| 04:54.30 | *** join/#asterisk-doc jsmith` (~jsmith@234.81.233.72.static.reverse.ltdomains.com) |
| 04:54.30 | *** join/#asterisk-doc Juggie (~Juggie@unaffiliated/juggie) |
| 04:55.43 | *** join/#asterisk-doc Alric (~nbowyer@64.6.54.218) |
| 04:58.54 | *** join/#asterisk-doc Alric (~nbowyer@64.6.54.218) |
| 04:58.54 | *** join/#asterisk-doc Juggie (~Juggie@unaffiliated/juggie) |
| 04:58.54 | *** join/#asterisk-doc jsmith` (~jsmith@234.81.233.72.static.reverse.ltdomains.com) |
| 06:21.42 | *** join/#asterisk-doc Juggie (~Juggie@unaffiliated/juggie) |
| 12:59.24 | *** join/#asterisk-doc jsmith (~jsmith@fedora/jsmith) |
| 12:59.24 | *** mode/#asterisk-doc [+o jsmith] by ChanServ |
| 13:00.02 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 13:51.58 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 14:07.39 | *** join/#asterisk-doc leifmadsen (~Leif@asterisk/documenteur-extraordinaire/blitzrage) |
| 14:07.39 | *** mode/#asterisk-doc [+o leifmadsen] by ChanServ |
| 14:14.10 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 15:00.47 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 15:36.45 | Alric | waves. |
| 15:38.42 | leifmadsen | waves back |
| 15:51.07 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 16:10.59 | Alric | Ever mess with iptables rate limiting for sip port security? |
| 16:17.16 | *** join/#asterisk-doc Juggie` (~Juggie@CPE001601df17fb-CM001ceac25ada.cpe.net.cable.rogers.com) |
| 16:21.15 | jsmith | Rate limiting on UDP port 5060? |
| 16:21.20 | jsmith | Or on the RTP ports? |
| 16:21.32 | Alric | I'm thinking 5060 right now. |
| 16:21.42 | Alric | UDP 5060 |
| 16:22.12 | jsmith | If you're going to do that, at least do it *per IP*, and not globally |
| 16:24.09 | Alric | The problem I'm running into is that I get basically hammered with registration requests. I block these manually in iptables, but I tire of this exercise. So far I don't like the idea of rate limiting. It seems easy to catch good traffic, but I also think I can identify all of my sources of large, good traffic, so that may be a mitigating circumstance. |
| 16:24.36 | seanbright | fail2ban |
| 16:25.49 | jsmith | Alric: fail2ban, or specifically rate limit the REGISTER requests :-p |
| 16:26.09 | Alric | Well that is the trick, isn't it? :) |
| 16:26.27 | Alric | I haven't found a way to isolate REGISTER requests with tools available to iptables. |
| 16:26.39 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 16:26.45 | jsmith | Hence you're forced to use a sub-optimal tool like fail2ban |
| 16:26.52 | jsmith | Just don't ban yourself :-p |
| 16:26.53 | Alric | I had looked at fail2ban. Seems like I ruled it out for some reason, but looking back at it I'm wondering why. |
| 16:28.38 | Alric | WHy do you call fail2ban sub-optimal? |
| 16:29.15 | jsmith | Because it a more optimal solution would look at Asterisk events, and not simply the output of Asterisk logs |
| 16:29.36 | jsmith | That being said, since we don't yet have a great Asterisk security subsystem, fail2ban is about as good as it gets for now |
| 16:30.37 | Alric | When you say Asterisk events, do you mean Manager events? |
| 16:35.26 | Alric | ANd would it be an asterisk module? |
| 16:37.59 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 16:38.54 | jsmith | Alric: No, Asterisk security events. |
| 16:40.11 | Alric | Is that a real thing or a design idea at this point? |
| 16:40.17 | Alric | hasn't heard of asterisk security events. |
| 16:43.35 | seanbright | they exist |
| 16:43.42 | seanbright | maybe only for sip right now |
| 16:43.52 | seanbright | and maybe only in 1.8 and trunk |
| 16:44.39 | Alric | How would one collect those events? |
| 16:45.32 | Alric | Or is there some kind of docs that cover these events? |
| 16:48.05 | russellb | fail2ban seems to work great |
| 16:48.11 | russellb | the security events stuff isn't usable right now |
| 16:48.16 | russellb | chan_sip doesn't generate any events |
| 16:48.37 | Alric | Ahh ok |
| 16:56.46 | jsmith | Alric: Nothing like being stuck between a rock (a perfect theoretical future) and a hard place (what we have today)... |
| 16:59.59 | russellb | :-) |
| 17:00.02 | russellb | indeed. |
| 17:00.22 | russellb | and after setting up fail2ban and seeing how easy it was, i'm even less motivated to try to finish the security events thing |
| 17:00.24 | Alric | I thought perfect theoretical futures were always in the future :D |
| 17:00.34 | russellb | I guess there is still value in it to get chan_sip to spit out more detailed information |
| 17:01.06 | seanbright | russellb: you guys write something about that in the new book? |
| 17:01.15 | russellb | security events? |
| 17:01.18 | russellb | or fail2ban? |
| 17:01.21 | russellb | fail2ban, yes |
| 17:01.27 | seanbright | fail2ban |
| 17:01.37 | seanbright | where can i take a gander? |
| 17:02.28 | russellb | http://ofps.oreilly.com/titles/9780596517342/ch25.html#Security_id36001183 |
| 17:02.36 | seanbright | nice, thanks |
| 17:10.31 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 17:10.43 | seanbright | oh nice. fail2ban looks sexy. |
| 17:10.51 | seanbright | primarily because it uses regex to match the log entries. |
| 17:11.54 | Alric | is bantime in seconds? |
| 17:14.18 | seanbright | yes |
| 17:15.07 | file | DIE YOU STUPID TELCO PROVIDED ROUTER DIE |
| 17:18.57 | Alric | is the section on SRTP available? |
| 17:19.37 | russellb | Alric: nope |
| 17:28.00 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 18:12.09 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 19:06.05 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 19:08.19 | *** join/#asterisk-doc snuff-home (~snuffy@203-219-29-182.tpgi.com.au) |
| 19:20.25 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 19:42.40 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 19:58.46 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 20:29.02 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 20:51.12 | *** join/#asterisk-doc jsmith-away (~jsmith@fedora/jsmith) |
| 20:51.12 | *** mode/#asterisk-doc [+o jsmith-away] by ChanServ |
| 20:58.36 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 21:16.20 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 21:44.25 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 21:56.14 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 22:10.21 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 22:21.10 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 22:49.45 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 23:11.52 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 23:22.19 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |
| 23:48.09 | *** join/#asterisk-doc MuffinMan (~muffinman@asterisk/issue-tracker-bot/muffinman) |