<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [X] Commit message has the format required by CONTRIBUTING guide - [X] Commits are split per component (core, individual modules, libs, utils, ...) - [X] Each component has a single commit (if not, squash them into one commit) - [X] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [X] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description <!-- Describe your changes in detail -->
You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/1903
-- Commit Summary --
* etc/kamailio.cfg: detect sipvicious as scanner
-- File Changes --
M etc/kamailio.cfg (2)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/1903.patch https://github.com/kamailio/kamailio/pull/1903.diff
Probable you want look other [scanners UA](https://github.com/2600hz/kazoo-configs-kamailio/blob/master/kamailio/defaul...).
Thanks!
Merged #1903 into master.
Probable you want look other [scanners UA](https://github.com/2600hz/kazoo-configs-kamailio/blob/master/kamailio/defaul...).
IMHO adding these makes sense. What do you think?
To add the missing user agents from the kazoo cfg snippet sounds good to me.
I don't think it is good to add a lot of string there. The default configuration files is more like a reference. sipvicious is a well known one and made sense (although most of its versions use `friendly-scanner` in user-agent).
But, afaik, portsip is an sdk and pbx. Then, others like NiceGuy likely to be sipvicious with a different value set for user agent. If the attacker was changing the default value to something else, banning that one by regex won't get it fixed for too long, the attacker will use a different value soon.
In other words, if it is something very common or a tool used for scanning attacks, makes sense to add. If it is just different user agent name used by an attacker against a platform, it should not be added in the default config file. There is pike+htable that can detect DoS attacks.
-
Daniel-Constantin Mierla -
Henning Westerholt
-
Kevin Olbrich
-
sergey-safarov