Over recent month many users are finding they are suffereing from brute force attacks from servers in Romania and more worryingly from "servers" in the Amazon cloud.

http://www.stuartsheldon.org/blog/2010/ ... ec2-hosts/ and many other posts have more details and Amazons poor response to this attack.

These attacks are also causing poor sound quality and many other QOS issues.

What can you do to protect yourself....

Make sure you have ACLs setup if you can and most importantly use STRONG passwords. , dont use 1234 use nergt32uy5ue9n also keep an eye on your logs and keep the firewall or IP tables upto date.

Also make sure your sip.conf file is set correctly, Make sure your have

alwaysauthreject=yes

and also make sure that the default context in the sip.conf is very restricted, no disa entries and no options to dialout.

You can also manually set your iptables firewall to block known hosts that are attacking, but this can be very labour intensive so setting a script or fail2ban to do it for you is a much better alternative.

On our customer servers we have a script running that keeps iptables updated blocking rogue servers after a couple of attempts.

It also is imporant to keep your call baring uptodate. We resell Gradwell services this means you can block numbers at their servers as well as your own.

UPDATED

You cant get away from it, Twitter that is, Everyone is either tweeting or writing about tweeting, Just sticking twitter into search on the BBC website and you will get over 500 unique results from the BBC alone. Stephen Fry has over a million followers ! .

So I thought that there must be something else that this could be used for, And it came to me "Asterisk Voicemail Notification" Obviously you don't want everyone to know you have a voicemail (Well I hope not) but this is easily solved by creating a private account for the server that only selected followers can see, and then send the notifications as "Direct Messages", Easy I thought and to be honest it was.

Then Twitter up'd their game by introducing oauth, This added a extra level of complication.

but now I am posting details of a way to Tweet notifications using Oauth