Someone is HACKING but CANT STOP IT

[jochy25251]

Hi there,

One IP is hacking my server, which is sending unknown information to the IP (port 4569)

What we do today:

- Block it in iptables
- Block it in iptables in datacenter
- Scan for viruses (ClamAV reported 45 infected items)

IT'S IMPOSSIBLE TO STOP THE TRAFFIC!!! The NOC can't do anything, we blocked the IP in the Mitroki , the DNS servers but we can't!!

Please help!

 

[danardf]

Hi.

I'm sad for you.
one more again.

I guess that there was no Fail2ban installed before? :huh:

The better way (for me).

- Stop Asterisk
- Keep every log file, and save them on an USB key. (It could be useful if you going to the police)
- Make a fresh install.
- Make an update to having exactly the same version (Elastix, Freepbx...Etc)
- Install Fail2ban of course, and RKHunter if you want.
- Make a restore from your last backup.
- Change every password that you want.
- Change the SSH port basically on 22, and deny root login.
- Create another Linux account to connect on SSH.
- Forward only ports what you need.
- Configure your firewall following your setup Elastix. (Accept only trusted IP and/or MAC address, and DROP all ).
- Use "deny/permit" information on every extensions, even trunks.
- Of course, disable anonymous SIP connexions too.
- Doing same thing about IAX2.
- Making backups often.

Good luck.

 

[Disaster]

If you have a Mikrotik router you can set up access list on your firwall nat to only allow the IP address of your VSP and any remote sites. That should help in future.

 

[DaveD]

- Scan for viruses (ClamAV reported 45 infected items)

With that many infections I would be doing a clean install, and install tighter security

 

[dwhoff]

Are you sure that you didin't scan the clamav directory? There are test files in that directory that would give a false positive.