Skinny???

[richardroi]

Support,

I noticed this warning, can someone explain what is it? Is someone hacking my box? I ran skinny show devices but there is no devices showing?

Skinny Client sent less data than expected.
[Jul 8 17:37:27] NOTICE[9839]: chan_skinny.c:4568 skinny_session: Skinny Session returned: Success


Thank you.

[williamconley]

if you have ports open upon which skinny may communicate, I would expect you are, indeed, being at least "explored" for hacking purposes. find those ports and close them.

[GaD]

Why not just disable Skinny? Do you have any Cisco phones connected to your Vici? Maybe you are using Ciscos using SIP and perhaps these same phones are also searching for a Skinny talking server looking for autoconfiguration or such.... If Skinny is a problem..., just disable it.... You may also run verbose mode and see who's trying to talk Skinny...., but that may be a lot of output.

[williamconley]

It'd still make me nervous not knowing what it was. And in a strange protocol. If it is malicious, finding out is often necessary. That's what caused our first lockdown. And it's what "upgraded" our lockdowns to what it is now. No more attempted breakins.

[richardroi]

Why not just disable Skinny? Do you have any Cisco phones connected to your Vici? Maybe you are using Ciscos using SIP and perhaps these same phones are also searching for a Skinny talking server looking for autoconfiguration or such.... If Skinny is a problem..., just disable it.... You may also run verbose mode and see who's trying to talk Skinny...., but that may be a lot of output.

don't know how to disable it? Help please!
Thank you

[GaD]

Code: Select all

module unload chan_skinny.so

But, I would still recommend you to see who or where the 'attack' is comming from like William said..... Might be good to fix the problem from the source (finding what is really going on) other than just disabling the module, the latter being the quickest fix....

[edited to fix encoding = williamconley]

[richardroi]

thanks...I will look into it!

[williamconley]

the modules that load into asterisk are generally in the /etc/asterisk/modules.conf file. if it's in there ... change load to noload ... if it's not ... add it with noload => in front of it.