On 04/04/2013 02:30 PM, Togan Muftuoglu wrote:
On 04/04/2013 02:19 PM, Marcus Meissner wrote:
On Thu, Apr 04, 2013 at 02:10:58PM +0200, Togan Muftuoglu wrote:
Hi Per, On 04/04/2013 01:41 PM, Per Jessen wrote: There is the first drop...
I guess dropping was not the issue but keeping the dropped attacker for a long time in hold was the issue for me
Ok here we go again and in addition to the attacker not being held for a long time, the problem is in dictionary attacks SuSEfirewall2 fails, or I haven't been able to find a better way, since it takes quite a time for fail2ban to act. Fail2ban was in action The IP 62.75.202.56 has just been banned by Fail2Ban after 58 attempts against ASTERISK. So wandering what the hell SuSEfirewall2 doing Apr 13 03:56:10 whale kernel: SFW2-INext-ACC IN=eth0 OUT= MAC=00:19:66:3f:7f:fe:00:0d:65:ec:6e:ae:08:00 SRC=62.75.202.56 DST=XXX.XXX.XXX.XX LEN=442 TOS=0x00 PREC=0x00 TTL=57 ID=0 DF PROTO=UDP SPT=5098 DPT=5060 LEN=422 Apr 13 03:56:10 whale kernel: SFW2-INext-ACC IN=eth0 OUT= MAC=00:19:66:3f:7f:fe:00:0d:65:ec:6e:ae:08:00 SRC=62.75.202.56 DST=XXX.XXX.XXX.XX LEN=463 TOS=0x00 PREC=0x00 TTL=57 ID=0 DF PROTO=UDP SPT=5068 DPT=5060 LEN=443 So there are two packets and they are both accepted. There are no droped packets from this attacker Looking to asterisk this is again a brute force dictionary attack and SuSEfirewall2 is not sufficient with FW_SERVICES_ACCEPT_EXT="0/0,udp,5060,,hitcount=3,blockseconds=60,recentname=voip" [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"2276679141"sip:2276679141@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"1"sip:1@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"2"sip:2@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"3"sip:3@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"10"sip:10@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"11"sip:11@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"12"sip:12@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"13"sip:13@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"20"sip:20@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"21"sip:21@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"22"sip:22@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"30"sip:30@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"31"sip:31@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"40"sip:40@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"41"sip:41@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"50"sip:50@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"51"sip:51@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"60"sip:60@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"61"sip:61@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"70"sip:70@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"71"sip:71@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"80"sip:80@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"81"sip:81@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"90"sip:90@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"91"sip:91@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"100"sip:100@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"101"sip:101@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"102"sip:102@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"103"sip:103@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"104"sip:104@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"105"sip:105@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"106"sip:106@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"200"sip:200@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"201"sip:201@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"202"sip:202@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"203"sip:203@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"300"sip:300@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"301"sip:301@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"302"sip:302@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"303"sip:303@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"400"sip:400@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"401"sip:401@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"402"sip:402@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"403"sip:403@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"500"sip:500@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"501"sip:501@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"502"sip:502@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"503"sip:503@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"600"sip:600@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"601"sip:601@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"602"sip:602@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"603"sip:603@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"700"sip:700@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"701"sip:701@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"702"sip:702@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"703"sip:703@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"800"sip:800@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"801"sip:801@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"802"sip:802@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"803"sip:803@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"900"sip:900@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"901"sip:901@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"902"sip:902@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"903"sip:903@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"1000"sip:1000@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"1001"sip:1001@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"1002"sip:1002@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"1003"sip:1003@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"2000"sip:2000@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found [2013-04-13 03:56:10] NOTICE[20816] chan_sip.c: Registration from '"2001"sip:2001@XXX.XXX.XXX.XX' failed for '62.75.202.56' - No matching peer found -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org