[Spce-user] SPCE Security alert

[Norbert Piper]

USE GEOIP ban instead of fail2ban

☺

Von: spce-user-bounces at lists.sipwise.com [mailto:spce-user-bounces at lists.sipwise.com] Im Auftrag von Tabi Tabe Tabi
Gesendet: Mittwoch, 30. April 2014 13:18
An: spce-user at lists.sipwise.com
Betreff: [Spce-user] SPCE Security alert

Hi,

I just realized one of my test SPCE servers is under heavy friendly scanner and SIPViscious attack. This happened 30 minutes after I exposed the server to the Internet. I found the following IP addresses in Banned IP:

1.       199.231.48.5
2.       188.138.4.216
3.       109.230.245.113
4.       31.3.240.251
5.       41.221.11.46
6.       46.165.220.215
7.       70.34..120.248
8.       79.143.83.4
     I am using iptables to drop the packets and have seen drop in resource utilization on the server.
Does any one have recommendation for implementation of fail2ban on SIPWise?

Thanks.

--
...Tabi

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20140430/586c14bc/attachment-0001.html>