Alexandre, descreva a sua arquitetura... Tem Firewall? O Asterisk necessita de saída para a rede? Que nem o nosso amigo Felipe disse, se não tiver, sete allowguest=no no sip.conf, provavelmente você não necessita dele...<br>
<br><br><br>Ats,<br>Rodrigo Lang.<br><br><div class="gmail_quote">2009/11/24 Julio Arruda <span dir="ltr"><<a href="mailto:jarruda-asterisk@jarruda.com">jarruda-asterisk@jarruda.com</a>></span><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="im">Rafael Alves Machado wrote:<br>
> Não existe um patch de atualização para Este problema? Pois passei pelo<br>
> mesmo problema e o prejuízo foi alto.<br>
><br>
<br>
</div>Humm...nao sei se voce entendeu, mas isto nao e' um bug. O ponto e', se<br>
voce permite um SIP UA qualquer falar com o seu * sem estar registrado,<br>
e mandar chamadas, e' configuracao....<br>
Existe uma quantidade grande de brute-force tambem, onde tentam achar<br>
combinacoes usuario/senha que podem mandar chamadas via seu asterisk....<br>
<div><div></div><div class="h5"><br>
><br>
> Rafael<br>
><br>
> -----Mensagem original-----<br>
> De: <a href="mailto:asteriskbrasil-bounces@listas.asteriskbrasil.org">asteriskbrasil-bounces@listas.asteriskbrasil.org</a><br>
> [mailto:<a href="mailto:asteriskbrasil-bounces@listas.asteriskbrasil.org">asteriskbrasil-bounces@listas.asteriskbrasil.org</a>] Em nome de Felipe<br>
> R. Pasa<br>
> Enviada em: segunda-feira, 23 de novembro de 2009 22:04<br>
> Para: <a href="mailto:asteriskbrasil@listas.asteriskbrasil.org">asteriskbrasil@listas.asteriskbrasil.org</a><br>
> Assunto: Re: [AsteriskBrasil] Intruso no Asterisk<br>
><br>
> Alexandre,<br>
><br>
> no seu sip.conf, voce pode habilitar o parametro allowguest=yes e na<br>
> conta do [guest] coloca um contexto que alcance somente os seus ramais<br>
> internos,ou algum que nao exista, neste caso o seu invasor no máximo<br>
> liga para o seu ramal e inclusive voce pode até trocar umas<br>
> palavrinhas com o intruso! :)<br>
><br>
> At.!<br>
><br>
> 2009/11/23 Alexandre Ricardo Souza Silva <<a href="mailto:alexandre@componentizar.com.br">alexandre@componentizar.com.br</a>>:<br>
>> Salve Galera!<br>
>><br>
>><br>
>> Preciso de help de todos, estava verificando o log do meu<br>
>> asterisk e notei que tenho uns 48 registro assim ( Sip/<a href="http://113.105.152.56" target="_blank">113.105.152.56</a><br>
>> asterisk asterisk) , pelo que verifiquei na Net isso é tentativa de<br>
> intruso,<br>
>> só que esse ip tentou ligar para alguns lugares , mas sem sucesso pelo que<br>
>> vi , todas as tentativas não passou de 16 segundos, essas 48 tentativas<br>
> sao<br>
>> desde mes 08 , hoje por exemplo não tive este ataque, eles estao tentando<br>
> a<br>
>> cada 4 dias...<br>
>><br>
>> Qual o patch q tenho que aplicar no * para manter mais<br>
>> seguro?<br>
>><br>
>> ***Log<br>
>> Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [011441616604001@from-sip-external:1] NoOp("SIP/113.105.152.56-b2e04818",<br>
>> "Received incoming SIP connection from unknown peer to 011441616604001")<br>
> in<br>
>> new stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [011441616604001@from-sip-external:2] Set("SIP/113.105.152.56-b2e04818",<br>
>> "DID=011441616604001") in new stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [011441616604001@from-sip-external:3] Goto("SIP/113.105.152.56-b2e04818",<br>
>> "s|1") in new stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:1] GotoIf("SIP/113.105.152.56-b2e04818",<br>
>> "0?from-trunk|011441616604001|1") in new stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:2] Set("SIP/113.105.152.56-b2e04818",<br>
>> "TIMEOUT(absolute)=15") in new stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:3] Answer("SIP/113.105.152.56-b2e04818", "") in new<br>
>> stack<br>
>> [Nov 14 01:22:19] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:4] Wait("SIP/113.105.152.56-b2e04818", "2") in new<br>
>> stack<br>
>> [Nov 14 01:22:21] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:5] Playback("SIP/113.105.152.56-b2e08a38",<br>
>> "ss-noservice") in new stack<br>
>> [Nov 14 01:22:21] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:5] Playback("SIP/113.105.152.56-b2e04818",<br>
>> "ss-noservice") in new stack<br>
>> [Nov 14 01:22:21] VERBOSE[21170] logger.c: --<br>
>> <SIP/113.105.152.56-b2e08a38> Playing 'ss-noservice' (language 'en')<br>
>> [Nov 14 01:22:21] VERBOSE[21171] logger.c: --<br>
>> <SIP/113.105.152.56-b2e04818> Playing 'ss-noservice' (language 'en')<br>
>> [Nov 14 01:22:28] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:6] PlayTones("SIP/113.105.152.56-b2e08a38",<br>
>> "congestion") in new stack<br>
>> [Nov 14 01:22:28] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:7] Congestion("SIP/113.105.152.56-b2e08a38", "5") in<br>
>> new stack<br>
>> [Nov 14 01:22:28] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:6] PlayTones("SIP/113.105.152.56-b2e04818",<br>
>> "congestion") in new stack<br>
>> [Nov 14 01:22:28] VERBOSE[21171] logger.c: -- Executing<br>
>> [s@from-sip-external:7] Congestion("SIP/113.105.152.56-b2e04818", "5") in<br>
>> new stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: == Spawn extension<br>
>> (from-sip-external, s, 7) exited non-zero on 'SIP/113.105.152.56-b2e08a38'<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [T@from-sip-external:1] NoOp("SIP/113.105.152.56-b2e08a38", "Received<br>
>> incoming SIP connection from unknown peer to T") in new stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [T@from-sip-external:2] Set("SIP/113.105.152.56-b2e08a38", "DID=s") in new<br>
>> stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [T@from-sip-external:3] Goto("SIP/113.105.152.56-b2e08a38", "s|1") in new<br>
>> stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:1] GotoIf("SIP/113.105.152.56-b2e08a38",<br>
>> "0?from-trunk|s|1") in new stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:2] Set("SIP/113.105.152.56-b2e08a38",<br>
>> "TIMEOUT(absolute)=15") in new stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:3] Answer("SIP/113.105.152.56-b2e08a38", "") in new<br>
>> stack<br>
>> [Nov 14 01:22:34] VERBOSE[21170] logger.c: -- Executing<br>
>> [s@from-sip-external:4] Wait("SIP/113.105.152.56-b2e08a38", "2") in new<br>
>> stack<br>
>> [Nov 14 01:22:34] VERBOSE[21171] logger.c: == Spawn extension<br>
>> (from-sip-external, s, 7) exited non-zero on 'SIP/113.105.152.56-b2e04818'<br>
>> [Nov 14 01:22:34] VERBOSE[21171] logger.c: -- Executing<br>
>> [T@from-sip-external:1] NoOp("SIP/113.105.152.56-b2e04818", "Received<br>
>> incoming SIP connection from unknown peer to T") in new stack<br>
>> [Nov 14 01:22:34] VERBOSE[21171] logger.c: -- Executing<br>
>> [T@from-sip-external:2] Set("SIP/113.105.152.56-b2e04818", "DID=s") in new<br>
>> stack<br>
>> [Nov 20 15:23:17] VERBOSE[6506] logger.c: -- Executing<br>
>> [s@from-sip-external:1] GotoIf("SIP/113.105.152.56-b3702a48",<br>
>> "0?from-trunk|s|1") in new stack<br>
>> [Nov 20 15:23:17] VERBOSE[6506] logger.c: -- Executing<br>
>> [s@from-sip-external:2] Set("SIP/113.105.152.56-b3702a48",<br>
>> "TIMEOUT(absolute)=15") in new stack<br>
>> [Nov 20 15:23:17] VERBOSE[6506] logger.c: -- Executing<br>
>> [s@from-sip-external:3] Answer("SIP/113.105.152.56-b3702a48", "") in new<br>
>> stack<br>
>> [Nov 20 15:23:17] VERBOSE[6506] logger.c: == Spawn extension<br>
>> (from-sip-external, s, 3) exited non-zero on 'SIP/113.105.152.56-b3702a48'<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [00#441616604001@from-sip-external:1] NoOp("SIP/113.105.152.56-b37009f8",<br>
>> "Received incoming SIP connection from unknown peer to 00#441616604001")<br>
> in<br>
>> new stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [00#441616604001@from-sip-external:2] Set("SIP/113.105.152.56-b37009f8",<br>
>> "DID=00#441616604001") in new stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [00#441616604001@from-sip-external:3] Goto("SIP/113.105.152.56-b37009f8",<br>
>> "s|1") in new stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:1] GotoIf("SIP/113.105.152.56-b37009f8",<br>
>> "0?from-trunk|00#441616604001|1") in new stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:2] Set("SIP/113.105.152.56-b37009f8",<br>
>> "TIMEOUT(absolute)=15") in new stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:3] Answer("SIP/113.105.152.56-b37009f8", "") in new<br>
>> stack<br>
>> [Nov 20 17:05:38] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:4] Wait("SIP/113.105.152.56-b37009f8", "2") in new<br>
>> stack<br>
>> [Nov 20 17:05:40] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:5] Playback("SIP/113.105.152.56-b37009f8",<br>
>> "ss-noservice") in new stack<br>
>> [Nov 20 17:05:40] VERBOSE[25061] logger.c: --<br>
>> <SIP/113.105.152.56-b37009f8> Playing 'ss-noservice' (language 'en')<br>
>> [Nov 20 17:05:47] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:6] PlayTones("SIP/113.105.152.56-b37009f8",<br>
>> "congestion") in new stack<br>
>> [Nov 20 17:05:47] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:7] Congestion("SIP/113.105.152.56-b37009f8", "5") in<br>
>> new stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: == Spawn extension<br>
>> (from-sip-external, s, 7) exited non-zero on 'SIP/113.105.152.56-b37009f8'<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [h@from-sip-external:1] NoOp("SIP/113.105.152.56-b37009f8", "Hangup") in<br>
> new<br>
>> stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [h@from-sip-external:2] Set("SIP/113.105.152.56-b37009f8", "DID=s") in new<br>
>> stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [h@from-sip-external:3] Goto("SIP/113.105.152.56-b37009f8", "s|1") in new<br>
>> stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:1] GotoIf("SIP/113.105.152.56-b37009f8",<br>
>> "0?from-trunk|s|1") in new stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:2] Set("SIP/113.105.152.56-b37009f8",<br>
>> "TIMEOUT(absolute)=15") in new stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: -- Executing<br>
>> [s@from-sip-external:3] Answer("SIP/113.105.152.56-b37009f8", "") in new<br>
>> stack<br>
>> [Nov 20 17:05:52] VERBOSE[25061] logger.c: == Spawn extension<br>
>> (from-sip-external, s, 3) exited non-zero on 'SIP/113.105.152.56-b37009f8'<br>
>><br>
>> **<br>
>><br>
>> Fico no aguardo<br>
>><br>
>> Abraço<br>
>><br>
>><br>
>> Alexandre<br>
>> _______________________________________________<br>
>> A Redfone é líder no fornecimento de bridges TDMoE &lt;-> E1<br>
>> - Valor similar ao de placas E1 PCI;<br>
>> - Não há problemas de compatibilidade com barramento PCI;<br>
>> - Possibilitam a construção de soluções de alta disponibilidade(dois<br>
>> servidores compartilham o mesmo E1)<br>
>> Conheça mais sobre este produto em <a href="http://www.red-fone.com" target="_blank">www.red-fone.com</a><br>
>> _______________________________________________<br>
>> Lista de discussões AsteriskBrasil.org<br>
>> <a href="mailto:AsteriskBrasil@listas.asteriskbrasil.org">AsteriskBrasil@listas.asteriskbrasil.org</a><br>
>> <a href="http://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil" target="_blank">http://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil</a><br>
>><br>
><br>
><br>
><br>
<br>
_______________________________________________<br>
A Redfone é líder no fornecimento de bridges TDMoE &lt;-> E1<br>
- Valor similar ao de placas E1 PCI;<br>
- Não há problemas de compatibilidade com barramento PCI;<br>
- Possibilitam a construção de soluções de alta disponibilidade(dois<br>
servidores compartilham o mesmo E1)<br>
Conheça mais sobre este produto em <a href="http://www.red-fone.com" target="_blank">www.red-fone.com</a><br>
_______________________________________________<br>
Lista de discussões AsteriskBrasil.org<br>
<a href="mailto:AsteriskBrasil@listas.asteriskbrasil.org">AsteriskBrasil@listas.asteriskbrasil.org</a><br>
<a href="http://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil" target="_blank">http://listas.asteriskbrasil.org/mailman/listinfo/asteriskbrasil</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Rodrigo F. Lang<br>Amd. de Redes em Telecom<br>