LinuxMCE Forums

General => Users => Topic started by: Esperanto on November 14, 2014, 07:23:20 am

Title: LinuxMCE suddenly rings
Post by: Esperanto on November 14, 2014, 07:23:20 am
LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?

Code: [Select]
2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on November 14, 2014, 08:43:19 am
it rings every 10 minutes
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 19, 2014, 02:31:37 pm
LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?

Code: [Select]
2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00

Do you have an external trunk connected to a telecome provider? Can inbound external calls reach your system? It could be a auto-dialer from an external source. Another possibility is that you have accidentally created or triggered a 'rogue' telecom scenario or possibly created a scenario that accidentally calls the main call group every 10 mins.

Just some ideas....

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: ladekribs on November 21, 2014, 07:36:51 am
Do you have an extension with a very simple password, that might have been hacked?

BR Stefan
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on November 21, 2014, 02:33:26 pm
whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.

Fortunately it seems to have stopped ringing after a few reboots.

I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom

Code: [Select]
2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 22, 2014, 12:36:14 pm
whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.

Fortunately it seems to have stopped ringing after a few reboots.

I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom

Code: [Select]
2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01

A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen. If they do with the external trunk to your telecom provider disabled then you know that the cause is something internal to your system.

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on November 24, 2014, 11:28:43 am
I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.
doesn't that previous message already answers that option?
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 24, 2014, 02:11:58 pm
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.

doesn't that previous message already answers that option?

Actually it does...I hadn't noticed you mentioned disabling your provider. Glad the rings have stopped...and I hope they don't return! Does the log still show similar call activity now?

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on November 24, 2014, 05:03:18 pm
Does the log still show similar call activity now?

Actually it does. Any ideas what might cause it?

Code: [Select]
2014-11-24 17:00:42 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:54:42 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:46:34 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:45:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-24 16:38:16 SIP 123456 Answer s ANSWERED 00:00
2014-11-24 16:34:15 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:32:12 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:28:30 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:26:25 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:19:48 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:19:47 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:18:42 SIP 27 Answer s ANSWERED 00:01
2014-11-24 16:17:49 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:14:12 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:14:11 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:13:06 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:08:48 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:08:27 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:08:26 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:04:03 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:03:46 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 15:59:01 SIP 102 Answer s ANSWERED 00:00
2014-11-24 15:57:14 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:57:13 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:56:17 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 15:51:42 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:51:41 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:49:10 SIP 102 Answer s ANSWERED 00:00
Title: Re: LinuxMCE suddenly rings
Post by: lemming86_au on November 25, 2014, 05:16:13 am
Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.

Regards,
Josh
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 25, 2014, 09:59:29 am
Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.

Regards,
Josh

Hmmm...well I don't think that can be it as he's disabled his telecom VOIP service provider. I guess they could be stupid hackers who can hack in but are too lazy to see if there's a working trunk/voip provider though!

...Esperanto why don't you run your Core for a period without a WAN side connection and see if the logs still indicate telecom activity?

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: lemming86_au on November 25, 2014, 10:50:12 am
Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.

The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.

If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.

Regards,
Josh
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 25, 2014, 11:18:28 am
Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.

The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.

If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.

Regards,
Josh

Agreed re it not needing a configured trunk. That's why i suggested disabling his WAN side connection to see if the call traffic went away.

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on November 26, 2014, 09:42:31 am
That's why i suggested disabling his WAN side connection to see if the call traffic went away.

That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging?  ;)

Code: [Select]
2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01
Title: Re: LinuxMCE suddenly rings
Post by: ladekribs on November 26, 2014, 10:07:24 am
same thing happened to me as far as I can see.
I had an extension used by a Siemens gigaset phone with password "12345" when I changed that password, the ringing stopped. so if I not total misunderstood, asterisk is open for communication to the extensions if you know the password and ID.

BR Stefan
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on November 26, 2014, 12:31:13 pm
That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging?  ;)

Code: [Select]
2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01

Well it looks like ladekribs who posted about his issue with Gigasets might have a solution for you...but it depends if your using Gigasets I guess. His issue does seem similar to your though I have to say.

All the best

Andy
Title: Re: LinuxMCE suddenly rings
Post by: tschak909 on December 01, 2014, 05:56:22 am
Guys, I can not stress this enough:

FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!

IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!

EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!

-Thom
Title: Re: LinuxMCE suddenly rings
Post by: ladekribs on December 01, 2014, 01:27:24 pm
Thank You for the advice Thom,

"FIREWALL OFF PORT 5060" how is that best done?

Br Stefan.
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on December 03, 2014, 11:35:53 am
Guys, I can not stress this enough:

FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!

IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!

EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!

-Thom

Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.
Title: Re: LinuxMCE suddenly rings
Post by: totallymaxed on December 03, 2014, 01:07:13 pm
Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.

Hmmm...I'd tend to agree with that.
Title: Re: LinuxMCE suddenly rings
Post by: Marie.O on December 03, 2014, 02:46:13 pm
All passwords used to be identical to the extension. That had been rectified a couple of years ago.
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on December 14, 2014, 09:20:09 pm
Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4    input            tcp & udp      5060          DROP      Edit Delete

that does not help.

I tried renaming /usr/sbin/asterisk and that also does not help.

Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on December 21, 2014, 06:00:22 pm
Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4    input            tcp & udp      5060          DROP      Edit Delete

that does not help.

I tried renaming /usr/sbin/asterisk and that also does not help.
anyone?
Title: Re: LinuxMCE suddenly rings
Post by: Dap-P on December 23, 2014, 03:41:57 pm
You could try to use 'netstat' and see where these connections are coming from.

If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.


-Anton
Title: Re: LinuxMCE suddenly rings
Post by: Esperanto on December 29, 2014, 05:54:04 pm
You could try to use 'netstat' and see where these connections are coming from.

If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.

As intended by lmce I have the core as the router. As mentioned before, unplugging the internet cable stopped the ringing. I don't see anything special on netstat. what should I look for?