;branch=z9hG4bK2fe8534d-5450-4385-ad8b-49a04200c041;rport=8949
Max-Forwards: 70
Contact: <sip:[email protected]:8949;rinstance=e30439bb3b06144f>
To: "82"<sip:[email protected]>
From: "82"<sip:[email protected]>;tag=ohjyqqns
Call-ID: ahtjqwcjnlcnklkjuchvoitbjhegxunuhfooplieothkvgyqif
CSeq: 2 REGISTER
Expires: 3600
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Proxy-Authorization: Digest username="82",realm="3CXPhoneSystem",nonce="414d53595d4a3fe884:9154676d35ad412944d22ab5a573f19c",response="7b315ac67bb2790083d714e299e9eb7f",uri="sip:35.201.2.25",algorithm=MD5
Supported: 100rel
User-Agent: 3CXPhoneSystem 15.5.3554.1  3554
Content-Length: 0

; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

 

[cobaltit]

So that seems pretty obvious. You have what looks to be varies endpoints trying to authenticate unsuccesfully to your system. One claims to be 3CX PhoneSystem 12.5 and another v15.5 . They both appear to come from the same IP address. I'd track down those devices and reset them or properly configure them if they are yours. If not, block at the edge. Also, make sure you don't have verbose logging on.

 

[microedjared]

It seems to malicious but the IP address keeps changing. It seems as though the setting for Failed Challenge Requests (407) being set to 1000 was way too high and we've lowered that and hopefully will see some good results.

 

[cobaltit]

If you haven't turned on the global blacklist you should do so.That will weed out a lot of the attacks as well.

 

[JohnS_3CX]

If these are all failed registrations then it is likely that you are being scanned by attackers (this is common for all PBXs unfortunately).

The PBX will eventually block any IP addresses that fail to authenticate, but the Global Blacklist should help block well known malicious IPs at least.