is my test cloud pbx server hacked? *NEW FusionPBX user*

[imcontreras]

I'm trying to auto-provisioning a grandstream phone, extension 3001 is mine

extension 4559 and 100 and 4560 they are not mine. Does this mean my system is compromised? any immediate security tips



Thanks!

 

[ad5ou]

You are seeing the typical SIP hacking attempts port 5060 sees.
The default fusion install script will keep you fairly safe from those scans but there is always more you can do to tighten security.

 

[JamesBorne]

You also forgot to block out your IP on the far right by the way haha.
As mentioned, it's just SIP scanning.

 

[DigitalDaz]

You will also notice in thew messages column that there is only a single sip message from each, ie no response from the server. This indicates that fail2ban has already caught them and banned them.

 

[JamesBorne]

there is only a single sip message from each

Nice pickup

 

[imcontreras]

Thanks for all these tips, really helps me to understand better this tool.

 

[Jonathan R.]

By changing your SIP port on Internal Profile you'll block 100% of these automated attempt at your server. It won't block a targeted attack tho.

 

[imcontreras]

By changing your SIP port on Internal Profile you'll block 100% of these automated attempt at your server. It won't block a targeted attack tho.

I've tried but somehow it doesn't work, even if I change the port on voip innovation and fusionpbx, all communications still use 5060.
but my next step after figure out how the auto-provisioning works will be to external profile or change the port on the internal profile.

Thanks for the advice