[arm-allstar] failed to authenticate

[Matt Mather]

Hi Kevin,

I am relatively new to all star and this is my first reply to the group, so please bear that in mind.

In reverse order, those messages tell me that some person(s) is / are trying to authenticate with your asterisk manager interface, originating from IP addresses located in the Netherlands and Belize respectively. If you don't recognise these IP addresses or locations then the answer to your final question is, yes. By default I believe that this interface is disabled to the outside world on port 5038 and only used for allmon / supermon. I'd check your manager.conf configuration.

I would expect that these messages are not related to the random disconnects unless that the unauthorised users did obtain access to your install. 

Matt. 

On Oct 12, 2017, at 12:47 PM, ""Kevin Halton via arm-allstar"" <arm-allstar at hamvoip.org> wrote:

I have noticed as of late that my node will randomly disconnect from
whatever I am connected to. I reviewed /var/log/asterisk/message and see a
lot of these entries ;



[Oct 11 09:47:04] NOTICE[3508] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 09:50:13] NOTICE[3546] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 09:53:22] NOTICE[3590] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 09:56:31] NOTICE[3631] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 09:59:41] NOTICE[3661] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:02:51] NOTICE[3719] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:18:41] NOTICE[3912] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:21:51] NOTICE[3955] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:25:00] NOTICE[3996] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:28:10] NOTICE[4035] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:31:20] NOTICE[4068] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:34:30] NOTICE[4115] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:37:41] NOTICE[4153] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:40:53] NOTICE[4190] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 10:44:04] NOTICE[4235] manager.c: 176.223.111.186 failed to
authenticate as 'admin'

[Oct 11 13:13:39] NOTICE[6103] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 13:13:40] NOTICE[6104] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 16:39:20] NOTICE[8706] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 16:39:21] NOTICE[8707] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 16:39:22] NOTICE[8708] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 20:04:43] NOTICE[11566] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 20:04:45] NOTICE[11567] manager.c: 5.104.228.142 failed to
authenticate as 'admin'

[Oct 11 20:04:46] NOTICE[11568] manager.c: 5.104.228.142 failed to
authenticate as 'admin'



Would this indicate someone or something is trying to gain access without my
approval? 

_______________________________________________

arm-allstar mailing list
arm-allstar at hamvoip.org
http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar

Visit the BBB and RPi2/3 web page - http://hamvoip.org