[arm-allstar] failed to authenticate

[David McGough]

Hi Kevin,

Yes, your Asterisk Manager Interface (AMI) is being hacked on--not good!

Did you modify you /etc/asterisk/manager.conf file??

Take a look at these statements:


bindaddr = 127.0.0.1   ; Local interface only!
;bindaddr = 0.0.0.0    ; Not secure

...Make sure to only bind the AMI to localhost, unless you're on a private 
network that you're certain is secure!


73, David KB4FXC


On Thu, 12 Oct 2017, "Kevin Halton via arm-allstar" wrote:

> I have noticed as of late that my node will randomly disconnect from
> whatever I am connected to. I reviewed   /var/log/asterisk/message and see a
> lot of these entries ;
> 
>  
> 
> [Oct 11 09:47:04] NOTICE[3508] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 09:50:13] NOTICE[3546] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 09:53:22] NOTICE[3590] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 09:56:31] NOTICE[3631] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 09:59:41] NOTICE[3661] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:02:51] NOTICE[3719] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:18:41] NOTICE[3912] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:21:51] NOTICE[3955] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:25:00] NOTICE[3996] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:28:10] NOTICE[4035] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:31:20] NOTICE[4068] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:34:30] NOTICE[4115] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:37:41] NOTICE[4153] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:40:53] NOTICE[4190] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 10:44:04] NOTICE[4235] manager.c: 176.223.111.186 failed to
> authenticate as 'admin'
> 
> [Oct 11 13:13:39] NOTICE[6103] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 13:13:40] NOTICE[6104] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 16:39:20] NOTICE[8706] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 16:39:21] NOTICE[8707] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 16:39:22] NOTICE[8708] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 20:04:43] NOTICE[11566] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 20:04:45] NOTICE[11567] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
> [Oct 11 20:04:46] NOTICE[11568] manager.c: 5.104.228.142 failed to
> authenticate as 'admin'
> 
>  
> 
> Would this indicate someone or something is trying to gain access without my
> approval? 
> 
> _______________________________________________
> 
> arm-allstar mailing list
> arm-allstar at hamvoip.org
> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
> 
> Visit the BBB and RPi2/3 web page - http://hamvoip.org
>