服务器 Gind.cn
  1. 服务器 Gind.cn
  3. 章节：未能禁止IP“
Intereting Posts
重写导致现有目录上的无限301redirect循环 使用Netfilter隔离Internet和LAN之间的networkingstream量 为什么不build议在DNS中使用多个PTRlogging？ 什么是苹果屏幕共享端口监听？ 使用Apache和LDAP单点login IPsec隧道不断崩溃 如何打开防火墙来访问Azure文件存储 从我的服务器收到垃圾邮件的垃圾邮件，但后缀日志不显示他们 / dev / dsk和/ dev / rdsk有什么区别？ 如何删除iproute2的IPv6地址？ Microsoft组策略不推送Citrixconfiguration文件策略设置 通过ssh jenkins发布 我可以更改closures的Hyper-V虚拟机的计算机名称而不打开它吗？ configurationDNS服务器的域名不带前缀 我可以使用什么来自动安装新PC所需的软件？

章节：未能禁止IP“

代D：

这是在观察到这个问题时的设置：Ubuntu 12.04.4服务器LTS上的secast-1.0.1.0-x86_64-ub12，带有Asterisk 11.10.2。

在离开seacast（build secast-1.0.1.0-x86_64-ub12）运行后，/ var / log / secast中捕获并观察到以下事件： 

Sun Jun 22 14:22:45 2014, 00001403, D, Asterisk, IP '' added to watch list Sun Jun 22 14:22:45 2014, 00000510, I, Asterisk, Detected potential intrustion attempt by username '%40102' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages' Sun Jun 22 14:23:05 2014, 00001402, D, Asterisk, IP '' on IP watch list with 2 potential intrusion attempts Sun Jun 22 14:23:05 2014, 00000510, I, Asterisk, Detected potential intrustion attempt by username '%40102' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages' Sun Jun 22 14:23:07 2014, 00001402, D, Asterisk, IP '' on IP watch list with 3 potential intrusion attempts Sun Jun 22 14:23:07 2014, 00000510, I, Asterisk, Detected potential intrustion attempt by username '%40' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages' Sun Jun 22 14:23:27 2014, 00001402, D, Asterisk, IP '' on IP watch list with 4 potential intrusion attempts Sun Jun 22 14:23:27 2014, 00000510, S, Asterisk, Detected excessive intrustion attempts by username '%40' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages'. Requesting ban. Sun Jun 22 14:23:27 2014, 00000902, D, ThreatInfo, Adding IP address to banned IP list Sun Jun 22 14:23:27 2014, 00000608, S, EventQueue, Banning detected IP as managed Sun Jun 22 14:23:27 2014, 00000710, E, SystemCommand, Failed to add rule to iptables chain. Run result 0; exitcode 2 : : Sun Jun 22 14:24:08 2014, 00001402, D, Asterisk, IP '' on IP watch list with 5 potential intrusion attempts Sun Jun 22 14:24:08 2014, 00000510, S, Asterisk, Detected excessive intrustion attempts by username '%40' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages'. Requesting ban. Sun Jun 22 14:24:08 2014, 00000900, D, ThreatInfo, Ignoring attempt to add duplicate IP to banned IP list Sun Jun 22 14:25:28 2014, 00001402, D, Asterisk, IP '' on IP watch list with 6 potential intrusion attempts Sun Jun 22 14:25:28 2014, 00000510, S, Asterisk, Detected excessive intrustion attempts by username '%40' at IP '' using protocol 'SIP' through security log '/var/log/asterisk/messages'. Requesting ban. Sun Jun 22 14:25:28 2014, 00000900, D, ThreatInfo, Ignoring attempt to add duplicate IP to banned IP list Sun Jun 22 14:35:36 2014, 00001405, D, Asterisk, IP '' removed from IP watch list due to expiration

请注意，对IP地址的引用，其中没有显示实际的IP地址。 看来这个空的IP引用在尝试将规则添加到iptables链时导致失败。 此外，尝试将其添加到数据库似乎失败（上面省略的行）。

也许这表明应该检测到IP“的情况，以避免无效尝试调用iptables和数据库。

以下是从/ var / log / asterisk / messages（我们的IP地址replace为IP_REMOVED）中对应于以上事件的行： 

 [Jun 22 14:22:45] NOTICE[7420] chan_sip.c: Registration from '<sip:%40102@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password [Jun 22 14:22:48] NOTICE[7420][C-0000005a] chan_sip.c: Failed to authenticate device <sip:%40102@IP_REMOVED>;tag=17280b03 [Jun 22 14:22:55] NOTICE[7420][C-0000005b] chan_sip.c: Failed to authenticate device <sip:%40102@IP_REMOVED>;tag=394a4856 [Jun 22 14:23:01] NOTICE[7420][C-0000005c] chan_sip.c: Failed to authenticate device <sip:%40102@IP_REMOVED>;tag=022a0438 [Jun 22 14:23:05] NOTICE[7420] chan_sip.c: Registration from '<sip:%40102@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password [Jun 22 14:23:07] NOTICE[7420] chan_sip.c: Registration from '<sip:%40@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password [Jun 22 14:23:09] NOTICE[7420][C-0000005d] chan_sip.c: Failed to authenticate device <sip:%40@IP_REMOVED>;tag=93209c36 [Jun 22 14:23:12] NOTICE[7420][C-0000005e] chan_sip.c: Failed to authenticate device <sip:%40@IP_REMOVED>;tag=cf5b9246 [Jun 22 14:23:13] NOTICE[7420][C-0000005f] chan_sip.c: Failed to authenticate device <sip:%40@IP_REMOVED>;tag=ae0ff835 [Jun 22 14:23:27] NOTICE[7420] chan_sip.c: Registration from '<sip:%40@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password [Jun 22 14:24:08] NOTICE[7420] chan_sip.c: Registration from '<sip:%40@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password [Jun 22 14:24:21] NOTICE[7420][C-00000060] chan_sip.c: Failed to authenticate device 201<sip:201@IP_REMOVED>;tag=ba38c3c8 [Jun 22 14:25:28] NOTICE[7420] chan_sip.c: Registration from '<sip:%40@IP_REMOVED>' failed for '176.58.69.112:14398' - Wrong password

根据我读到的内容，我预计IP 176.58.69.112已被禁止。

为什么会发生知识产权案件，以及采取哪些措施来纠正这一问题？

****更新****

今天在/ var / log / secast中观察到以下消息： 

 2014-06-27T09:43:23, 00001403, D, Asterisk, IP '5.11.41.130' added to watch list 2014-06-27T09:43:23, 00000510, I, Asterisk, Detected potential intrustion attempt by username '1000' at IP '5.11.41.130' using protocol 'SIP' through security log '/var/log/asterisk/messages' 2014-06-27T09:43:43, 00001402, D, Asterisk, IP '5.11.41.130' on IP watch list with 2 potential intrusion attempts 2014-06-27T09:43:43, 00000510, I, Asterisk, Detected potential intrustion attempt by username '1000' at IP '5.11.41.130' using protocol 'SIP' through security log '/var/log/asterisk/messages' 2014-06-27T09:53:52, 00001405, D, Asterisk, IP '5.11.41.130' removed from IP watch list due to expiration

这些来自/ var / log / asterisk / messages中的以下行： 

 [Jun 27 09:43:23] NOTICE[1309] chan_sip.c: Registration from '<sip:[email protected]>' failed for '5.11.41.130:12736' - Wrong password [Jun 27 09:43:43] NOTICE[1309] chan_sip.c: Registration from '<sip:[email protected]>' failed for '5.11.41.130:12736' - Wrong password

虽然没有足够的尝试来引起禁令，但似乎IP地址5.11.41.130是按预期收集的。 如果有更多的尝试，我猜这次禁令的尝试本来是成功的。

请注意，这次用户名只是'1000'; 而在用户名是'％40102'和'％40'之前

是否有可能是％字符跳过Asterisk消息行的secastparsing，导致提取的IP地址失败？

我将继续监视日志中的实际禁止事件并报告回来。

攻击者在176.58.69.112隔离他的连接企图避免检测。 请确保将maxintrusioninterval设置为足够高以查看多次尝试，并将maxintrusions设置得足够低以触发该间隔中的检测。 你可以从secast.conf的[credentials]节发布你的设置吗？ （或通过电子邮件将整个configuration文件发送至[email protected]）

我们看到更多的VoIP黑客将他们的攻击排除在外以避免被发现 – 有些甚至在两次尝试之间等待一天甚至更多。 （为了解决这个问题，我们已经把检测间隔设置的最大值从1小时增加到了1周）。

“IP相关的消息是一个警告，SecAst在星号消息文件中发现了一些它无法解释的东西。 （我们会在某一天放置一个更智能的消息）我们收到了您的日志文件，并通过parsing器运行它，并为该问题行添加适当的检测。 （Digium会定期对日志格式进行细微的更改，而且我们总是根据testing脚本来testing最新的Asterisk版本来捕捉这些内容）。

**更新：截至SecAst版本1.0.6，这些消息现在被添加到签名数据库。

你会发现，黑客/扫描器也正在减less他们的暴力试图，甚至每天只有一次尝试（再次避免检测）。 如果您想要加强安全性，您可以将最大入侵降低到1，并将间隔扩大到2天或更长。 （这就是为什么在您的日志中显示的攻击可能停止在2次尝试）。

根据我们通过支持合同监控的系统，我们看到来自巴勒斯坦和非洲的黑客正在做这个事情。 他们正试图留在雷达或入侵检测系统之下。

另一种方法（也是更积极主动的方法）是使用内置在SecAst中的Geo IP防护，并阻止这些攻击来自的整个国家/大陆。 看看这个serverfault问题了解更多信息。