Anti brute-force attacksΒΆ
IvozProvider ships a simple anti brute-force attack in KamUsers that bans sources after continuous SIP auth failures from same IP address.
It works like this:
- On SIP failures (invalid user or invalid password cases only), a counter is increased:
- Key: fromUsername@fromDomain::source_ip
- e.g. terminal@vpbx.domain.net::1.2.3.4
- Counter is increased on every failure.
- When counter reaches 100, that specific source (user + domain + ip) is banned for 12 hours.
After 12 hours, source is accepted again and:
- Counter starts counting again from 80.
- If it reaches 100 again, it is banned for another 12 hours.
Tip
See Brute-force attacks for currently blocked sources.