[Spce-user] security bans / 403 Errror

[Pascal Schwarz]

Hallo Daniel,

> grep "Consecutive Authentication Failure" kamailio-lb.log

root at viax00:/var/log/ngcp# grep "Consecutive Authentication Failure" 
kamailio-lb.log | wc -l
1249
root at viax00:/var/log/ngcp#

thats only entry from 01.08.2014
it all the same ia change the username to XXXXXXXXXXX

Jul 31 23:59:51 viax00 lb[6845]: WARNING: <script>: Consecutive 
Authentication Failure for 'XXXXXXXXXXX at voice.mtkom.de' UA='AVM FRITZ!Box 
7272 120.06.03 TAL (Feb  7 2014)' IP='82.206.74.185' -  R=<null> 
ID=AAEF7C33E85B415F at 82.206.74.185

Aug  1 00:00:33 viax00 lb[6845]: WARNING: <script>: Consecutive 
Authentication Failure for 'XXXXXXXXXXX at voice.mtkom.de' UA='AVM FRITZ!Box 
Fon WLAN 7390 84.06.04 TAL (Feb 10 2014)' IP='82.206.74.227' -  R=<null> 
ID=BBCBCEA04C88306F at 82.206.74.227

Aug  1 00:16:35 viax00 lb[6845]: WARNING: <script>: Consecutive 
Authentication Failure for 'XXXXXXXXXX at voice.mtkom.de' UA='Grandstream 
GXP2000 1.2.4.3' IP='217.140.73.162' -  R=<null> 
ID=16ad51adde8014d2 at 192.168.253.106

Aug  1 00:24:22 viax00 lb[6845]: WARNING: <script>: Consecutive 
Authentication Failure for 'XXXXXXXXXXX at voice.mtkom.de' 
UA='Linksys/SPA2102-3.3.6' IP='93.194.37.194' -  R=<null> 
ID=81840f46-eea3fc72 at 93.194.37.194

you see this problem is with other Hardware too.
we block the config-change at AVM so nobody can change username
and password and that user that here will be ban works afte delet ban 
entry some times fine .

> An option is to increase the number of attempt from 3 to 6 for ex.
but the user ask why more times every day he see 403 at the logile
auf his AVM . So thats must fix.


regards
pascal