On Tuesday 09 January 2007 3:51 pm, Pittner, Zoltan wrote: > Maybe we should have a session on how-to securing your asterisk or trixbox > from similar or as matter of fact any exploit attempts. I would definetly > read some documentation on this, or step by step guide - however this is > always a trade off - security over functionality - or functionality over > security... > > I would not be interested on securing it from the internet side - I think I > am pretty good with that - what I be interested is securing it from the > telephone network side. What if somebody knows some dialtone sequence and > they can make calls through your lines? Remember the days when they > whistled codes into the public phones to make free long distance calls...
I disagree with you in the respect that it's a security-vs-functionality tradeoff. Do you leave a cordless phone outside so the neighbours can make calls if they happen to be near the unit? It's not much different here. Off the top of my head, the following recommendations seem both straightforward and prudent: 1) don't ever use the [default] context for anything more than a NoOp and Hangup. 2) If you are accepting SIP/IAX2 calls, authenticate strongly 3) If you're accepting SIP/IAX2 calls anonymously, accept them into a very limited context. I have both echotest and milliwatt SIP and IAX2 users which I accept from anywhere on the planet, but they don't get anything than some of my CPU time. 4) Speaking of contexts, break your dialplan up into local, longdistance, tollfree, international, 911, internal, etc. contexts, and then build up bigger contexts by including these basic blocks. 5) Don't ever accept Caller*ID as credentials. If you must authenticate calls without accepting a PIN, get an 800# from a reputable PRI provider and trust ANI. Test that they're not just sending Caller*ID as ANI. 6) Limit what you're willing to accept in terms of codecs and outright number of simultaneous calls. Otherwise you're just waiting for a DoS. On the whole, Open Source software in general is pretty immune to back doors and magic passwords. Not infallible, but pretty immune. The biggest security problems you're going to create yourself through misapplying the dialplan or not adhering to the rules mentioned above. -A.
