<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><div>Hi, </div><div>I have a fake sip server listenning on port 5060 on a linux machine in the same subnet, made in perl , which execute a perl script than ban the ip from our principal router.<br></div><div>It´s adapted for mikrotik , using its api , but can be easily modified for make a ssh to a cisco or quagga server.</div><div><br></div><div>I have attached the perl script , copy from linux to a txt.</div><div><br></div><div>Regards.</div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Tabi Tabe Tabi" <tabi.tabe@gmail.com><br><b>Para: </b>"Derrick Bradbury" <derrickb@halex.com><br><b>CC: </b>spce-user@lists.sipwise.com<br><b>Enviados: </b>Miércoles, 30 de Abril 2014 16:17:46<br><b>Asunto: </b>Re: [Spce-user] SPCE Security alert<br><div><br></div><div dir="ltr">Thanks Derrick.<div><br></div><div>You all make me smile.</div><div><br></div><div>Much appreciated. Will revert with update.</div><div><br></div><div>Regards,</div><div><br></div><div>Tabi</div></div><div class="gmail_extra">
<br><div><br></div><div class="gmail_quote">On Wed, Apr 30, 2014 at 3:47 PM, Derrick Bradbury <span dir="ltr"><<a href="mailto:derrickb@halex.com" target="_blank">derrickb@halex.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Also you can do GeoIP at the IPTABLES level:<br>
<br>
One way is:<br>
<a href="http://terminal28.com/how-to-block-countries-using-iptables-debian/" target="_blank">http://terminal28.com/how-to-block-countries-using-iptables-debian/</a><br>
<br>
Slightly modified to be a bit easier...<br>
<br>
sudo apt-get install xtables-addons-common unzip module-assistant<br>
<br>
sudo module-assistant --verbose --text-mode auto-install xtables-addons<br>
<br>
mkdir -p /tmp/xt<br>
cd /tmp/xt<br>
<br>
/usr/lib/xtables-addons/xt_geoip_dlro<br>
unzip *.zip<br>
sudo mkdir -p /usr/share/xt_geoip<br>
sudo /usr/lib/xtables-addons/xt_geoip_build -D /usr/share/xt_geoip *.csv<br>
<br>
<br>
and a sample for what I have is:<br>
<br>
iptables -I INPUT -p udp --dport 5060 -m geoip ! --src-cc CA,US -j DROP -i em2<br>
iptables -I INPUT -p tcp --dport 5060 -m geoip ! --src-cc CA,US -j DROP -i em2<br>
<br>
<br>
<br>
________________________________________<br>
From: <a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a> [<a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a>] on behalf of Daniel Grotti [<a href="mailto:dgrotti@sipwise.com" target="_blank">dgrotti@sipwise.com</a>]<br>
Sent: Wednesday, April 30, 2014 8:39 AM<br>
To: <a href="mailto:spce-user@lists.sipwise.com" target="_blank">spce-user@lists.sipwise.com</a><br>
Subject: Re: [Spce-user] SPCE Security alert<br>
<div class="HOEnZb"><div class="h5"><br>
Hi Tabi,<br>
another easy solution, just add in LB config file the following lines:<br>
<br>
<br>
if ($ua=~"friendly-scanner" || $ua=~"sipvicious" )<br>
{<br>
drop();<br>
}<br>
<br>
Also, regarding svcrash.py:<br>
<a href="http://keithcroxford.wordpress.com/2012/01/08/sip-registerdos-attacks/" target="_blank">http://keithcroxford.wordpress.com/2012/01/08/sip-registerdos-attacks/</a><br>
<br>
<br>
<br>
Daniel<br>
<br>
<br>
<br>
<br>
On 04/30/2014 01:39 PM, Lorenzo Mangani wrote:<br>
> You could also consider actively crashing the offenders IP on log hits<br>
> alongside the banning (using either svcrash.py, Homer Kill-Vicious tool,<br>
> or sipgrep 2.0 -J or your own solution)<br>
><br>
> Best,<br>
><br>
> Lorenzo Mangani<br>
><br>
> HOMER DEV TEAM<br>
> QXIP - Capture Engineering<br>
> Desk: <a href="tel:%2B1%20%28202%29%20470-5312" target="_blank">+1 (202) 470-5312</a><br>
> Mobile: <a href="tel:%2B31%206%204603-2730" target="_blank">+31 6 4603-2730</a><br>
><br>
><br>
><br>
><br>
> On Wed, Apr 30, 2014 at 1:26 PM, Norbert Piper<br>
> <<a href="mailto:norbert.piper@telenoise.de" target="_blank">norbert.piper@telenoise.de</a> <mailto:<a href="mailto:norbert.piper@telenoise.de" target="_blank">norbert.piper@telenoise.de</a>>> wrote:<br>
><br>
> USE GEOIP ban instead of fail2ban____<br>
><br>
> __ __<br>
><br>
> J____<br>
><br>
> __ __<br>
><br>
> *Von:*<a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a><br>
> <mailto:<a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a>><br>
> [mailto:<a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a><br>
> <mailto:<a href="mailto:spce-user-bounces@lists.sipwise.com" target="_blank">spce-user-bounces@lists.sipwise.com</a>>] *Im Auftrag von *Tabi<br>
> Tabe Tabi<br>
> *Gesendet:* Mittwoch, 30. April 2014 13:18<br>
> *An:* <a href="mailto:spce-user@lists.sipwise.com" target="_blank">spce-user@lists.sipwise.com</a> <mailto:<a href="mailto:spce-user@lists.sipwise.com" target="_blank">spce-user@lists.sipwise.com</a>><br>
> *Betreff:* [Spce-user] SPCE Security alert____<br>
><br>
> __ __<br>
><br>
> Hi,____<br>
><br>
> __ __<br>
><br>
> I just realized one of my test SPCE servers is under heavy friendly<br>
> scanner and SIPViscious attack. This happened 30 minutes after I<br>
> exposed the server to the Internet. I found the following IP<br>
> addresses in Banned IP:____<br>
><br>
> __ __<br>
><br>
> 1. 199.231.48.5____<br>
><br>
> 2. 188.138.4.216____<br>
><br>
> 3. 109.230.245.113____<br>
><br>
> 4. 31.3.240.251____<br>
><br>
> 5. 41.221.11.46____<br>
><br>
> 6. 46.165.220.215____<br>
><br>
> 7. 70.34..120.248____<br>
><br>
> 8. 79.143.83.4____<br>
><br>
> I am using iptables to drop the packets and have seen drop in<br>
> resource utilization on the server.____<br>
><br>
> Does any one have recommendation for implementation of fail2ban on<br>
> SIPWise?____<br>
><br>
> __ __<br>
><br>
> Thanks.____<br>
><br>
> __ __<br>
><br>
> --<br>
> ...Tabi____<br>
><br>
> __ __<br>
><br>
><br>
> _______________________________________________<br>
> Spce-user mailing list<br>
> <a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a> <mailto:<a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a>><br>
> <a href="http://lists.sipwise.com/listinfo/spce-user" target="_blank">http://lists.sipwise.com/listinfo/spce-user</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Spce-user mailing list<br>
> <a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a><br>
> <a href="http://lists.sipwise.com/listinfo/spce-user" target="_blank">http://lists.sipwise.com/listinfo/spce-user</a><br>
><br>
<br>
_______________________________________________<br>
Spce-user mailing list<br>
<a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a><br>
<a href="http://lists.sipwise.com/listinfo/spce-user" target="_blank">http://lists.sipwise.com/listinfo/spce-user</a><br>
<br>
_______________________________________________<br>
Spce-user mailing list<br>
<a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a><br>
<a href="http://lists.sipwise.com/listinfo/spce-user" target="_blank">http://lists.sipwise.com/listinfo/spce-user</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>...Tabi<div><br></div>
</div>
<br>_______________________________________________<br>Spce-user mailing list<br>Spce-user@lists.sipwise.com<br>http://lists.sipwise.com/listinfo/spce-user<br></div><div><br></div></div></body></html>