|
@@ -43,14 +43,21 @@ Jose Luis Verdeguer
|
|
|
|
|
|
5.1. secfilter.reload
|
|
5.1. secfilter.reload
|
|
5.2. secfilter.print
|
|
5.2. secfilter.print
|
|
- 5.3. secfilter.add_dst
|
|
|
|
- 5.4. secfilter.add_bl
|
|
|
|
- 5.5. secfilter.add_wl
|
|
|
|
|
|
+ 5.3. secfilter.stats
|
|
|
|
+ 5.4. secfilter.stats_reset
|
|
|
|
+ 5.5. secfilter.add_dst
|
|
|
|
+ 5.6. secfilter.add_bl
|
|
|
|
+ 5.7. secfilter.add_wl
|
|
|
|
|
|
6. Installation
|
|
6. Installation
|
|
|
|
|
|
6.1. Database setup
|
|
6.1. Database setup
|
|
|
|
|
|
|
|
+ 7. Some examples
|
|
|
|
+
|
|
|
|
+ 7.1. Print data
|
|
|
|
+ 7.2. Statistics
|
|
|
|
+
|
|
List of Examples
|
|
List of Examples
|
|
|
|
|
|
1.1. Set db_url parameter
|
|
1.1. Set db_url parameter
|
|
@@ -70,10 +77,14 @@ Jose Luis Verdeguer
|
|
1.15. secf_check_sqli_all usage
|
|
1.15. secf_check_sqli_all usage
|
|
1.16. secfilter.reload usage
|
|
1.16. secfilter.reload usage
|
|
1.17. secfilter.print usage
|
|
1.17. secfilter.print usage
|
|
- 1.18. secfilter.add_dst usage
|
|
|
|
- 1.19. secfilter.add_bl usage
|
|
|
|
- 1.20. secfilter.add_wl usage
|
|
|
|
- 1.21. Example database content - secfilter table
|
|
|
|
|
|
+ 1.18. secfilter.stats usage
|
|
|
|
+ 1.19. secfilter.stats_reset usage
|
|
|
|
+ 1.20. secfilter.add_dst usage
|
|
|
|
+ 1.21. secfilter.add_bl usage
|
|
|
|
+ 1.22. secfilter.add_wl usage
|
|
|
|
+ 1.23. Example database content - secfilter table
|
|
|
|
+ 1.24. kamcmd secfilter.print ua
|
|
|
|
+ 1.25. kamcmd secfilter.stats
|
|
|
|
|
|
Chapter 1. Admin Guide
|
|
Chapter 1. Admin Guide
|
|
|
|
|
|
@@ -110,14 +121,21 @@ Chapter 1. Admin Guide
|
|
|
|
|
|
5.1. secfilter.reload
|
|
5.1. secfilter.reload
|
|
5.2. secfilter.print
|
|
5.2. secfilter.print
|
|
- 5.3. secfilter.add_dst
|
|
|
|
- 5.4. secfilter.add_bl
|
|
|
|
- 5.5. secfilter.add_wl
|
|
|
|
|
|
+ 5.3. secfilter.stats
|
|
|
|
+ 5.4. secfilter.stats_reset
|
|
|
|
+ 5.5. secfilter.add_dst
|
|
|
|
+ 5.6. secfilter.add_bl
|
|
|
|
+ 5.7. secfilter.add_wl
|
|
|
|
|
|
6. Installation
|
|
6. Installation
|
|
|
|
|
|
6.1. Database setup
|
|
6.1. Database setup
|
|
|
|
|
|
|
|
+ 7. Some examples
|
|
|
|
+
|
|
|
|
+ 7.1. Print data
|
|
|
|
+ 7.2. Statistics
|
|
|
|
+
|
|
1. Overview
|
|
1. Overview
|
|
|
|
|
|
This module has been designed to offer an additional layer of security
|
|
This module has been designed to offer an additional layer of security
|
|
@@ -488,9 +506,11 @@ d in the user-agent header ($ua)");
|
|
|
|
|
|
5.1. secfilter.reload
|
|
5.1. secfilter.reload
|
|
5.2. secfilter.print
|
|
5.2. secfilter.print
|
|
- 5.3. secfilter.add_dst
|
|
|
|
- 5.4. secfilter.add_bl
|
|
|
|
- 5.5. secfilter.add_wl
|
|
|
|
|
|
+ 5.3. secfilter.stats
|
|
|
|
+ 5.4. secfilter.stats_reset
|
|
|
|
+ 5.5. secfilter.add_dst
|
|
|
|
+ 5.6. secfilter.add_bl
|
|
|
|
+ 5.7. secfilter.add_wl
|
|
|
|
|
|
5.1. secfilter.reload
|
|
5.1. secfilter.reload
|
|
|
|
|
|
@@ -524,7 +544,25 @@ d in the user-agent header ($ua)");
|
|
kamcmd secfilter.print dst
|
|
kamcmd secfilter.print dst
|
|
...
|
|
...
|
|
|
|
|
|
-5.3. secfilter.add_dst
|
|
|
|
|
|
+5.3. secfilter.stats
|
|
|
|
+
|
|
|
|
+ Print statistics of blocked and allowed messages.
|
|
|
|
+
|
|
|
|
+ Example 1.18. secfilter.stats usage
|
|
|
|
+ ...
|
|
|
|
+ kamcmd secfilter.stats
|
|
|
|
+ ...
|
|
|
|
+
|
|
|
|
+5.4. secfilter.stats_reset
|
|
|
|
+
|
|
|
|
+ Reset all statistics.
|
|
|
|
+
|
|
|
|
+ Example 1.19. secfilter.stats_reset usage
|
|
|
|
+ ...
|
|
|
|
+ kamcmd secfilter.stats_reset
|
|
|
|
+ ...
|
|
|
|
+
|
|
|
|
+5.5. secfilter.add_dst
|
|
|
|
|
|
Insert values into destination blacklist. These values will be checked
|
|
Insert values into destination blacklist. These values will be checked
|
|
with the function secf_check_dst to verify if the destination number
|
|
with the function secf_check_dst to verify if the destination number
|
|
@@ -533,12 +571,12 @@ d in the user-agent header ($ua)");
|
|
Parameters:
|
|
Parameters:
|
|
* number (number to add to the destination blacklist)
|
|
* number (number to add to the destination blacklist)
|
|
|
|
|
|
- Example 1.18. secfilter.add_dst usage
|
|
|
|
|
|
+ Example 1.20. secfilter.add_dst usage
|
|
...
|
|
...
|
|
kamcmd secfilter.add_dst 555123123
|
|
kamcmd secfilter.add_dst 555123123
|
|
...
|
|
...
|
|
|
|
|
|
-5.4. secfilter.add_bl
|
|
|
|
|
|
+5.6. secfilter.add_bl
|
|
|
|
|
|
Insert values into blacklist.
|
|
Insert values into blacklist.
|
|
|
|
|
|
@@ -546,13 +584,13 @@ d in the user-agent header ($ua)");
|
|
* type (must be: ua, country, domain, user or ip)
|
|
* type (must be: ua, country, domain, user or ip)
|
|
* value (value to add to the blacklist)
|
|
* value (value to add to the blacklist)
|
|
|
|
|
|
- Example 1.19. secfilter.add_bl usage
|
|
|
|
|
|
+ Example 1.21. secfilter.add_bl usage
|
|
...
|
|
...
|
|
kamcmd secfilter.add_bl ua friendly-scanner
|
|
kamcmd secfilter.add_bl ua friendly-scanner
|
|
kamcmd secfilter.add_bl user sipvicious
|
|
kamcmd secfilter.add_bl user sipvicious
|
|
...
|
|
...
|
|
|
|
|
|
-5.5. secfilter.add_wl
|
|
|
|
|
|
+5.7. secfilter.add_wl
|
|
|
|
|
|
Insert values into whitelist.
|
|
Insert values into whitelist.
|
|
|
|
|
|
@@ -560,7 +598,7 @@ d in the user-agent header ($ua)");
|
|
* type (must be: ua, country, domain, user or ip)
|
|
* type (must be: ua, country, domain, user or ip)
|
|
* value (value to add to the whitelist)
|
|
* value (value to add to the whitelist)
|
|
|
|
|
|
- Example 1.20. secfilter.add_wl usage
|
|
|
|
|
|
+ Example 1.22. secfilter.add_wl usage
|
|
...
|
|
...
|
|
kamcmd secfilter.add_wl country es
|
|
kamcmd secfilter.add_wl country es
|
|
kamcmd secfilter.add_wl user trusted_user
|
|
kamcmd secfilter.add_wl user trusted_user
|
|
@@ -583,7 +621,7 @@ d in the user-agent header ($ua)");
|
|
the complete database documentation on the project webpage,
|
|
the complete database documentation on the project webpage,
|
|
https://www.kamailio.org/docs/db-tables/kamailio-db-devel.html.
|
|
https://www.kamailio.org/docs/db-tables/kamailio-db-devel.html.
|
|
|
|
|
|
- Example 1.21. Example database content - secfilter table
|
|
|
|
|
|
+ Example 1.23. Example database content - secfilter table
|
|
...
|
|
...
|
|
+----+-----------+-----------+------------------+
|
|
+----+-----------+-----------+------------------+
|
|
| id | action | type | data |
|
|
| id | action | type | data |
|
|
@@ -613,3 +651,79 @@ d in the user-agent header ($ua)");
|
|
* 2 (domain)
|
|
* 2 (domain)
|
|
* 3 (IP address)
|
|
* 3 (IP address)
|
|
* 4 (user)
|
|
* 4 (user)
|
|
|
|
+
|
|
|
|
+7. Some examples
|
|
|
|
+
|
|
|
|
+ 7.1. Print data
|
|
|
|
+ 7.2. Statistics
|
|
|
|
+
|
|
|
|
+7.1. Print data
|
|
|
|
+
|
|
|
|
+ Example 1.24. kamcmd secfilter.print ua
|
|
|
|
+ ...
|
|
|
|
+User-agent
|
|
|
|
+==========
|
|
|
|
+[+] Blacklisted
|
|
|
|
+ -----------
|
|
|
|
+ 0001 -> friendly-scanner
|
|
|
|
+ 0002 -> pplsip
|
|
|
|
+ 0003 -> sipcli
|
|
|
|
+ 0004 -> sundayddr
|
|
|
|
+ 0005 -> iWar
|
|
|
|
+ 0006 -> sipsak
|
|
|
|
+ 0007 -> VaxSIPUserAgent
|
|
|
|
+ 0008 -> SimpleSIP
|
|
|
|
+ 0009 -> SIP Call
|
|
|
|
+ 0010 -> Ozeki
|
|
|
|
+ 0011 -> VoIPSec
|
|
|
|
+ 0012 -> SIPScan
|
|
|
|
+ 0013 -> Conaito
|
|
|
|
+ 0014 -> UsaAirport
|
|
|
|
+ 0015 -> PortSIP VoIP SDK
|
|
|
|
+ 0016 -> zxcvfdf11
|
|
|
|
+ 0017 -> fdgddfg546df4g8d5f
|
|
|
|
+
|
|
|
|
+[+] Whitelisted
|
|
|
|
+ -----------
|
|
|
|
+ 0001 -> my custom ua
|
|
|
|
+ ...
|
|
|
|
+
|
|
|
|
+7.2. Statistics
|
|
|
|
+
|
|
|
|
+ Example 1.25. kamcmd secfilter.stats
|
|
|
|
+ ...
|
|
|
|
+Blocked messages (blacklist)
|
|
|
|
+============================
|
|
|
|
+[+] By user-agent : 1256
|
|
|
|
+[+] By country : 45
|
|
|
|
+[+] By from domain : 0
|
|
|
|
+[+] By to domain : 0
|
|
|
|
+[+] By contact domain: 1
|
|
|
|
+[+] By IP address : 2552
|
|
|
|
+[+] By from name : 0
|
|
|
|
+[+] By to name : 0
|
|
|
|
+[+] By contact name : 0
|
|
|
|
+[+] By from user : 316
|
|
|
|
+[+] By to user : 134
|
|
|
|
+[+] By contact user : 0
|
|
|
|
+
|
|
|
|
+Allowed messages (whitelist)
|
|
|
|
+============================
|
|
|
|
+[+] By user-agent : 0
|
|
|
|
+[+] By country : 478
|
|
|
|
+[+] By from domain : 0
|
|
|
|
+[+] By to domain : 0
|
|
|
|
+[+] By contact domain: 0
|
|
|
|
+[+] By IP address : 0
|
|
|
|
+[+] By from name : 0
|
|
|
|
+[+] By to name : 0
|
|
|
|
+[+] By contact name : 0
|
|
|
|
+[+] By from user : 0
|
|
|
|
+[+] By to user : 0
|
|
|
|
+[+] By contact user : 0
|
|
|
|
+
|
|
|
|
+Other blocked messages
|
|
|
|
+======================
|
|
|
|
+[+] Destinations : 0
|
|
|
|
+[+] SQL injection : 213
|
|
|
|
+ ...
|