[Spce-user] Registration attack

[Jeremie Chism]

Thanks skyler. I will make those changes now. The attack was coming from an
IP block in France. We blocked the entire range.

On Wednesday, May 1, 2013, Skyler wrote:

> Hi Jeremie,
>
> On 5/1/2013 6:40 AM, Jeremie Chism wrote:
>
>> We are receiving an attack of someone that is continuously trying to
>> register to sipwise. There are so many attempts that the security ban tab
>> is now returning an internal error. Is there a way to stop this or slow it
>> down. I thought I remembered someone saying there was something that could
>> be changed like returning a 200 ok on a ban. I am concerned about how this
>> will impact sipwise since it is already showing signs of stress.
>>
>> Sent from my iPhone
>> ______________________________**_________________
>> Spce-user mailing list
>> Spce-user at lists.sipwise.com
>> http://lists.sipwise.com/**listinfo/spce-user<http://lists.sipwise.com/listinfo/spce-user>
>>
>>
>
>  Look for the below in your /etc/ngcp-config/templates/**
> etc/kamailio/lb/kamailio.cfg.**customtt.tt2
>
> change_reply_status("403", "Blocked, banned and reported");
>
>  Now comment that out and insert this right below it
>
> change_reply_status("200", "OK");
>
> so now you should have...
>
> #change_reply_status("403", "Blocked, banned and reported");
> change_reply_status("200", "OK");
>
>
> Save, then ngcpcfg apply and that should do it for you. This will 200 at
> ban time and hopefully throw off the scanner with an OK.
>
> Skyler
>
> ______________________________**_________________
> Spce-user mailing list
> Spce-user at lists.sipwise.com
> http://lists.sipwise.com/**listinfo/spce-user<http://lists.sipwise.com/listinfo/spce-user>
>


-- 
Jeremie Chism
Triton Communications
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20130501/b0a0498b/attachment-0001.html>