From 47b063b022d45013bfbff4c23d4e01ccee16c4c1 Mon Sep 17 00:00:00 2001 From: Carlos Alberto Lopez Perez Date: Mon, 10 Jun 2013 19:41:13 +0200 Subject: [PATCH 1/2] Filter Asterisk: Add AUTH_UNKNOWN_DOMAIN error to list * I have been seeing bruteforcing attempts where asterisk fails with AUTH_UNKNOWN_DOMAIN (Not a local domain) --- config/filter.d/asterisk.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/filter.d/asterisk.conf b/config/filter.d/asterisk.conf index 589a188c..c1b3dcab 100644 --- a/config/filter.d/asterisk.conf +++ b/config/filter.d/asterisk.conf @@ -26,6 +26,7 @@ failregex = NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '(:[0-9]+)?' - Device does not match ACL$ NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '(:[0-9]+)?' - Peer is not supposed to register$ NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '(:[0-9]+)?' - ACL error \(permit/deny\)$ + NOTICE%(__pid_re)s [^:]+: Registration from '[^']*' failed for '(:[0-9]+)?' - Not a local domain$ NOTICE%(__pid_re)s\[[^:]+\] [^:]+: Call from '[^']*' \(:[0-9]+\) to extension '[0-9]+' rejected because extension not found in context 'default'.$ NOTICE%(__pid_re)s [^:]+: Host failed to authenticate as '[^']*'$ NOTICE%(__pid_re)s [^:]+: No registration for peer '[^']*' \(from \)$ From 7248ef4564d3ad3b8c24ac17b4caa666c79f2122 Mon Sep 17 00:00:00 2001 From: Carlos Alberto Lopez Perez Date: Tue, 11 Jun 2013 02:08:26 +0200 Subject: [PATCH 2/2] Filter Asterisk: Add sample log entry to testcase. * Sample log entry for AUTH_UNKNOWN_DOMAIN (Not a local domain) --- testcases/files/logs/asterisk | 1 + 1 file changed, 1 insertion(+) diff --git a/testcases/files/logs/asterisk b/testcases/files/logs/asterisk index 667eee02..45b69304 100644 --- a/testcases/files/logs/asterisk +++ b/testcases/files/logs/asterisk @@ -12,3 +12,4 @@ [2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0972598285108' rejected because extension not found in context 'default'. [2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found [2013-05-13 07:10:53] SECURITY[1204] res_security_log.c: SecurityEvent="InvalidAccountID",EventTV="1368439853-500975",Severity="Error",Service="SIP",EventVersion="1",AccountID="00972599580679",SessionID="0x7f8ecc0421f8",LocalAddress="IPV4/UDP/1.2.3.4/5060",RemoteAddress="IPV4/UDP/1.2.3.4/5070" +[2013-06-10 18:15:03] NOTICE[2723] chan_sip.c: Registration from '"100"' failed for '1.2.3.4' - Not a local domain