IRC log for #asterisk on 20190129

00:06.04*** join/#asterisk MLC (~MLC@rrcs-98-6-21-229.sw.biz.rr.com)
00:13.43life_of_eIs Kamailio in front of Asterisk a useful thing for a very small phone system (just a few endpoints, one or two calls at a time) or is it really meant for larger systems like at a large business?
00:18.29*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
00:24.44sibiriain my opinion there's no real point to having a SIP proxy in front of a single asterisk system
00:25.01sibiriaSamot may offer a scenario where it would be useful
00:53.03*** join/#asterisk [TK]D-Fender (~joe@64.235.216.2)
01:02.18*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
01:03.20*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
01:06.23*** join/#asterisk Pegasus_RPG (~Thunderbi@71-222-100-80.lsv2.qwest.net)
01:22.33Pegasus_RPGHello. I have an * set up for federated voip and of course it's getting abused. 'sip show channels' shows tons of them from one IP address with a few appearing to be active outbound calls, from the g722 codec I'm seeing on those.
01:22.56Pegasus_RPGIs there a best-practices guide to federated voip security? I'd rather not disable the feature.
01:26.58SamotDisable what feature?
01:27.17Pegasus_RPGFederated voip
01:27.29SamotThat's not a feature.
01:27.33Pegasus_RPGI.e. calling my users by e-mail address
01:27.43Pegasus_RPGwithout using the PSTN
01:27.57SamotThat's standard SIP.
01:28.17SamotWhen you say email address are you just referring to a format?
01:28.21Pegasus_RPGYes, I know, I meant "feature" in the abstract sense.
01:28.30SamotOr are you using actual NAPTR to convert it?
01:29.43Pegasus_RPGI'm using NAPTR
01:30.10SamotOK so you're using their email to lookup a SIP URI...
01:30.39SamotAsterisk doesn't care about emails. So by the time Asterisk has the call it's a SIP URI.
01:30.45Pegasus_RPGOf course
01:31.06SamotSo how have you secured your Asterisk box thus far?
01:31.13[TK]D-Fenderappearing to be active outbound calls <- look at your actual channel list
01:31.17[TK]D-Fendernot driver channel
01:31.24[TK]D-Fenderbecause that holds misc comms.
01:31.43[TK]D-Fendernot exclsively actual calls that were accepted and processing
01:33.16Pegasus_RPGah okay
01:33.25SamotWhat security do you have in place now?
01:33.47SamotBecause "Federated VoIP" is no different than "Regular VoIP" when it comes to securing Asterisk overall.
01:34.03SamotThere may be some tweaks for some of the extra services but INVITEs are INVITes.
01:34.11[TK]D-FenderThere is no Federation.  The Klingons destroyed it ages ago...
01:35.15Pegasus_RPGNot much unfortunately. A firewall, fail2ban running on the * box, and non-numeric extensions.
01:35.18[TK]D-Fender"Random attackers" sending you calls igoing to "just happen".  Legit people don't magically come up with the idea of guessing you have a SIP server and can address calls to you .. let alone pass you calls targeting #'s that should go "out"
01:35.39SamotDo you have Asterisk setup to accept calls from any source?
01:35.39[TK]D-FenderYou should be looking for the SIP debug of these...
01:35.52SamotOr are you limiting calls to known sources?
01:35.58[TK]D-Fender<Samot> Do you have Asterisk setup to accept calls from any source? <- because this is what I'm pretty much sure is the case
01:36.32Pegasus_RPGyes, allowguest=yes
01:36.39[TK]D-Fender= fail
01:36.40SamotWell that's problem #1.
01:36.48Pegasus_RPGIsn't that required for direct SIP comms?
01:36.53[TK]D-Fendertath = no fail2ban
01:37.08[TK]D-Fenderwhat does "direct" mean?
01:37.21[TK]D-FenderYou use a lot of dubious terms....
01:37.27SamotNo..
01:37.33SamotThis is a 15 year ago setup
01:37.42Pegasus_RPGAllowing someone with a SIP phone and nothing else to be able to call me using my email address.
01:37.50SamotThat a subset of SIP people insist is the way to go
01:38.04[TK]D-Fendernever call it an "e-mail address"
01:38.06[TK]D-Fenderit isn't
01:38.18Pegasus_RPGI know, it's a SIP URI
01:38.25[TK]D-FenderAre you expecting calls specifically from these people?
01:38.31SamotWait.
01:38.44SamotPegasus_RPG: What format are they using to call you?
01:39.01Pegasus_RPGsip:me@example.com
01:39.05[TK]D-FenderIf you allow ANY random person to call you then there is no fail2ban pretty much
01:39.18SamotOK so yeah, that's what I asked earlier..
01:39.46SamotThis whole ENUM, "Federation VoIP" stuff failed 15+ years ago.
01:39.51[TK]D-Fenderunless you accept all calls with a catch-all that manually logs it as a failure if they ask for a # you didn't specifically match otherwise
01:40.02SamotThis is just some die hard group that wants SIP a certain way..
01:40.53Pegasus_RPGideology aside, though it's not currently required in my setup, I want to offer people the ability to call me with nothing more than my E-mail address
01:41.07SamotIt's not an email address.
01:41.09Pegasus_RPGAre you saying that's not really realistic or am i just doing it wrong?
01:41.13SamotPlease stop calling it that.
01:41.34Pegasus_RPGokay okay
01:41.44SamotBecause with ENUM and NAPTR you actually can convert me@email.com to sip:me@email.com:5060
01:41.57[TK]D-FenderI've already answered that
01:42.05[TK]D-Fender<[TK]D-Fender> unless you accept all calls with a catch-all that manually logs it as a failure if they ask for a # you didn't specifically match otherwise
01:42.10SamotIt's not realistic.
01:42.18[TK]D-FenderAnd then you'll ban people who "typo" a name
01:43.06SamotFederation VoIP is the SIP version of HAM Radio basically.
01:44.19Pegasus_RPGI don't know much about HAM radio, but I'm thinking of it as essentially p2p calling instead of having to use the PSTN
01:44.35Pegasus_RPGor other central control service a la Skype or what have you
01:44.40SamotRight so both sides need the ability to do that
01:44.44SamotThe average person does not.
01:44.55[TK]D-FenderYou've got your answer.  Get ready to start logging all of this yourself and running your own firewall
01:44.56SamotThe average VoIP user isn't doing SIP URI dialing.
01:45.02SamotThey are dialing phone numbers.
01:45.32Pegasus_RPG[TK]D-Fender: yes, thank you. I am now just trying to correct my understanding
01:45.39SamotPeople doing direct SIP URI dialing or P2P calling is akin to HAM Radio because all parties have to be setup for it.
01:46.06[TK]D-FenderIf you want to let the world throw calls at you then the whole world can ... including people you don't want.
01:46.20SamotThey either need a direct route/connection or in this case an ENUM system to do the lookup and routing conversion.
01:46.27[TK]D-FenderCan't call it a "fail" and thus "ban" it ... if nothing qualifies as a "fail".
01:46.41SamotThis is basically IP tables.
01:46.58Pegasus_RPG[TK]D-Fender: of course. The problem I'm currently having is essentially resource starvation. It looks like people are somehow getting calls out, though I'll check 'core show channels' the next time it happens
01:47.03SamotYou're going to have to setup rate limiting and drop traffic that doesn't fit criteria.
01:47.16[TK]D-Fenderare they?  You haven't shown anything that proves they got "out"
01:47.17SamotBecause you have allowguests=yes
01:47.28SamotYou have no method of authing your callers I'm guessing..
01:47.39[TK]D-Fender"allowguests" should still never ALLOW them to go "out"
01:47.49Pegasus_RPGI do have a script that checks inbound requests for matches in the voicemail table
01:47.58[TK]D-Fendereven if the SIP call is not rejected on auth terms they should not succeed in going "out"
01:48.01SamotNo but I'm sure the rest of the setup is lacking any validation checks.
01:48.14[TK]D-Fenderif you set your system up sanely at all that is
01:48.48[TK]D-FenderYou wouldn't have done something so suicidal as pointing the [general] context to somewhere USEFUL would you?
01:49.33Pegasus_RPGNo, just to a context that validates the request
01:50.06Pegasus_RPGcalling Congestion() if there's no match
01:51.09Pegasus_RPGhttp://paste.debian.net/hidden/5e4eb975/  if you're intersted
01:51.30*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
01:51.30[TK]D-FenderThen show us that they actually made it "out" like You worded it.
01:52.07Pegasus_RPGyes, I'm waiting for them to try again. I had blocked the offending IP at the firewall before I jumped in here. Lifted it a few minutes ago
01:52.09[TK]D-FenderOr amend your previous description.
01:52.26[TK]D-FenderYo should have logging of basic CLI execution which would prove it
01:52.41[TK]D-Fenderand CDR which could also be used to do those searches for the full log
01:53.59Pegasus_RPGoops forgot to apply. Wow that didn't take long.
01:54.02Pegasus_RPG147.135.9.77     3330             1525612160-1773  (alaw)           No       Rx: INVITE                 <guest>
01:54.58[TK]D-Fendertht isn't a READ channel
01:55.01[TK]D-FenderREAL
01:55.06[TK]D-Fender"core show channels"
01:55.44[TK]D-FenderI can throw an invite that is either not accepted or not processing any longer and it'd STILL show up in "sip show channels"
01:56.02[TK]D-FenderStop doing the wrong tests.
01:56.20Pegasus_RPGcore show channels has nothing right now.
01:56.28[TK]D-Fender"not a call in progress"
01:56.38[TK]D-Fenderwhere the logging for this?
01:56.44Pegasus_RPG(it's hard to read the results due to the massive number of warning messages being logged to the console.)
01:57.21[TK]D-FenderWhy would there be a massive # of them?
01:57.26[TK]D-FenderWhat do they say?
01:57.42Pegasus_RPGres_rtp_asterisk.c: Unable to allocate RTP socket: Too many open files
01:57.52Pegasus_RPGDoS effectively
01:58.21Pegasus_RPGand  chan_sip.c: Failed to authenticate device <sip:3370@myserversip>;tag=1978222027
01:58.33[TK]D-FenderSounds like you should be blobking those....
01:59.12Pegasus_RPGI agree. I need to find out how
01:59.52Pegasus_RPGsearches Web for the latter message
02:01.26Pegasus_RPGThank you, stackoverflow
02:01.42[TK]D-FenderWhat version are you running?
02:02.20Pegasus_RPGoh also acl.c: Cannot create socket to 147.135.9.77: Too many open files  (that's the attacker's IP)
02:03.06Pegasus_RPG*cough* 13.14   I'm afraid I'll need to build from source as the distro's package manager is not keeping up
02:03.33[TK]D-FenderThat's new enough to support proper security logging for those ath failures for fail2ban to hit
02:03.56[TK]D-Fenderthen you need to do your own dialplan logging for that ones where they aren't claiming to come from one of your defined peers
02:06.03*** join/#asterisk kunwon1 (~kunwon1@unaffiliated/kunwon1)
02:07.55Pegasus_RPGI thought I did. But the security log is not showing anything on those failures
02:08.31Pegasus_RPGI do get some Failed ACL items
02:09.12Pegasus_RPGBut nothing when that "chan_sip.c: Failed to authenticate device" is logged to the console
02:09.54[TK]D-FenderThen something isn't being done right
02:09.59Pegasus_RPGI have just "security" being logged to the security file
02:10.08[TK]D-FenderAnd the speed and level of detail we're getting this as isn't looking promising
02:10.31[TK]D-FenderKeep looking and readin on it till you see what's happening...
02:12.37Pegasus_RPGI hesitate to just pipe all warning level messages to security
02:15.32Pegasus_RPGThank you very much for all of your help and patience.
02:18.14Pegasus_RPGokay, so basically, I'd like messages of the form NOTICE[10503][C-0007f1f3] chan_sip.c: Call from '' (147.135.9.77:54802) to extension '+443331010050' rejected because extension not found in context 'unauthenticated'.    to go to the security log
02:18.46Pegasus_RPGthen I have to add a filter to fail2ban to snag those
02:23.41[TK]D-Fenderthey don't
02:23.51[TK]D-Fenderbecause it isn't a SECURITY failure
02:24.02[TK]D-Fenderand I've already described what you have to do
02:25.05Pegasus_RPGyeah, I'm looking up how to do that now, thank you again
02:44.34*** join/#asterisk kunwon1 (~kunwon1@unaffiliated/kunwon1)
02:54.57Pegasus_RPGgot it, actually did have to just add notice to the security log. fal2ban already has rules for this case
02:55.04Pegasus_RPGs/rules/filters/
02:56.34*** join/#asterisk Pegasus_RPG (~Thunderbi@71-222-100-80.lsv2.qwest.net)
03:58.58*** join/#asterisk lankanmon (~LKNnet@CPE64777d632383-CM64777d632380.cpe.net.cable.rogers.com)
04:15.06*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
04:28.28*** join/#asterisk Pegasus_RPG (~Thunderbi@71-222-100-80.lsv2.qwest.net)
04:45.12*** join/#asterisk cemotyz09_ (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
05:24.13*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
05:25.09*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
05:25.40*** join/#asterisk cemotyz09 (~cemotyz09@cpe-70-121-128-59.satx.res.rr.com)
05:31.14*** join/#asterisk Downlots (~Downlots@2a02:85f:1f01:b400:ddf3:4d84:ea7f:41b0)
05:55.28*** join/#asterisk gerhard7 (~gerhard7@ip5657ee30.direct-adsl.nl)
06:07.57*** join/#asterisk Downlots (~Downlots@ppp185145165108.access.hol.gr)
07:13.42*** join/#asterisk jkroon (~jkroon@165.16.203.57)
07:19.02*** join/#asterisk pchero_work (~pchero@87.213.240.121)
07:26.00*** join/#asterisk esteban (~esteban@gateway/tor-sasl/esteban)
08:23.15*** join/#asterisk Downlots (~Downlots@185.73.41.1)
09:23.38*** join/#asterisk Chainsaw (~chainsaw@gentoo/developer/chainsaw)
09:27.04*** join/#asterisk esteban (~esteban@gateway/tor-sasl/esteban)
09:41.24*** join/#asterisk bhuddah (~michael@unaffiliated/bhuddah)
10:13.59*** join/#asterisk TriJetScud (~TriJetScu@van-mig-svr.ad.v10networks.ca)
10:41.54*** join/#asterisk duo_kali (b61e5a84@gateway/web/freenode/ip.182.30.90.132)
10:42.12*** join/#asterisk hehol (~hehol@gatekeeper.loca.net)
10:56.34*** join/#asterisk Jesterboxboy (~Thunderbi@84-115-150-8.cable.dynamic.surfer.at)
11:23.11*** join/#asterisk Jesterboxboy (~Thunderbi@84-115-150-8.cable.dynamic.surfer.at)
12:17.27*** join/#asterisk lankanmon (~LKNnet@CPE64777d632383-CM64777d632380.cpe.net.cable.rogers.com)
12:29.24*** join/#asterisk miralin (~Thunderbi@81.177.57.153)
13:29.12*** join/#asterisk rpifan (~rpifan@ipb218f1de.dynamic.kabel-deutschland.de)
13:33.57*** join/#asterisk MLC (~MLC@63.249.40.11)
13:37.55*** join/#asterisk Janos (~Janos@201.204.94.76)
13:43.46*** join/#asterisk gerhard7 (~gerhard7@ip5657ee30.direct-adsl.nl)
14:04.53*** join/#asterisk brad_mssw (~brad@66.129.88.50)
14:10.28*** join/#asterisk LoKoMurdoK (~LoKoMurdo@fedora/LoKoMurdoK)
14:26.25*** join/#asterisk [TK]D-Fender (~joe@216.191.106.165)
14:53.41*** join/#asterisk MLC (~MLC@63.249.40.11)
15:22.52*** join/#asterisk MLC (~MLC@63.249.40.11)
15:23.49*** join/#asterisk cresl1n (uid299068@asterisk/libpri-and-libss7-expert/Cresl1n)
15:23.49*** mode/#asterisk [+o cresl1n] by ChanServ
15:35.07*** join/#asterisk kharwell (kharwell@nat/digium/x-thbrkkltgkazkqen)
15:35.07*** mode/#asterisk [+o kharwell] by ChanServ
15:39.44*** join/#asterisk bford (uid283514@gateway/web/irccloud.com/x-frwdxmkvruehhrbn)
15:39.44*** mode/#asterisk [+o bford] by ChanServ
15:39.45*** join/#asterisk rmudgett (rmudgett@nat/digium/x-mtepwhdueymxysgf)
15:39.45*** mode/#asterisk [+o rmudgett] by ChanServ
15:48.48*** join/#asterisk Pegasus_RPG (~Thunderbi@71-222-100-80.lsv2.qwest.net)
16:00.46*** join/#asterisk cranq (~crank@107.161.164.124)
16:34.42*** join/#asterisk salviadud (~ralfalfa@187-162-213-198.static.axtel.net)
17:02.46*** join/#asterisk jkroon (~jkroon@165.16.204.40)
17:08.44*** join/#asterisk rpifan (~rpifan@ipb218f0f4.dynamic.kabel-deutschland.de)
17:09.32*** join/#asterisk rpifan (~rpifan@ipb218f0f4.dynamic.kabel-deutschland.de)
17:13.23*** join/#asterisk [J]oules (uid223833@gateway/web/irccloud.com/x-vqhwkyhrzlasbhvt)
18:14.06*** join/#asterisk rpifan (~rpifan@ipb218f031.dynamic.kabel-deutschland.de)
18:26.09*** join/#asterisk alexandre9099 (~alexandre@unaffiliated/alexandre9099)
18:27.30*** join/#asterisk _0x5eb_ (~seb@seb-hpws2.elen.ucl.ac.be)
18:36.10*** join/#asterisk defsdoor (~Andrew@cpc120600-sutt6-2-0-cust232.19-1.cable.virginm.net)
18:54.12*** join/#asterisk rpifan_ (~rpifan@45.77.199.32)
19:01.13*** join/#asterisk jeffspeff (~jeffspeff@12.49.160.131)
19:17.14jeffspeffin my dialplan, i have "exten=s,n,GotoIf("$[${LEN(${USER_PIN})}" = "0"]?,hangup)" and then further down in the same context i have "exten=s,n(hangup),Hangup()" ...  when USER_PIN was evaluated I get the following in my * console --- "Cannot find extension '' in context 'INBOUND'"   and  "Priority 'hangup' must be a number > 0, or valid label"
19:24.16SamotWell I can see you have incorrect syntax.
19:24.28Samotexten=s
19:24.38Samot^^ bad.
19:24.43Samotexten => s
19:24.47Samot^^ good
19:24.53jeffspeffi thought => was legacy
19:24.58SamotNo.
19:24.58jeffspeff1.x stuff
19:25.01*** join/#asterisk cranq (~crank@107.161.164.124)
19:25.09SamotNot at all.
19:25.50jeffspeffok. other than that. do you see any issues?
19:25.51SamotGotoIf("$[${LEN(${USER_PIN})}" = "0"]?,hangup) <-- You don't need the comma.
19:26.39jeffspeffI want the call to proceed to the next n if the condition is false or hangup if true.
19:26.53SamotOK then that's completely wrong.
19:27.15jeffspeffgotoif...]?true,false) right?
19:27.26SamotGotoIf("$[${LEN(${USER_PIN})}" = "0"]?hangup:)
19:27.31Samottrue:false
19:27.46jeffspeffi had it backwards
19:27.54SamotPlus you had a ,
19:27.56SamotNot a :
19:28.07jeffspeffah
19:28.20SamotSince you can have ?context,exten,priority:context,exten,priority
19:28.35jeffspeffthanks for the help
19:29.15jeffspeffdo you know how that would be evaluated if if USER_PIN is null?
19:29.31jeffspeffthat var is grabbed from func_odbc.
19:30.23jeffspeffor would it better to do GotoIf($["${USER_PIN}" = ""]?h) ?
19:33.53[TK]D-FenderDon't go jumping to H
19:34.01[TK]D-Fenderor you risk double execution
19:51.52*** join/#asterisk troyt (zncsrv@2601:681:4100:8981:44dd:acff:fe85:9c8e)
19:55.46rmudgettSamot: Asterisk doesn't care if you use 'exten = s,..' or 'exten => s,..'
19:56.45*** join/#asterisk FF2456 (~FF@198.245.97.90)
20:01.16FF2456Hello, everyone. I am running FreePBX 13.0.195.26 with a TDM400P card (4 FXO) and I am not able to receive any calls on it. I plugged in a regular phone and it is working properly. The 4 FXO channels show up under Connectibity -> Dahdi config -> Analog Hardware, but the output of 'dahdi show channels' results in 1 channel identified as pseudo. Where should I start troubleshooting this matter? Thanks in advance for any help.
20:05.54[TK]D-Fender~freepbx
20:05.54infobot[~freepbx] FreePBX is unable to be supported here. It is made up of complex dialplans and scripts which can't be easily supported by people who aren't deeply involved. Try joining #freepbx and asking there
20:06.09FF2456ok, thanks
20:06.42*** part/#asterisk FF2456 (~FF@198.245.97.90)
20:07.51*** join/#asterisk Jesterboxboy (~Thunderbi@84-115-150-8.cable.dynamic.surfer.at)
20:34.03*** join/#asterisk troyt (zncsrv@2601:681:4100:8981:44dd:acff:fe85:9c8e)
23:03.26*** join/#asterisk yeehi (~n@unaffiliated/yeehi)
23:09.33*** join/#asterisk tomaluca95 (~quassel@kde/developer/tomaluca)
23:23.02*** join/#asterisk zaf (~zaf@104.254.192.70)
23:28.31*** join/#asterisk Janos (~Janos@201.204.94.76)
23:57.40*** join/#asterisk paulgrmn (~paulgrmn@162.219.176.22)

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.