SIP attack log analyzer

Where to find the log

# Asterisk
tail -n 20000 /var/log/asterisk/messages
grep -E "failed for|rejected because|SecurityEvent" /var/log/asterisk/messages*
# FreeSWITCH
grep -E "auth failure|auth challenge|Can't find user" /var/log/freeswitch/freeswitch.log

For the Asterisk security log add security => security to logger.conf; /var/log/asterisk/security will then carry InvalidAccountID, ChallengeResponseFailed and SuccessfulAuth events.

How to protect the PBX

• Random SIP passwords of 16+ characters; the username is not the extension number.
• Port 5060 open only to carrier and office addresses; remote staff go through a VPN.
• fail2ban banning for a day after 5 failures.
• Long-distance and international off by default, with a per-line limit on concurrent calls.
• No outbound route reachable from the inbound context.

Check the same night's calls in the CDR analyzer, and keep an eye on the PBX with Telegram monitoring.