Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-25 Thread Paul Hayes
On 23/07/11 04:48, Bruce B wrote: Quote,/How do the users register to begin with, if their REGISTER requests won't be processed unless their IP is already known to be a registrant? :-)/ Well, unfortunately I don't have the luxury of knowing their IP and the closest I know is their IP range.

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-23 Thread Mitesh Thakkar
I think fail2ban can help in this issue. Regards, Mitesh Thakkar +91 94279 07952 Yahoo: miteshthakkar...@yahoo.co.in GTalk: mail.mthak...@gmail.com On Sat, Jul 23, 2011 at 10:04 AM, Bruce B bruceb...@gmail.com wrote: Robert thanks for weighing in. So, you are saying that FreeSwitch on it's

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-23 Thread Bruce B
Not really. It's only good after DECLINED is sent. On Sat, Jul 23, 2011 at 2:08 AM, Mitesh Thakkar mail.mthak...@gmail.comwrote: I think fail2ban can help in this issue. Regards, Mitesh Thakkar +91 94279 07952 Yahoo: miteshthakkar...@yahoo.co.in GTalk: mail.mthak...@gmail.com On Sat,

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-23 Thread Paul Belanger
On 11-07-23 12:34 AM, Bruce B wrote: Robert thanks for weighing in. So, you are saying that FreeSwitch on it's own can tackle issues like this without the need of OpenSIPs? Can you elaborate please? If true, I'd be curious to see how they accomplish it. I've never tried FreeSwitch but as

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-23 Thread Patrick Lists
On 07/23/2011 04:00 PM, Paul Belanger wrote: A UAS rejecting an offer contained in an INVITE SHOULD return a 488 (Not Acceptable Here) response. Such a response SHOULD include a Warning header field value explaining why the offer was rejected. If the choice is to get hacked/DDOS'ed/etc or

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-23 Thread Paul Belanger
On 11-07-23 11:48 AM, Patrick Lists wrote: On 07/23/2011 04:00 PM, Paul Belanger wrote: A UAS rejecting an offer contained in an INVITE SHOULD return a 488 (Not Acceptable Here) response. Such a response SHOULD include a Warning header field value explaining why the offer was rejected. If the

[asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Bruce B
Hello, I am wondering if there is a way to drop SIP packets for generic transactions? For example, only SIP PEERs are allowed to call in and receive ACK or Declined rather that those inviting a call who are not PEERs at all. Currently my Asterisk setup sends, *SIP/2.0 603 Declined *to any

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Alex Balashov
On 07/22/2011 07:32 PM, Bruce B wrote: Hello, I am wondering if there is a way to drop SIP packets for generic transactions? For example, only SIP PEERs are allowed to call in and receive ACK or Declined rather that those inviting a call who are not PEERs at all. Currently my Asterisk setup

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Bruce B
Thanks for the input. I am really surprised. But yes, I want exactly what firewall does, DROP packet instead of REJECTING it. So, you are saying that one has to tamper the SIP stack to add the option to not respond to un-trusted sources? I really thought Asterisk might have this built in as a

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Alex Balashov
Asterisk does not expose low-level control of its SIP stack. It's something intended to be configured and used at the application level. If you really want to do this without a firewall, put a Kamailio proxy in front of your Asterisk install and drop things as you see fit. But why go through

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Paul Belanger
On 11-07-22 07:32 PM, Bruce B wrote: Hello, I am wondering if there is a way to drop SIP packets for generic transactions? For example, only SIP PEERs are allowed to call in and receive ACK or Declined rather that those inviting a call who are not PEERs at all. Currently my Asterisk setup

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Alex Balashov
Paul, Won't that just send a 403 Forbidden? -- Alex Balashov - Principal Evariste Systems LLC 260 Peachtree Street NW Suite 2200 Atlanta, GA 30303 Tel: +1-678-954-0670 Fax: +1-404-961-1892 Web: http://www.evaristesys.com/ On Jul 22, 2011, at 9:48 PM, Paul Belanger pabelan...@digium.com wrote:

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Paul Belanger
On 11-07-22 09:51 PM, Alex Balashov wrote: Paul, Won't that just send a 403 Forbidden? I believe so, but I was proposing a different SIP message then 603 Declined. As you mentioned, a firewall is the real solution if OP wants to drop packets. Asterisk is a B2BUA, not a firewall. -- Paul

Re: [asterisk-users] Securing Asterisk - How to avoid sending, SIP/2.0 603 Declined

2011-07-22 Thread Bruce B
Robert thanks for weighing in. So, you are saying that FreeSwitch on it's own can tackle issues like this without the need of OpenSIPs? Can you elaborate please? Thanks On Sat, Jul 23, 2011 at 12:17 AM, Robert-iPhone rhuddles...@gmail.comwrote: I like to put mine on 3389 hahaha just