<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Guilherme, concordo com a sua colocação final. Segurança é de suma importância para telefonia IP! Complemente dizendo que a maioria nem sabe o que é isso!</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">O exemplo foi minimalista, e só para demonstrar a necessidade de um &quot;firewall&quot; entre a rede externa e os serviços.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">O grande problema é que a maioria mal sabe usar linux, não tem noção dos conceitos básicos de rede e pioro de segurança. Ai pega meia dúzia de receita de bolo na net e sai vendendo serviço, quando dá alguma &quot;zica&quot; a culpa é da tecnologia!</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Quanto ao item 3.1, nunca fiz e me recusaria a fazer, pelo simples fato que qualquer empresa que queria isso tem que ter grana para pagar. Um dos principais erros do mundo &quot;software livre&quot;, principalmente no Brasil, é a ideia de que o Linux/Asterisk são de graça, então as soluções tem que ser baratas se não de graça.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Falando dos itens 3.2 e 3.3, é uma segurança a mais. Porém não é 100%, pode ser contornado, principalmente por algum ex-funcionário que tenha saído magoado da empresa e conheça a estrutura. Muitas vezes ele próprio não faz, mas passas as informações para alguém fazer.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Uso o item 3.4, com alguns detalhes a mais.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Pois é, chegamos ao item 3.5, e nesse caso se for um ataque de pequeno porte pra cima, a não ser que você tenha um appliance bem dimensionado, as chances de algum problema são bem grandes. Por problemas não entendo apenas conseguir fazer ligações, mas a própria indisponibilidade do sistema ou queda do serviço é um problema.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Estrutura minima detalhada: Internet &lt;&gt; Router &lt;&gt; Firewall Generalista / Serviços / Aplicações / Pacotes *1 &lt;&gt; IDS &lt;&gt; [Proxy SIP] &lt;&gt; Asterisk</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif">*1 - Normalmente um appliance, pode ser dividido em mais de um hardware.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Não to considerando ai DMZ, a parte isolada para os serviços que não são expostos e etc.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Se o individuo passar pelo Firewall, dificilmente ele passa pelo IDS. Se ainda assim passar pelo IDS, o Asterisk pode avisar o IDS de tentativas de conexão mal-sucedidas, e esse por usa vez vai aumentar o rigor. O IDS também conversa com o Firewall, e esse por sua vez com o Router, que em ultima instancia isola determinadas rotas até a ação de um sysadmin.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">O problema é que a maioria não tem a menor noção disso, baixa a ISO de uma distro Linux qualquer, instala de qualquer jeito e normalmente mais pacotes que o necessário, baixa o Asterisk, usa uma receita de bolo para instalar e sobe ele como *root* mesmo. Dai pega um script de iptables pronto, que nem ao menos intende direito o que faz, e quando muito instala o Fail2Ban, com receita de bolo também, e acha que é o supra sumo do universo em Linux, Segurança, Redes, Asterisk e tudo mais. Tá feito a lambança.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Na primeira *zica* que acontece, fica desesperado, não sabe nem os logs que tem e muito menos como usa-los, e vem pedir socorro na lista. E não estou falando só sobre a questão de segurança mesmo.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">É só prestar atenção nas &quot;dúvidas&quot; que são postadas, chega ser triste! Chega ao cumulo do cara postar a dúvida com um fragmento de log com a mensagem explicando o problema!</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">É só olhar a quantidade de gente cadastrada na lista, muitos antigos, que nem respondem mais. Dá desanimo!</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Eu mesmo só voltei a ativa pra passar o tempo, e quando surge uma dúvida de alguém que realmente demonstra ter interesse, tento ajudar.</div>
<div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">É isso, desculpe misturar a resposta a esse desabafo!</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div></div><div class="gmail_extra"><br clear="all">
<div><div dir="ltr"><br>[...]&#39;s<br><br>Marcio<div><br></div><div><div style="font-family:arial;font-size:small">========================================</div><div style="font-family:arial;font-size:small">########### Campanha Ajude o Marcio! ###########</div>
<div style="font-family:arial;font-size:small"><a href="http://sosmarcio.blogspot.com.br/" style="color:rgb(17,85,204)" target="_blank">http://sosmarcio.blogspot.com.br/</a></div><div style="font-family:arial;font-size:small">
<a href="http://www.vakinha.com.br/VaquinhaP.aspx?e=195793" style="color:rgb(17,85,204)" target="_blank">http://www.vakinha.com.br/VaquinhaP.aspx?e=195793</a><br></div><div style="font-family:arial;font-size:small">========================================</div>
</div></div></div>
<br><br><div class="gmail_quote">Em 31 de julho de 2013 13:31, Guilherme Rezende <span dir="ltr">&lt;<a href="mailto:asterisk@guilherme.eti.br" target="_blank">asterisk@guilherme.eti.br</a>&gt;</span> escreveu:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    Márcio, gerando uma discursão saudável sobre aspecto segurança:<br>
        Trabalho a 13 anos c/ Linux e Firewall e a 4 c/ Asterisk.  Ja
    trabalhei e ainda faço algumas instalações(de vez em quando) de
    Fortinet, SonicWall e Linux/Iptables/Snort. <br>
    Bom, quando precisamos colocar uma máquina Asterisk exposta na
    Internet p/ que clientes externos possa se logar via SIP, a melhor
    alternativa é criando tuneis com OpenVPN usando TAP+SSL.  Porém nem
    sempre em virtudes de custo essa solução torna-se viável e
    precisamos expor nosso Asterisk na Internet, tanto diretamente c/ um
    IP Público ou conforme solução apresentada por vc abaixo.<br>
        Eu, particulamente discordo de sua solução que postou abaixo e
    prefiro usar IP-Público no Asterisk.  Veja os motivos:<br>
    <br>
    1 - No modelo que apresenta, seu Asterisk não fica livre de falhas
    ou Bugs no módulo SIP do Asterisk.  O protoco SIP/UDP na forma que
    apresenta abaixo fica exposto na mesma forma como seu Asterisk
    estivesse c/ IP-Público, além de poder gerar anomalias do NAT com
    SIP.  Se o SIP não estiver liberado externo ninguém externamente irá
    se logar no seu server correto? Um atacante pode facilmente fazer
    BruteForce em seu servidor no modelo abaixo como se o mesmo
    estivesse com IP-Publico.  Uma ferramenta p/ isso e que uso em
    laboratório é o sipvicious.    Não sei o porque, mas sempre quando
    sofro esses ataques, todos são oriundos de redes externas, ou seja,
    fora do Brasil.  Acho que até na lista todos os cologas apenas
    sofrem ataques de brute force externo também...<br>
    <br>
    2 - Bom, passando da esfera de um filtro de pacotes, uma grande
    solução seria análise de cabeçalho/string de pacotes do SIP p/
    identificar anomalia no mesmo e ai sim bloquear, como ja existe p/
    HTTP, SMTP, etc...  Infelizmente nenhum dos firewalls proprietário
    que conheço não possui essa técnica.<br>
    <br>
    3 - Bom, resumindo minhas colocações, eu monto meus projetos da
    seguinte forma:<br>
        3.1 - Quando se torna necessário expor o Asterisk ao IP
    Público.  &quot;Eu possuo 4 clientes c/ esse modelo e nunca tive
    problemas. Porém tentativas foram várias&quot;<br>
                Internet &lt;&gt; Router &lt;&gt;  Asterisk<br>
        3.2 - Se todos os ips públicos que irão se logar via SIP são
    fixos, libero no firewall(iptables) apenas esses IP´s p/ se logarem.<br>
        3.3 - Caso não sei de onde esses IP´s virão, Libero a Range do
    BR conforme ja postei aqui e fecho todas as portas TCP, abrindo
    apenas as que irei usar como SSH, HTTP, etc..<br>
        3.4 - Depois do filtro de pacotes, instale um IDS p/ analise de
    pacotes mal forjados em cima do seu Asterisk e um bom exemplo p/
    isso é usar o SNORT c/ uma rule pronta Asterisk.
    <a href="http://blog.sipvicious.org/2008/02/detecting-sip-attacks-with-snort.html" target="_blank">http://blog.sipvicious.org/2008/02/detecting-sip-attacks-with-snort.html</a><br>
        3.5 - Em 95% dos casos os ataques em cima do Asterisk são
    Brute-Force em cima do SIP p/ tentar se logar.  Dificilmente os
    ataques em cima do SIP são de Stack-Overflow p/ se conseguir um
    shell no sistema por falha do Asterisk.  <br>
        Enfim, são vários cenários e concordo com vc quando diz p/
    evitar expor seu Asterisk c/ IP Público.  Devemos expor o mínimo. 
    Porém nem sempre é possível.......<br>
        <br>
    Desculpa se fugi um pouco do escopo da lista que é Asterisk, mas
    creio que é um assunto de suma importância par telefonia IP.  Que é
    a seguança !!!<br>
    <br>
    <br>
    <br>
    Em 31/07/2013 13:51, Marcio - Google escreveu:
    <div><div class="h5"><blockquote type="cite">
      <div dir="ltr">
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">IP público no
          server?!?!?! My Good, alguém realmente faz uma sandice
          dessas???</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
          <br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Acho que vou
          desencarnar e não terei lido tudo ... rsrsrsrsrsr</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
          <br>
        </div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">No mínimo, mas
          mínimo mesmo: Internet &lt;&gt; Router &lt;&gt; Firewall
          &lt;&gt; [NAT] &lt;&gt; Asterisk</div>
        <div class="gmail_default" style="font-family:arial,helvetica,sans-serif">
          <br>
        </div>
      </div>
      <div class="gmail_extra"><br clear="all">
        <div>
          <div dir="ltr"><br>
            [...]&#39;s<br>
            <br>
            Marcio
            <div><br>
            </div>
            <div>
              <div style="font-family:arial;font-size:small">========================================</div>
              <div style="font-family:arial;font-size:small">
                ########### Campanha Ajude o Marcio! ###########</div>
              <div style="font-family:arial;font-size:small"><a href="http://sosmarcio.blogspot.com.br/" style="color:rgb(17,85,204)" target="_blank">http://sosmarcio.blogspot.com.br/</a></div>
              <div style="font-family:arial;font-size:small"><a href="http://www.vakinha.com.br/VaquinhaP.aspx?e=195793" style="color:rgb(17,85,204)" target="_blank">http://www.vakinha.com.br/VaquinhaP.aspx?e=195793</a><br>

              </div>
              <div style="font-family:arial;font-size:small">
                ========================================</div>
            </div>
          </div>
        </div>
        <br>
        <br>
        <div class="gmail_quote">Em 31 de julho de 2013 12:37, Danilo
          Almeida <span dir="ltr">&lt;<a href="mailto:daniloricalmeida@gmail.com" target="_blank">daniloricalmeida@gmail.com</a>&gt;</span>
          escreveu:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div dir="ltr">surgiu uma dúvida referente a esses ataques,
              como sou inexperiente nessa parte de redes, não sei como
              funciona essas tentativas...
              <div><br>
              </div>
              <div>como que eles descobrem o servidor na rede?</div>
              <div>como conseguem fazer tantas tentativas de ataque
                simultaneamente?</div>
              <div><br>
              </div>
              <div>se alguém puder me esclarecer um pouco sobre esse
                assunto eu agradeço... até mesmo porque, precisamos
                conhecer as técnicas para nos proteger.</div>
              <div><br>
              </div>
              <div>Obrigado</div>
            </div>
            <div class="gmail_extra">
              <br>
              <br>
              <div class="gmail_quote">Em 31 de julho de 2013 13:33,
                Guilherme Rezende <span dir="ltr">&lt;<a href="mailto:asterisk@guilherme.eti.br" target="_blank">asterisk@guilherme.eti.br</a>&gt;</span>
                escreveu:
                <div>
                  <div>
                    <br>
                    <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                      <div bgcolor="#FFFFFF" text="#000000">     Gente,
                        eu não uso Fail2ban.   Como esses ataques são
                        oriundos de redes externas ao BR, fiz o bloqueio
                        de todas as redes cujam origem não são BR. E
                        resolveu!!  Não tenho problemas c/ ataques
                        mais...  Os logs do meu Asterisk nunca mais
                        exibiram tentativa de logar via sip nos meus
                        servidores.  Veja o código abaixo que é bem
                        simples, libero apenas as redes que estão
                        listadas, depois fecho tudo.  Se não tiver
                        necessidade de ter alguém externo que logue no
                        seu servidor, o código abaixo resolve.  Desative
                        todas suas regras de iptables, desative todos os
                        firewall´s e rode o script abaixo.<br>
                        <br>
                        #!/bin/bash<br>
                        ipt=/sbin/iptables<br>
                        $ipt -F<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://172.16.5.0/24" target="_blank">172.16.5.0/24</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://186.0.0.0/8" target="_blank">186.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://187.0.0.0/8" target="_blank">187.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://177.0.0.0/8" target="_blank">177.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://179.0.0.0/8" target="_blank">179.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://189.0.0.0/8" target="_blank">189.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="tel:198.50.96.130" value="+551985096130" target="_blank">198.50.96.130</a> -p udp -j
                        ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://200.0.0.0/8" target="_blank">200.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -s <a href="http://201.0.0.0/8" target="_blank">201.0.0.0/8</a>
                        -p udp -j ACCEPT<br>
                        $ipt -A INPUT -i eth2 -p udp -j DROP<br>
                        <br>
                        <br>
                        <br>
                        Em 31/07/2013 13:12, Danilo Almeida escreveu:
                        <div>
                          <div>
                            <blockquote type="cite">
                              <div dir="ltr">recebi várias tentativas
                                neste final de semana, porém, o fail2ban
                                bloqueiou.
                                <div><br>
                                </div>
                                <div>DROP       all  --  <a href="tel:173.242.120.42" value="+17324212042" target="_blank">173.242.120.42</a>      
                                  anywhere<br>
                                  <table border="0" cellpadding="4" cellspacing="0" height="300" width="297">
                                    <tbody>
                                      <tr>
                                        <td align="right">Nome do Host:</td>
                                        <td align="left" width="198"><a href="tel:173.242.120.42" value="+17324212042" target="_blank">173.242.120.42</a></td>
                                      </tr>
                                      <tr>
                                        <td align="right">IP Address:</td>
                                        <td align="left"><a href="tel:173.242.120.42" value="+17324212042" target="_blank">173.242.120.42</a></td>
                                      </tr>
                                      <tr>
                                        <td align="right">País:</td>
                                        <td align="left"><a href="http://en.wikipedia.org/wiki/united%20states" target="_blank"> United
                                            States</a> <img alt="united states" align="absmiddle"></td>
                                      </tr>
                                      <tr>
                                        <td align="right">Código do
                                          país:</td>
                                        <td align="left">US (USA)</td>
                                      </tr>
                                      <tr>
                                        <td align="right">Região:</td>
                                        <td align="left"><a href="http://en.wikipedia.org/wiki/Pennsylvania" target="_blank">Pennsylvania</a></td>
                                      </tr>
                                      <tr>
                                        <td align="right">Cidade:</td>
                                        <td align="left">Clarks Summit</td>
                                      </tr>
                                      <tr>
                                        <td align="right">Código postal:</td>
                                        <td align="left">18411</td>
                                      </tr>
                                      <tr>
                                        <td align="right">Código tel.:</td>
                                        <td align="left"><a href="http://en.wikipedia.org/wiki/Area_code#United_States" target="_blank">+1</a></td>
                                      </tr>
                                      <tr>
                                        <td align="right">Longitude:</td>
                                        <td align="left">-75.728</td>
                                      </tr>
                                      <tr>
                                        <td align="right">Latitude:</td>
                                        <td align="left">41.4486<br>
                                        </td>
                                      </tr>
                                    </tbody>
                                  </table>
                                </div>
                                <div class="gmail_extra"><br>
                                </div>
                                <div class="gmail_extra">
                                  <div class="gmail_extra">[2013-07-27
                                    15:09:35] NOTICE[1775] chan_sip.c:
                                    Registration from &#39;&quot;shuang&quot; <a>&lt;sip:shuang@IP-Servidor&gt;</a>&#39;
                                    failed for &#39;<a href="http://173.242.120.42:5061" target="_blank">173.242.120.42:5061</a>&#39;
                                    - Wrong password</div>
                                  <div><br>
                                  </div>
                                  <div>
                                    <div>[2013-07-28 15:09:43]
                                      NOTICE[1775] chan_sip.c:
                                      Registration from &#39;&quot;chu&quot; <a>&lt;sip:chu@IP-servidor&gt;</a>&#39;
                                      failed for &#39;<a href="http://173.242.120.42:5081" target="_blank">173.242.120.42:5081</a>&#39;
                                      - Wrong password</div>
                                  </div>
                                  <div><br>
                                  </div>
                                  <div>[2013-07-29 15:09:45]
                                    NOTICE[1775] chan_sip.c:
                                    Registration from &#39;&quot;chu&quot; <a>&lt;sip:chu@IP-servidor&gt;</a>&#39;
                                    failed for &#39;<a href="http://173.242.120.42:5081" target="_blank">173.242.120.42:5081</a>&#39;
                                    - Wrong password<br>
                                  </div>
                                  <div><br>
                                  </div>
                                  <div>[2013-07-30 15:09:47]
                                    NOTICE[1775] chan_sip.c:
                                    Registration from &#39;&quot;chu&quot; <a>&lt;sip:chu@IP-servido&gt;</a>&#39;
                                    failed for &#39;<a href="http://173.242.120.42:5081" target="_blank">173.242.120.42:5081</a>&#39;
                                    - Wrong password</div>
                                  <div class="gmail_extra"><br>
                                  </div>
                                  se observarem, eu bloqueio as
                                  tentativas por 24 horas, sendo assim,
                                  o invasor permanecia tentando no dia
                                  seguinte, agora dei um BAN permanente
                                  nele... rsrs</div>
                                <div class="gmail_extra"> <br>
                                </div>
                                <div class="gmail_extra"><br>
                                  <div class="gmail_quote">Em 31 de
                                    julho de 2013 12:50, Thiago Anselmo
                                    <span dir="ltr">&lt;<a href="mailto:thiagoo.anselmoo@gmail.com" target="_blank">thiagoo.anselmoo@gmail.com</a>&gt;</span>
                                    escreveu:<br>
                                    <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                      <div dir="ltr">Amigo,
                                        <div><br>
                                        </div>
                                        <div>Já teve outro amigo aqui da
                                          lista que teve o mesmo
                                          problema, e o mesmo o fail2ban
                                          não pegou, pois eles não
                                          atacam penas 5060, existe
                                          outras fomras!! <br>
                                          <br>
                                          Como está ligado seu PABX?
                                          Está atrás de NAT ou
                                          diretamente um IP público
                                          ligado a ele?</div>
                                        <div><br>
                                        </div>
                                        <div>me diga que podemos
                                          realizar formas de fazer com o
                                          IPTABLES!! E fica bom!!!</div>
                                        <div>Bloqueia tudo e libera
                                          apenas para quem você deseja!</div>
                                      </div>
                                      <div class="gmail_extra"><br>
                                        <br>
                                        <div class="gmail_quote"> Em 31
                                          de julho de 2013 12:40, Marcio
                                          - Google <span dir="ltr">&lt;<a href="mailto:marciorp@gmail.com" target="_blank">marciorp@gmail.com</a>&gt;</span>
                                          escreveu:
                                          <div>
                                            <div><br>
                                              <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                <div dir="ltr">
                                                  <div style="font-family:arial,helvetica,sans-serif">Exatamente

                                                    o que o Hudson disse
                                                    ...</div>
                                                  <div style="font-family:arial,helvetica,sans-serif">Falha

                                                    no dimensionamento e
                                                    configuração.</div>
                                                </div>
                                                <div class="gmail_extra"><br clear="all">
                                                  <div>
                                                    <div dir="ltr"><br>
                                                      [...]&#39;s<br>
                                                      <br>
                                                      Marcio
                                                      <div><br>
                                                      </div>
                                                      <div>
                                                        <div style="font-family:arial;font-size:small">========================================</div>
                                                        <div style="font-family:arial;font-size:small">
                                                          ###########
                                                          Campanha Ajude
                                                          o Marcio!
                                                          ###########</div>
                                                        <div style="font-family:arial;font-size:small"><a href="http://sosmarcio.blogspot.com.br/" style="color:rgb(17,85,204)" target="_blank">http://sosmarcio.blogspot.com.br/</a></div>

                                                        <div style="font-family:arial;font-size:small"><a href="http://www.vakinha.com.br/VaquinhaP.aspx?e=195793" style="color:rgb(17,85,204)" target="_blank">http://www.vakinha.com.br/VaquinhaP.aspx?e=195793</a><br>

                                                        </div>
                                                        <div style="font-family:arial;font-size:small">
========================================</div>
                                                      </div>
                                                    </div>
                                                  </div>
                                                  <br>
                                                  <br>
                                                  <div class="gmail_quote">Em
                                                    31 de julho de 2013
                                                    11:06, Hudson
                                                    Cardoso <span dir="ltr">&lt;<a href="mailto:hudsoncardoso@hotmail.com" target="_blank">hudsoncardoso@hotmail.com</a>&gt;</span>
                                                    escreveu:
                                                    <div>
                                                      <div> <br>
                                                        <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div>
                                                          <div dir="ltr"><font style="font-size:12pt" face="Arial" size="3">   O Fail2ban não pegou,
                                                          porque ele ja
                                                          conseguiu
                                                          passar, isso
                                                          significa que
                                                          o teu firewall
                                                          não está
                                                          corretamente</font>
                                                          <div><font style="font-size:12pt" face="Arial" size="3">dimensionado,

                                                          e/ou
                                                          configurado.</font></div>
                                                          <div><font style="font-size:12pt" face="Arial" size="3">  No
                                                          meu se fizer 3
                                                          tentativas,
                                                          bloqueia por
                                                          15 minutos, e
                                                          quando um
                                                          guest pede
                                                          acesso ao
                                                          diaplan,
                                                          simplesmente </font></div>
                                                          <div><font style="font-size:12pt" face="Arial" size="3">dou
                                                          HangUp em
                                                          todos os
                                                          Guest.<br>
                                                          </font><br>
                                                          <br>
                                                          <pre style="line-height:17px;color:rgb(42,42,42);white-space:normal">Hudson 
<a href="tel:%28048%29%208413-7000" value="+554884137000" target="_blank">(048) 8413-7000</a>
Para quem nao cre, nenhuma prova converte,Para aquele que cre, nenhuma prova precisa. </pre>
                                                          <br>
                                                          <br>
                                                          <div>&gt;
                                                          From: <a href="mailto:caiopato@gmail.com" target="_blank">caiopato@gmail.com</a><br>
                                                          &gt; Date:
                                                          Wed, 31 Jul
                                                          2013 11:47:25
                                                          -0300<br>
                                                          &gt; To: <a href="mailto:asteriskbrasil@listas.asteriskbrasil.org" target="_blank">asteriskbrasil@listas.asteriskbrasil.org</a><br>
                                                          &gt; Subject:
                                                          [AsteriskBrasil]

                                                          Ataque massivo
                                                          a partir do IP
                                                          <a href="tel:67.207.137.49" value="+556720713749" target="_blank">67.207.137.49</a>
                                                          <div>
                                                          <div><br>
                                                          &gt; <br>
                                                          &gt; Eu estava
                                                          sendo vítima
                                                          de uma
                                                          tentativa de
                                                          ataque a
                                                          partir do IP<br>
                                                          &gt; <a href="tel:67.207.137.49" value="+556720713749" target="_blank">67.207.137.49</a>
                                                          (Rackspace
                                                          Cloud
                                                          Servers),<br>
                                                          &gt; Foram
                                                          3548
                                                          tentativas em
                                                          10 minutos até
                                                          ser bloqueado
                                                          manualmente no
                                                          iptables.<br>
                                                          &gt; Não
                                                          investiguei a
                                                          fundo o método
                                                          do ataque, mas
                                                          basicamente
                                                          ele estava<br>
                                                          &gt; tentando
                                                          cavar uma
                                                          falha no
                                                          dialplan.<br>
                                                          &gt; <br>
                                                          &gt; No
                                                          console
                                                          apareceu:<br>
                                                          &gt; Jul 31
                                                          09:53:58
                                                          WARNING[18816]:
                                                          chan_sip.c:6903

                                                          get_destination:
                                                          Huh?<br>
                                                          &gt; Not a SIP
                                                          header
                                                          (tel:1900442075005000)?<br>
                                                          &gt; ...<br>
                                                          &gt; Jul 31
                                                          10:04:37
                                                          WARNING[18816]:
                                                          chan_sip.c:6903

                                                          get_destination:
                                                          Huh?<br>
                                                          &gt; Not a SIP
                                                          header
                                                          (tel:2440900442075005000)?<br>
                                                          &gt; <br>
                                                          &gt; Note que
                                                          o atacando
                                                          manteve o
                                                          sufixo e
                                                          alterava só o
                                                          prefixo (19,
                                                          29,<br>
                                                          &gt; 39, ....
                                                          até chegar no
                                                          24409 quando
                                                          eu bloqueei
                                                          via iptables.<br>
                                                          &gt; <br>
                                                          &gt; Esse tipo
                                                          de ataque NÃO
                                                          É identificado
                                                          pelo fail2ban
                                                          pois não há
                                                          logs gerados.<br>
                                                          &gt; <br>
                                                          &gt; O
                                                          telefone
                                                          00442075005000
                                                          pertence a um
                                                          banco (Citi)
                                                          em Londres.
                                                          Pode<br>
                                                          &gt; ser
                                                          apenas um
                                                          número teste -
                                                          se o atacante
                                                          receber
                                                          &quot;CONNECT&quot;, a<br>
                                                          &gt; tentativa
                                                          foi bem
                                                          sucedida e ele
                                                          descarrega um
                                                          caminhão de
                                                          chamadas<br>
                                                          &gt; para
                                                          outros
                                                          destinos.<br>
                                                          &gt; <br>
                                                          &gt; Então
                                                          vale o eterno
                                                          conselho:
                                                          fique de olho
                                                          - não confie
                                                          só no
                                                          fail2ban.<br>
                                                          &gt;
                                                          _______________________________________________<br>
                                                          &gt; KHOMP:
                                                          completa linha
                                                          de placas
                                                          externas FXO,
                                                          FXS, GSM e E1;<br>
                                                          &gt; Media
                                                          Gateways de 1
                                                          a 64 E1s para
                                                          SIP com R2,
                                                          ISDN e SS7;<br>
                                                          &gt;
                                                          Intercomunicadores
                                                          para acesso
                                                          remoto via
                                                          rede IP.
                                                          Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
                                                          &gt;
                                                          _______________________________________________<br>
                                                          &gt; ALIGERA –
                                                          Fabricante
                                                          nacional de
                                                          Gateways
                                                          SIP-E1 para
                                                          R2, ISDN e
                                                          SS7.<br>
                                                          &gt; Placas de
                                                          1E1, 2E1, 4E1
                                                          e 8E1 para PCI
                                                          ou PCI
                                                          Express.<br>
                                                          &gt; Channel
                                                          Bank –
                                                          Appliance
                                                          Asterisk -
                                                          Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
                                                          &gt;
                                                          _______________________________________________<br>
                                                          &gt; Para
                                                          remover seu
                                                          email desta
                                                          lista, basta
                                                          enviar um
                                                          email em
                                                          branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <br>
_______________________________________________<br>
                                                          KHOMP:
                                                          completa linha
                                                          de placas
                                                          externas FXO,
                                                          FXS, GSM e E1;<br>
                                                          Media Gateways
                                                          de 1 a 64 E1s
                                                          para SIP com
                                                          R2, ISDN e
                                                          SS7;<br>
                                                          Intercomunicadores
                                                          para acesso
                                                          remoto via
                                                          rede IP.
                                                          Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
_______________________________________________<br>
                                                          ALIGERA –
                                                          Fabricante
                                                          nacional de
                                                          Gateways
                                                          SIP-E1 para
                                                          R2, ISDN e
                                                          SS7.<br>
                                                          Placas de 1E1,
                                                          2E1, 4E1 e 8E1
                                                          para PCI ou
                                                          PCI Express.<br>
                                                          Channel Bank –
                                                          Appliance
                                                          Asterisk -
                                                          Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
_______________________________________________<br>
                                                          Para remover
                                                          seu email
                                                          desta lista,
                                                          basta enviar
                                                          um email em
                                                          branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
                                                        </blockquote>
                                                      </div>
                                                    </div>
                                                  </div>
                                                  <br>
                                                </div>
                                                <br>
_______________________________________________<br>
                                                KHOMP: completa linha de
                                                placas externas FXO,
                                                FXS, GSM e E1;<br>
                                                Media Gateways de 1 a 64
                                                E1s para SIP com R2,
                                                ISDN e SS7;<br>
                                                Intercomunicadores para
                                                acesso remoto via rede
                                                IP. Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
_______________________________________________<br>
                                                ALIGERA – Fabricante
                                                nacional de Gateways
                                                SIP-E1 para R2, ISDN e
                                                SS7.<br>
                                                Placas de 1E1, 2E1, 4E1
                                                e 8E1 para PCI ou PCI
                                                Express.<br>
                                                Channel Bank – Appliance
                                                Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
_______________________________________________<br>
                                                Para remover seu email
                                                desta lista, basta
                                                enviar um email em
                                                branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
                                              </blockquote>
                                            </div>
                                          </div>
                                        </div>
                                        <span><font color="#888888"> <br>
                                            <br clear="all">
                                            <div><br>
                                            </div>
                                            -- <br>
                                            Thiago Anselmo </font></span></div>
                                      <br>
_______________________________________________<br>
                                      KHOMP: completa linha de placas
                                      externas FXO, FXS, GSM e E1;<br>
                                      Media Gateways de 1 a 64 E1s para
                                      SIP com R2, ISDN e SS7;<br>
                                      Intercomunicadores para acesso
                                      remoto via rede IP. Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
_______________________________________________<br>
                                      ALIGERA – Fabricante nacional de
                                      Gateways SIP-E1 para R2, ISDN e
                                      SS7.<br>
                                      Placas de 1E1, 2E1, 4E1 e 8E1 para
                                      PCI ou PCI Express.<br>
                                      Channel Bank – Appliance Asterisk
                                      - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
_______________________________________________<br>
                                      Para remover seu email desta
                                      lista, basta enviar um email em
                                      branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
                                    </blockquote>
                                  </div>
                                  <br>
                                  <br clear="all">
                                  <div><br>
                                  </div>
                                  -- <br>
                                  <div dir="ltr"><b><font color="#0000ff">att</font></b>
                                    <div><b><font color="#0000ff">Danilo
                                          Almeida</font></b></div>
                                  </div>
                                </div>
                              </div>
                              <br>
                              <fieldset></fieldset>
                              <br>
                              <pre>_______________________________________________
KHOMP: completa linha de placas externas FXO, FXS, GSM e E1;
Media Gateways de 1 a 64 E1s para SIP com R2, ISDN e SS7;
Intercomunicadores para acesso remoto via rede IP. Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.
_______________________________________________
ALIGERA – Fabricante nacional de Gateways SIP-E1 para R2, ISDN e SS7.
Placas de 1E1, 2E1, 4E1 e 8E1 para PCI ou PCI Express.
Channel Bank – Appliance Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.
_______________________________________________
Para remover seu email desta lista, basta enviar um email em branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a></pre>

                            </blockquote>
                            <br>
                          </div>
                        </div>
                      </div>
                      <br>
                      _______________________________________________<br>
                      KHOMP: completa linha de placas externas FXO, FXS,
                      GSM e E1;<br>
                      Media Gateways de 1 a 64 E1s para SIP com R2, ISDN
                      e SS7;<br>
                      Intercomunicadores para acesso remoto via rede IP.
                      Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
                      _______________________________________________<br>
                      ALIGERA – Fabricante nacional de Gateways SIP-E1
                      para R2, ISDN e SS7.<br>
                      Placas de 1E1, 2E1, 4E1 e 8E1 para PCI ou PCI
                      Express.<br>
                      Channel Bank – Appliance Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
                      _______________________________________________<br>
                      Para remover seu email desta lista, basta enviar
                      um email em branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
                    </blockquote>
                  </div>
                </div>
              </div>
              <span><font color="#888888">
                  <br>
                  <br clear="all">
                  <div><br>
                  </div>
                  -- <br>
                  <div dir="ltr"><b><font color="#0000ff">att</font></b>
                    <div><b><font color="#0000ff">Danilo
                          Almeida</font></b></div>
                  </div>
                </font></span></div>
            <br>
            _______________________________________________<br>
            KHOMP: completa linha de placas externas FXO, FXS, GSM e E1;<br>
            Media Gateways de 1 a 64 E1s para SIP com R2, ISDN e SS7;<br>
            Intercomunicadores para acesso remoto via rede IP. Conheça
            em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
            _______________________________________________<br>
            ALIGERA – Fabricante nacional de Gateways SIP-E1 para R2,
            ISDN e SS7.<br>
            Placas de 1E1, 2E1, 4E1 e 8E1 para PCI ou PCI Express.<br>
            Channel Bank – Appliance Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
            _______________________________________________<br>
            Para remover seu email desta lista, basta enviar um email em
            branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>_______________________________________________
KHOMP: completa linha de placas externas FXO, FXS, GSM e E1;
Media Gateways de 1 a 64 E1s para SIP com R2, ISDN e SS7;
Intercomunicadores para acesso remoto via rede IP. Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.
_______________________________________________
ALIGERA – Fabricante nacional de Gateways SIP-E1 para R2, ISDN e SS7.
Placas de 1E1, 2E1, 4E1 e 8E1 para PCI ou PCI Express.
Channel Bank – Appliance Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.
_______________________________________________
Para remover seu email desta lista, basta enviar um email em branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org" target="_blank">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a></pre>

    </blockquote>
    <br>
  </div></div></div>

<br>_______________________________________________<br>
KHOMP: completa linha de placas externas FXO, FXS, GSM e E1;<br>
Media Gateways de 1 a 64 E1s para SIP com R2, ISDN e SS7;<br>
Intercomunicadores para acesso remoto via rede IP. Conheça em <a href="http://www.Khomp.com" target="_blank">www.Khomp.com</a>.<br>
_______________________________________________<br>
ALIGERA – Fabricante nacional de Gateways SIP-E1 para R2, ISDN e SS7.<br>
Placas de 1E1, 2E1, 4E1 e 8E1 para PCI ou PCI Express.<br>
Channel Bank – Appliance Asterisk - Acesse <a href="http://www.aligera.com.br" target="_blank">www.aligera.com.br</a>.<br>
_______________________________________________<br>
Para remover seu email desta lista, basta enviar um email em branco para <a href="mailto:asteriskbrasil-unsubscribe@listas.asteriskbrasil.org">asteriskbrasil-unsubscribe@listas.asteriskbrasil.org</a><br></blockquote></div>
<br></div>