Меня взломали

Как определить дыру?

    [May  7 11:09:09] DEBUG[24825]: audiohook.c:239 audiohook_read_frame_both: Read factory 0x93a6da8 was pretty quick last time, waiting for them.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8135 find_call: = Looking for  Call ID: 2577efe6780b565f487e7dfb6f9c4cc4 (Checking From) --From tag 79ea4b65 --To-tag
[May  7 11:09:09] DEBUG[24502]: acl.c:728 ast_ouraddrfor: For destination 'IP_HACKERA', our source address is '192.168.1.7'.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:3513 ast_sip_ouraddrfor: Setting SIP_TRANSPORT_UDP with address 192.168.1.7:5060
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7815 sip_alloc: Allocating new SIP dialog for 2577efe6780b565f487e7dfb6f9c4cc4 - INVITE (No RTP)
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:25170 handle_incoming: **** Received INVITE (5) - Command in SIP INVITE
[May  7 11:09:09] DEBUG[24502]: netsock2.c:134 ast_sockaddr_split_hostport: Splitting 'IP_HACKERA:5070' into...
[May  7 11:09:09] DEBUG[24502]: netsock2.c:188 ast_sockaddr_split_hostport: ...host 'IP_HACKERA' and port '5070'.
[May  7 11:09:09] DEBUG[24502]: netsock2.c:134 ast_sockaddr_split_hostport: Splitting '192.168.1.7' into...
[May  7 11:09:09] DEBUG[24502]: netsock2.c:188 ast_sockaddr_split_hostport: ...host '192.168.1.7' and port ''.
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:346 ast_rtp_instance_new: Using engine 'asterisk' for RTP instance '0x941e530'
[May  7 11:09:09] DEBUG[24502]: res_rtp_asterisk.c:556 ast_rtp_new: Allocated port 10958 for RTP instance '0x941e530'
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:355 ast_rtp_instance_new: RTP instance '0x941e530' is setup and ready to go
[May  7 11:09:09] DEBUG[24502]: res_rtp_asterisk.c:2521 ast_rtp_prop_set: Setup RTCP on RTP instance '0x941e530'
  == Using SIP RTP CoS mark 5
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:5107 do_setnat: Setting NAT on RTP to Off
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8937 process_sdp: Processing session-level SDP v=0... UNSUPPORTED.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8937 process_sdp: Processing session-level SDP o=sipcli-Session 205951659 474371412 IN IP4 IP_HACKERA... UNSUPPORTED.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8937 process_sdp: Processing session-level SDP s=sipcli... UNSUPPORTED.
[May  7 11:09:09] DEBUG[24502]: netsock2.c:134 ast_sockaddr_split_hostport: Splitting 'IP_HACKERA' into...
[May  7 11:09:09] DEBUG[24502]: netsock2.c:188 ast_sockaddr_split_hostport: ...host 'IP_HACKERA' and port ''.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8937 process_sdp: Processing session-level SDP c=IN IP4 IP_HACKERA... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:8937 process_sdp: Processing session-level SDP t=0 0... UNSUPPORTED.
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:537 ast_rtp_codecs_payloads_set_m_type: Setting payload 18 based on m type on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:537 ast_rtp_codecs_payloads_set_m_type: Setting payload 0 based on m type on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:537 ast_rtp_codecs_payloads_set_m_type: Setting payload 8 based on m type on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:537 ast_rtp_codecs_payloads_set_m_type: Setting payload 101 based on m type on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=fmtp:101 0-15... UNSUPPORTED.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=rtpmap:18 G729/8000... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=rtpmap:0 PCMU/8000... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=rtpmap:8 PCMA/8000... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=rtpmap:101 telephone-event/8000... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=ptime:20... OK.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9163 process_sdp: Processing media-level (audio) SDP a=sendrecv... OK.
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:640 ast_rtp_codecs_payload_formats: Incorporating payload 0 on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:640 ast_rtp_codecs_payload_formats: Incorporating payload 8 on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:640 ast_rtp_codecs_payload_formats: Incorporating payload 18 on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:640 ast_rtp_codecs_payload_formats: Incorporating payload 101 on 0xb451ae6c
[May  7 11:09:09] DEBUG[24502]: res_rtp_asterisk.c:2561 ast_rtp_remote_address_set: Setting RTCP address on RTP instance '0x941e530'
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:518 ast_rtp_codecs_payloads_copy: Copying payload 0 from 0xb451ae6c to 0x941e6dc
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:518 ast_rtp_codecs_payloads_copy: Copying payload 8 from 0xb451ae6c to 0x941e6dc
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:518 ast_rtp_codecs_payloads_copy: Copying payload 18 from 0xb451ae6c to 0x941e6dc
[May  7 11:09:09] DEBUG[24502]: rtp_engine.c:518 ast_rtp_codecs_payloads_copy: Copying payload 101 from 0xb451ae6c to 0x941e6dc
[May  7 11:09:09] DEBUG[24502]: res_rtp_asterisk.c:2487 ast_rtp_prop_set: Ignoring duplicate RTCP property on RTP instance '0x941e530'
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:9407 process_sdp: We're settling with these formats: 0xc (ulaw|alaw)
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:22706 handle_request_invite: Checking SIP call limits for device
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:5919 update_call_counter: Updating call counter for incoming call
[May  7 11:09:09] DEBUG[24502]: netsock2.c:134 ast_sockaddr_split_hostport: Splitting '192.168.1.7' into...
[May  7 11:09:09] DEBUG[24502]: netsock2.c:188 ast_sockaddr_split_hostport: ...host '192.168.1.7' and port ''.
[May  7 11:09:09] DEBUG[24502]: netsock2.c:134 ast_sockaddr_split_hostport: Splitting '192.168.1.7' into...
[May  7 11:09:09] DEBUG[24502]: netsock2.c:188 ast_sockaddr_split_hostport: ...host '192.168.1.7' and port ''.
[May  7 11:09:09] DEBUG[24502]: frame.c:1252 ast_codec_choose: Could not find preferred codec - Going for the best codec
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7112 sip_new: *** Our native formats are 0x4 (ulaw)
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7113 sip_new: *** Joint capabilities are 0xc (ulaw|alaw)
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7114 sip_new: *** Our capabilities are 0x80000008000e (gsm|ulaw|alaw|h263|testlaw)
[May  7 11:09:09] DEBUG[24502]: frame.c:1252 ast_codec_choose: Could not find preferred codec - Going for the best codec
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7115 sip_new: *** AST_CODEC_CHOOSE formats are 0x4 (ulaw)
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:7145 sip_new: This channel will not be able to handle video.
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:14298 build_route: build_route: Contact hop: <sip:7800@IP_HACKERA:5070>
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:23005 handle_request_invite: SIP/192.168.1.7-0000000f: New call is still down.... Trying...
[May  7 11:09:09] DEBUG[24502]: chan_sip.c:3359 __sip_xmit: Trying to put 'SIP/2.0 100' onto UDP socket destined for IP_HACKERA:5070
[May  7 11:09:09] DEBUG[24839]: pbx.c:4478 pbx_extension_helper: Launching 'Macro'
    -- Executing [NOMER_HACKERA@default:1] Macro("SIP/192.168.1.7-0000000f", "mylog, "BUG: Unhandled context !!!"") in new stack
[May  7 11:09:09] WARNING[24839]: app_macro.c:309 _macro_exec: No such context 'macro-mylog' for macro 'mylog'
[May  7 11:09:09] DEBUG[24839]: pbx.c:4478 pbx_extension_helper: Launching 'Hangup'
    -- Executing [NOMER_HACKERA@default:2] Hangup("SIP/192.168.1.7-0000000f", "") in new stack
[May  7 11:09:09] DEBUG[24839]: pbx.c:5295 __ast_pbx_run: Spawn extension (default,NOMER_HACKERA,2) exited non-zero on 'SIP/192.168.1.7-0000000f'
  == Spawn extension (default, NOMER_HACKERA, 2) exited non-zero on 'SIP/192.168.1.7-0000000f'
[May  7 11:09:09] DEBUG[24839]: channel.c:2684 ast_softhangup_nolock: Soft-Hanging up channel 'SIP/192.168.1.7-0000000f'
[May  7 11:09:09] DEBUG[24839]: channel.c:2832 ast_hangup: Hanging up channel 'SIP/192.168.1.7-0000000f'
[May  7 11:09:09] DEBUG[24839]: chan_sip.c:6305 sip_hangup: Hanging up zombie call. Be scared.
[May  7 11:09:09] DEBUG[24839]: chan_sip.c:6326 sip_hangup: Hanging up channel in state Ring (not UP)
[May  7 11:09:09] DEBUG[24839]: res_rtp_asterisk.c:2561 ast_rtp_remote_address_set: Setting RTCP address on RTP instance '0x941e530'
[May  7 11:09:09] DEBUG[24839]: chan_sip.c:6234 hangup_cause2sip: AST hangup cause 16 (no match found in SIP)
[May  7 11:09:09] DEBUG[24839]: chan_sip.c:3359 __sip_xmit: Trying to put 'SIP/2.0 603' onto UDP socket destined for IP_HACKERA:5070
[May  7 11:09:09] DEBUG[24481]: devicestate.c:342 _ast_device_state: No provider found, checking channel drivers for SIP - 192.168.1.7
[May  7 11:09:09] DEBUG[24481]: chan_sip.c:26439 sip_devicestate: Checking device state for peer 192.168.1.7
[May  7 11:09:09] DEBUG[24481]: devicestate.c:465 do_state_change: Changing state for SIP/192.168.1.7 - state 4 (Invalid)
[May  7 11:09:09] DEBUG[24481]: devicestate.c:440 devstate_event: device 'SIP/192.168.1.7' state '4'
[May  7 11:09:09] DEBUG[24571]: app_queue.c:1487 handle_statechange: Device 'SIP/192.168.1.7' changed to state '4' (Invalid) but we don't care because they're not a member of any queue.
[May  7 11:09:09] DEBUG[24839]: cdr_pgsql.c:278 pgsql_log: inserting a CDR record.
[May  7 11:09:09] DEBUG[24825]: audiohook.c:227 audiohook_read_frame_both: Read factory 0x93a6da8 and write factory 0x93a77d0 both fail to provide 160 samples
[May  7 11:09:09] DEBUG[24825]: audiohook.c:239 audiohook_read_frame_both: Read factory 0x93a6da8 was pretty quick last time, waiting for them.
[May  7 11:09:09] DEBUG[24839]: cdr_radius.c:208 radius_log: Unable to create RADIUS record. CDR not recorded!
[May  7 11:09:09] DEBUG[24839]: res_config_sqlite.c:834 cdr_handler: SQL query: INSERT INTO ast_cdr (clid,src,dst,dcontext,channel,lastapp,start,answer,end,duration,billsec,disposition,amaflags,uniqueid) VALUES ('"7800" <7800>','7800','NOMER_HACKERA','default','SIP/192.168.1.7-0000000f','Hangup','2015-05-07 11:09:09','2015-05-07 11:09:09','2015-05-07 11:09:09','0','0','NO ANSWER','DOCUMENTATION','1430986149.39')

В sip show channels появляются IP_HACKERA 9100 083ad5b9958ab97 0x0 (nothing) No Rx: INVITE <guest> номера, которые в sip.conf вообще не присутсвтуют

Если удалить отрубить интернет то

[May  7 11:50:33] WARNING[24502]: acl.c:711 ast_ouraddrfor: Cannot connect
  == Using SIP RTP CoS mark 5
[May  7 11:50:33] WARNING[24502]: chan_sip.c:3385 __sip_xmit: sip_xmit of 0x93a6d48 (len 517) to IP_HACKERA:5070 returned -2: Network is unreachable
    -- Executing [NOMER_HACKERA@default:1] Macro("SIP/192.168.1.7-00000040", "mylog, "BUG: Unhandled context !!!"") in new stack
[May  7 11:50:33] WARNING[25912]: app_macro.c:309 _macro_exec: No such context 'macro-mylog' for macro 'mylog'
    -- Executing [NOMER_HACKERA@default:2] Hangup("SIP/192.168.1.7-00000040", "") in new stack
  == Spawn extension (default, NOMER_HACKERA, 2) exited non-zero on 'SIP/192.168.1.7-00000040'
[May  7 11:50:33] WARNING[25912]: chan_sip.c:3385 __sip_xmit: sip_xmit of 0x939ab98 (len 488) to IP_HACKERA:5070 returned -2: Network is unreachable
[May  7 11:50:33] ERROR[25912]: chan_sip.c:3823 __sip_reliable_xmit: Serious Network Trouble; __sip_xmit returns error for pkt data

Звонки не попадают в экстеншейн если я прописываю allowguest= no Но в sip show channels все равно invite виден.

Как определить дыру?

asterisk 1.8

Доступ в интернет не открыт для астериска, только определенные ip адреса до sip провайдеров. 5060 в интернет не торчит

ВОТ что показывает sip debug:

Как будто астериск сам начинает разговор.

SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP IP_HACKERA:5071;branch=z9hG4bK-4259ea463399061751db3272cc02c8f9;received=IP_HACKERA;rport=5071
From: 3800<sip:3800@192.168.1.7>;tag=d1f44cd6
To: 81040349086571<sip:81040349086571@192.168.1.7>;tag=as59486c38
Call-ID: 4259ea463399061751db3272cc02c8f9
CSeq: 1 INVITE
Server: Asterisk PBX 1.8.13.1~dfsg1-3+deb7u3
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="asterisk", nonce="1731b585"
Content-Length: 0

В Tcpdump Пакеты только на отпрвку от астериска на айпи хакера. От него ничего не приходит в outgouing то же ничего нет Как будто астер сам инициирует соединение.