Hello Aaron,
Normally I'm not checking the console but today I was seeing loads of login attempts to my SS users. I was seeing loads of lines like this:
Warn 16:35:38:052 sip1(11308): Authentication token check failed for realm=sipsorcery.com, username=XXXXXX, uri=sip:sipsorcery.com, nonce=21030478501116396773, method=REGISTER.
Where XXXXXX are my SS users.
Please check if there's some wrong some where.
Thanks.
Some strange Login Attempts. SIP Attack?
Re: Some strange Login Attempts. SIP Attack?
That log message is unusual and could indeed indicate an attempt to get unauthorised access to your accounts.
Provided you don't have weak passwords you don't have to worry about it, see http://www.sipsorcery.com/mainsite/Help ... rdSecurity.
However if the messages do continue then please PM me with your sipsorcery username and I'll take a look and if needs be can block the originating IP address.
Provided you don't have weak passwords you don't have to worry about it, see http://www.sipsorcery.com/mainsite/Help ... rdSecurity.
However if the messages do continue then please PM me with your sipsorcery username and I'll take a look and if needs be can block the originating IP address.
Re: Some strange Login Attempts. SIP Attack?
I've just changed all passwords just in case. Or at least, the ones that have Outbound access.
But, need to add something important. Some login attemps have been done over sip users I usually do not use. Which means that somebody is arbitrary scanning different sip users. I'm sure this is not only over my users as I've just suddenly discovered it in some special moment.
But, need to add something important. Some login attemps have been done over sip users I usually do not use. Which means that somebody is arbitrary scanning different sip users. I'm sure this is not only over my users as I've just suddenly discovered it in some special moment.