Koozali.org: home of the SME Server

Obsolete Releases => SME VoIP (Asterisk, SAIL etc) => Topic started by: fred2k3 on April 04, 2013, 01:47:09 PM

Title: Inbound SIP calls - fake auth rejection
Post by: fred2k3 on April 04, 2013, 01:47:09 PM

I have setup an inbound SIP trunk on SAIL 3.1.1-22 but am getting the following error:

[NOTICE[3408] chan_sip.c: Sending fake auth rejection for device <sip:07*********@213.166.5.166>;tag=6976142C-24DA

Here are the Peer config settings I've got set for the Trunk:

Code: [Select]

type=peer
host=newsip.[sip provider].net
qualify=3000
canreinvite=no
username=
fromuser=
secret=
insecure=port,invite
allowguest=yes
context=from-sip-external
disallow=all
allow=g729
allow=alaw
allow=ulaw
Any ideas?

Title: Re: Inbound SIP calls - fake auth rejection
Post by: fred2k3 on April 04, 2013, 07:05:19 PM

Ok.. the problem was I needed allowguest=yes in sark_customer_sip_header.conf

This isn't good from a security point of view though is it?

Title: Re: Inbound SIP calls - fake auth rejection
Post by: apmuthu on April 06, 2013, 02:38:18 PM

The shorewall and / or upstream firewall are supposed to protect you besides OSSEC in SME8.

Title: Re: Inbound SIP calls - fake auth rejection
Post by: fred2k3 on April 08, 2013, 12:13:23 PM

Ah Right, I've tried to find some more information on these but coming up dry. Are there any articles about setting them up, or indeed anything on security specifically for SAIL? I've found a few articles on Asterisk, but I'm having a hard to finding any on SAIL other than sailpbx.com which is good but limited.

Title: Re: Inbound SIP calls - fake auth rejection
Post by: apmuthu on April 08, 2013, 01:45:22 PM

The SailPBX Wiki has a nice article on VoIP Security (http://www.sailpbx.com/mediawiki/index.php/VOIP_security_-_READ_THIS!).
 
OSSEC is part of the ISO based install.
Try the v4.0 SME8 ISO  (http://sailpbx.com/iso/SME8/sail-4.0.0/SME8FA18V400-beta1.iso)and then upgrade to v4.0.0-58 and post release fixes in this forum.
 
Alternatively, OSSEC rpm / tar.gz can be taken from the ISO and installed manually.
 

Title: Re: Inbound SIP calls - fake auth rejection
Post by: SARK devs on April 08, 2013, 10:57:49 PM

Hi there

Code: [Select]

allowguest=yes
is very bad.  Ap.Muthu is also correct in that OSSEC will do its best to protect you but you really must turn off allowguest=yes.  To solve your problem simply create a DDI/DiD trunk using the number which your sip provider has allocated to you.  This will either be an account number or a dialable PSTN number.  Whichever it is,  that will solve the rejection issue and you will still be fairly safe from the baddies....  and there are lots of baddies so take care.


Best

S