I see line after line after line in the log about this. But I see nothing anywhere in any of the conf files referring to node 1111.
An artifact of something else?
That’s a private node connected to whatever you’re looking at. What are you looking at?
Are you running your firewall ?
‘iptables’ and ‘fail2ban’. Find them in the asl menu if you need to install.
I realize “1111” is a private node but it isn’t one of mine nor does it exist in the [nodes] stanza (nor anywhere else in /etc/asterisk for that matter).
Yes, running a firewall, even though the node this is seen on (the error I posted appears in the AST log of my hub node) is on the AREDN mesh
(not sure why I started this thread in this category but…)
No one has any ideas as to what may be going on?
(Moved to app_rpt-users category)
With node 1111 nowhere in your node settings, there must be a node 1111 somewhere on the network attempt to connect to you. As Mike was getting at you’ll need to block it with a firewall.
What you are ‘likely’ seeing in your log file is a attempt to connect to a asterisk extension (hack)
That is why I say double check your firewall (iptables and fail2ban)
I will tell you that once you have been discovered, the attempts are relentless.
While most times they do not get much of anywhere, mostly because the extensions we use are not on a beaten standard (node#'s), it will often cause some strange anomalies from what they are trying to discover… but you will see attempts in the log.
So verify you have a firewall up and running and also let me know if you are using sip phone with this system (or have sip enabled in modules.conf)
There are some extra steps you can take to thwart them if you are using sip. Which is always a target.
SIP is not loaded but I’ll have a look at firewalling in any case, thanks
Ken,
If you can figure out what ip address this is coming from, you might have a shot at locating it on the network. Also, to clairfy, is this ASL node only on the AREDN mesh or does it have connectivity to the Internet as well?
73, Mark, N2MH
Sorry for resurrecting an old thread… I should have looked at the date first