Asterisk Security Hardening: Protect Your PBX from Attacks
Unsecured Asterisk systems are a prime target for toll fraud and abuse. This guide covers the essential security measures every Asterisk administrator should implement.
Real Risk: Toll fraud costs the telecom industry $40+ billion per year. An unsecured Asterisk system can rack up thousands in international call charges within hours of compromise.
Brute Force Registration
Attackers try thousands of username/password combinations to register as a valid extension.
Toll Fraud
Once registered, attackers make expensive international calls through your trunk.
SIP Scanning
Automated scanners probe port 5060 for vulnerable SIP servers worldwide.
Eavesdropping
Unencrypted SIP/RTP can be intercepted on the network.
1. Firewall Configuration
The first line of defense is restricting which IPs can reach your SIP ports:
iptables rules
# Allow SIP from IPComms
iptables -A INPUT -s 34.23.59.14 -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -s 34.23.59.14 -p tcp --dport 5061 -j ACCEPT
# Allow RTP media ports from IPComms
iptables -A INPUT -s 34.23.59.14 -p udp --dport 10000:20000 -j ACCEPT
# Allow from your office/VPN (for softphones)
iptables -A INPUT -s YOUR_OFFICE_IP -p udp --dport 5060 -j ACCEPT
iptables -A INPUT -s YOUR_OFFICE_IP -p udp --dport 10000:20000 -j ACCEPT
# Drop all other SIP traffic
iptables -A INPUT -p udp --dport 5060 -j DROP
iptables -A INPUT -p tcp --dport 5060 -j DROP
2. Fail2Ban for SIP
Fail2Ban monitors your Asterisk logs for failed authentication attempts and automatically bans offending IPs:
Never use extension numbers as passwords. This is the #1 vulnerability in Asterisk systems.
Bad Passwords
100 (same as extension)
1234
password
Good Passwords
xK9#mP2$vL7nQ4
Tr0ub4d&Loop#88
j7Hm!kN3pW9xR5v
Generate passwords
# Generate a random 20-character password
openssl rand -base64 20 | tr -d '/+=' | head -c 20
4. Dialplan Context Security
The most dangerous misconfiguration is putting untrusted traffic in a context that allows outbound calling:
extensions.conf - Secure context design
; INBOUND from trunk - NO outbound access
[from-ipcomms]
exten => _X.,1,NoOp(Inbound from trunk)
same => n,Goto(internal,${EXTEN},1)
; INTERNAL context - authenticated extensions only
[internal]
exten => _1XX,1,Dial(PJSIP/${EXTEN},30)
include => outbound-allowed
[outbound-allowed]
; US/Canada only - block international by default
exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@ipcomms)
exten => 911,1,Dial(PJSIP/911@ipcomms)
; NEVER do this:
; [default]
; exten => _X.,1,Dial(PJSIP/${EXTEN}@ipcomms)
; This allows ANYONE to make calls!
5. Enable TLS and SRTP
TLS encrypts SIP signaling (protecting credentials) and SRTP encrypts the audio stream:
IP authentication is more secure than username/password registration for SIP trunks because there are no credentials to steal:
pjsip.conf - IP auth
; No auth section needed - trust based on IP
[ipcomms]
type=endpoint
context=from-ipcomms
disallow=all
allow=ulaw
aors=ipcomms
[ipcomms-identify]
type=identify
endpoint=ipcomms
match=34.23.59.14
7. Monitor and Alert
Monitor concurrent calls: Alert if calls exceed your normal peak
Watch for international calls: Alert on any calls to unexpected country codes
Track registration failures: Spikes indicate brute force attempts
Check CDRs daily: Look for calls at unusual hours or to unusual destinations
Set spending limits: Configure your trunk provider to cap daily spend
Secure SIP Trunking with IPComms
IPComms provides TLS/SRTP encryption, IP authentication, and built-in fraud detection. Protect your calls from the trunk level up.
