sec_ignore_user_agent_custom

[vk4kij]

Hi,

I have added quite a few user agents to this parameter but there are a couple it will not ignore.
Both have a slash / in them, so I guess that is the problem.
I've tried using "", '', \ to to escape the character.
The two I'm trying to put in are:

N/A
PolycomSoundPointIP-SPIP_450-UA/3.3.4.0085

Thanks.

Ian.

 

[JohnS_3CX]

Hi Ian,

It can be a partial match, so you could just type PolycomSoundPointIP and it will still work.

Not as explicit, but it may still serve your purposes.

 

[vk4kij]

Hi JohnS,

That seems to have done the trick.
Of course when I put the changes in they stopped hitting my systems, as I only made the change on one, but they started again last night, even if it's very low traffic ATM.
One more question: When I enter the details into the parameter it seems I have to do a service restart, or am I just too impatient?

Ian.

 

[JohnS_3CX]

I did a very quick a test without restarting services and it worked immediately, there could be some cases beyond what I'm aware though where a service restart is needed.

 

[vk4kij]

Hi John,

Thanks for the reply, obviously I was impatient.

Putting Polycom in as a partial match certainly fixed the PolycomSoundPointIP-SPIP_450-UA/3.3.4.0085 user agent attacks.

But putting <N in as a partial match doesn't fix the <N/A> user agent (I had forgotten the < and > in the example above), I presume there would be a minimum character length.
So this one still eludes me.

Ian.

 

[JohnS_3CX]

Hi Ian,

The fake user agents can always change and they will hit you with various names over the years, but locking down your SIP port is way more effective at stopping random IPs that try drive-by attacks every now and then.

You might have better luck locking down your SIP port via firewall to only talk to the provider if you have the ability to do so.