[Spce-user] Registration attack

[Skyler]

Hi Jeremie,

On 5/1/2013 6:40 AM, Jeremie Chism wrote:
> We are receiving an attack of someone that is continuously trying to register to sipwise. There are so many attempts that the security ban tab is now returning an internal error. Is there a way to stop this or slow it down. I thought I remembered someone saying there was something that could be changed like returning a 200 ok on a ban. I am concerned about how this will impact sipwise since it is already showing signs of stress.
>
> Sent from my iPhone
> _______________________________________________
> Spce-user mailing list
> Spce-user at lists.sipwise.com
> http://lists.sipwise.com/listinfo/spce-user
>


  Look for the below in your 
/etc/ngcp-config/templates/etc/kamailio/lb/kamailio.cfg.customtt.tt2

change_reply_status("403", "Blocked, banned and reported");

  Now comment that out and insert this right below it

change_reply_status("200", "OK");

so now you should have...

#change_reply_status("403", "Blocked, banned and reported");
change_reply_status("200", "OK");


Save, then ngcpcfg apply and that should do it for you. This will 200 at 
ban time and hopefully throw off the scanner with an OK.

Skyler