I see a lot of unknown calls in statistics
From Kolmisoft Wiki
Jump to navigationJump to search
You see a lot of unknown calls in your statistics with unusual destinations and callerIDs.
- First of all check if Fail2Ban is installed
You should see such lines after issuing command iptables --list :
[root@kolmisoft]# iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- XX.XX.XX.XX anywhere fail2ban-SSH tcp -- anywhere anywhere tcp dpt:ssh fail2ban-ASTERISK all -- anywhere anywhere DROP all -- XX.XX.XX.XX anywhere DROP all -- XX.XX.XX.XX anywhere
Where XX.XX.XX.XX is some IP address
- If you see unauthorized calls from your connected PBX like FreePBX, Elastix:
1. Make sure you use strong passwords for authentication
2. Check if there are unauthorized connections in PBX
3. Block all unknown IPs from your system
4. In some cases external PBX'es were hacked, related problems are reviewed here, here and here.
5. Setup a secure VPN connection from your PBX to MOR.