OpenSIPS intrusion detection
A popular way to control intrusion attempts is fail2ban framework. There is a tutorial that explains how to setup fail2ban with OpenSIPS. This solution is easy to setup but, on my humble opinion, it has certain limitations and disadvantages: Fail2ban is parsing log files and if OpenSIPS will start to generate lots of logs (debug level 4 for example) there is a good chance that fail2ban will fail to detect intruder's IP. Besides, fail2ban uses regex pattern when checking logs, and it brings some extra charge on the system. Fail2ban is using iptables to block intruder by IP address. This seems to be correct, but what if user configure its softphone with wrong credentials and after several attempts PC address will be blocked. If server with OpenSIPS is providing other services, like DNS, then it would bring problems not related to telephony and problems like this are not easy to debug. If you are using cluster of OpenSIPS servers with lots of n...