Hi, I am starting to see a lot of these: [Jan 10 01:18:56] NOTICE[5627] chan_sip.c: Call from '' to extension '33155786056' rejected because extension not found. [Jan 10 01:52:47] NOTICE[5627] chan_sip.c: Call from '' to extension '033155786056' rejected because extension not found. [Jan 10 02:26:36] NOTICE[5627] chan_sip.c: Call from '' to extension '0#33155786056' rejected because extension not found. [Jan 10 03:00:30] NOTICE[5627] chan_sip.c: Call from '' to extension '0033155786056' rejected because extension not found. [Jan 10 03:34:53] NOTICE[5627] chan_sip.c: Call from '' to extension '00#33155786056' rejected because extension not found. [Jan 10 04:09:22] NOTICE[5627] chan_sip.c: Call from '' to extension '00033155786056' rejected because extension not found. [Jan 10 04:43:51] NOTICE[5627] chan_sip.c: Call from '' to extension '000#33155786056' rejected because extension not found. [Jan 10 05:18:15] NOTICE[5627] chan_sip.c: Call from '' to extension '000033155786056' rejected because extension not found. [Jan 10 05:52:41] NOTICE[5627] chan_sip.c: Call from '' to extension '0000#33155786056' rejected because extension not found. [Jan 10 06:27:10] NOTICE[5627] chan_sip.c: Call from '' to extension '001033155786056' rejected because extension not found. [Jan 10 07:01:37] NOTICE[5627] chan_sip.c: Call from '' to extension '0010#33155786056' rejected because extension not found. [Jan 10 07:36:12] NOTICE[5627] chan_sip.c: Call from '' to extension '001133155786056' rejected because extension not found. [Jan 10 08:10:46] NOTICE[5627] chan_sip.c: Call from '' to extension '0011#33155786056' rejected because extension not found. [Jan 10 08:45:15] NOTICE[5627] chan_sip.c: Call from '' to extension '001233155786056' rejected because extension not found. I presume somebody is attempting to use my PBX as a relay ? Thanks - Phil
On Mon, 2010-01-11 at 10:45 +0000, --[ UxBoD ]-- wrote:> Hi, > > I am starting to see a lot of these: > > [Jan 10 01:18:56] NOTICE[5627] chan_sip.c: Call from '' to extension '33155786056' rejected because extension not found. > [Jan 10 01:52:47] NOTICE[5627] chan_sip.c: Call from '' to extension '033155786056' rejected because extension not found. > [Jan 10 02:26:36] NOTICE[5627] chan_sip.c: Call from '' to extension '0#33155786056' rejected because extension not found.Yes, looks like it. Make sure that your sip.conf "context=" default context points to a context that cannot make external calls. (Or, if your asterisk box does not need to accept connections from anyone externally then restrict what can connect to it with firewall rules or an access-list.) Although I had locked down the SIP config already, I was almost caught out recently by one of these attackers, where somebody was trying to make calls over *H323* as that ALSO has a 'default' context similar to sip.conf (although the calls did not succeed because before an outbound call is placed, we check the caller ID is within an expected range, in order to set the correct outbound CLI, but were that check not in place, then it probably would have succeeded.) H323 seemed to be enabled by default, so I just disabled the H.323 module as we do not use it. Rob