{"id":4972,"date":"2014-12-16T16:45:39","date_gmt":"2014-12-16T21:45:39","guid":{"rendered":"http:\/\/www.nurango.com\/new\/?p=4972"},"modified":"2023-02-01T21:40:20","modified_gmt":"2023-02-01T21:40:20","slug":"asterisk-ip-pbx-security-tips","status":"publish","type":"post","link":"https:\/\/www.nurango.ca\/blog\/asterisk-ip-pbx-security-tips","title":{"rendered":"asterisk & IP-PBX Security Tips"},"content":{"rendered":"\n

Securing asterisk is a MUST if you plan to deploy and use it.<\/span><\/h2>\n\n\n\n

Linux and SIP hack attempts are all too common. There are dozens of stories out there including a client of mine that incurred $18,000 in losses. Here are a few tips on securing your IP-PBX Phone System.<\/p>\n\n\n\n

 <\/h4>\n\n\n\n

1) <\/strong>Make sure all passwords are changed from the defaults immediately.<\/strong><\/p>\n\n\n\n

Root:<\/strong>
> passwd<\/p>\n\n\n\n

Mysql:<\/strong>
mysql asterisk –execute=”UPDATE mysql.user SET Password=PASSWORD(‘XXXX’) WHERE User=’root’;”
mysql asterisk –execute=”FLUSH PRIVILEGES;”<\/p>\n\n\n\n

– Don\u2019t forget the Admin passwords if any through the Admin GUI.<\/strong><\/p>\n\n\n\n

– Only login with a standard user account and use \u201csudo\u201d when needed.<\/strong><\/p>\n\n\n\n

– Consider changing the SSH port to something other than 21
<\/strong><\/p>\n\n\n\n

– Use Complex SIP Passwords for Extensions and Trunks!<\/strong>
2) <\/strong>If using VoIP –<\/strong><\/p>\n\n\n\n

– Use IP AUTHENTICATION with your SIP Provider!! Avoid registrations with passwords at ALL costs if you can!
– Instead of using a registration string use \u201cQualify=yes\u201d.<\/p>\n\n\n\n

3) Things to notice in your CLI: “Pinball activity\u201d. <\/strong><\/p>\n\n\n\n

Multiple Messages such as “wrong password for ext xx”<\/strong> or “attempting to register but host is not dynamic”<\/strong> etc. Basically random messages with IP\u2019s that you do not recognize. Don\u2019t confuse them with your remote agents though! Use IPtables to block malicious IPs.<\/p>\n\n\n\n

iptables -A INPUT -s x.x.x.x -j DROP (add blocked IP)<\/strong><\/p>\n\n\n\n

(CentOS)<\/strong><\/p>\n\n\n\n

> \/etc\/init.d\/iptables save (save settings)<\/p>\n\n\n\n

(Debian)
To allow ONLY specific IPs<\/strong><\/p>\n\n\n\n

iptables -A INPUT -s \u201cfriendlyip.1\u201d -j ACCEPT<\/p>\n\n\n\n

iptables -A INPUT -s \u201cfriendly.ip.2\u201d -j ACCEPT<\/p>\n\n\n\n

iptables -A INPUT -s 127.0.0.1 -j ACCEPT # yes, accept connections from localhost.<\/p>\n\n\n\n

Save–
<\/strong>iptables -A INPUT -s 0\/0 -j DROP<\/p>\n\n\n\n

–<\/strong> Don\u2019t Ban yourself! Add your remote IP if needed and your ISP\/Router\/Gateway.<\/strong><\/p>\n\n\n\n

4) There are more root password hack attempts than SIP registration hacks due to linux hack attempts versus targeted SIP hack attempts. Lock down remote SSH wrong password attempts.<\/strong><\/p>\n\n\n\n

1.<\/strong> Open \/etc\/pam.d\/sshd in a text editor.<\/p>\n\n\n\n

2<\/strong>. Right before @include common-auth, add the following on its own line:<\/p>\n\n\n\n

auth required pam_tally.so deny=3 unlock_time=120<\/p>\n\n\n\n

3.<\/strong> Right before @include common-account, add the following on its own line:<\/p>\n\n\n\n

account required pam_tally.so reset<\/p>\n\n\n\n

– See also: \/var\/log\/auth.log and \/var\/mail\/root for unauthorized access and attempts.<\/strong><\/p>\n\n\n\n

5) Disable un-needed services such as FTP, TFTP, and any other remote access services not needed.<\/strong><\/p>\n\n\n\n

6) Install Fail2Ban – <\/strong>Scans log files like \/var\/log\/pwdfail or \/var\/log\/apache\/error_log and bans IPs that make too many password failures. It also updates firewall rules to reject the IP addresses.<\/p>\n\n\n\n

7) Restrict Default Access<\/strong> –
1) Bind your mysql server to localhost. To do this you need to edit \/etc\/my.cnf and set “bind_address=127.0.0.1”
2) Enable host based access on your httpd.conf. If you are using the apache server on your local network only, it would be wise to do a bind address to the local network interface<\/p>\n\n\n\n

8) Asterisk Based –<\/strong>
1) Edit \/etc\/asterisk\/manager.conf and change 0.0.0.0 to 127.0.0.1
2) Ensure “allowtransfer=no” in \/etc\/asterisk\/sip.conf<\/p>\n\n\n\n

For blocking malicious SIP enumerations, you need to install Fail2ban<\/a>with asterisk filters.<\/h5>\n\n\n\n

Good luck and safe calling!<\/h2>\n\n\n\n

Download pdf version<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Securing asterisk is a MUST if you plan to deploy and use it. Linux and SIP hack attempts are all too common. There are dozens of stories out there including a client of mine that incurred $18,000 in losses. Here are a few tips on securing your IP-PBX Phone System.   1) Make sure all passwords are changed from the defaults immediately.…<\/p>\n","protected":false},"author":1,"featured_media":4973,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[4],"tags":[5,3],"class_list":["post-4972","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guides","tag-security","tag-voip"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/posts\/4972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/comments?post=4972"}],"version-history":[{"count":2,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/posts\/4972\/revisions"}],"predecessor-version":[{"id":10238,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/posts\/4972\/revisions\/10238"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/media\/4973"}],"wp:attachment":[{"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/media?parent=4972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/categories?post=4972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nurango.ca\/blog\/wp-json\/wp\/v2\/tags?post=4972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}