How are these changed?

[WM: If you are running PBX in a Flash, both of these applications are protected by the root and FreePBX passwords. You can hide the warning messages by following the instructions at this link.]

[WM: If the call is passing through the VPN tunnel it will be encrypted.]

The article is very much focussed on IP security. But this site was exploited via Asterisk voicemail. They had the "dialout" option enabled in voicemail.conf and the hackers gained access through an insecure mailbox PIN and used the dialout feature to make international calls.

So be very careful about the "dialout" and "callback" options in voicemail.conf.

Regards,
Steve

Excellent information! This is exactly what users, admins, and especially bean-counters need to know about. A small investment in security can yield big dividends, the best of which is probably being able to sleep at night. 🙂

For those concerned about telecom system security you might also want to check out the way FreeSWITCH does things. It is "secure by default" as the devs are properly paranoid.

-MC

[WM: We like paranoid. We all sleep better. 🙂 ]

Your points about hardening systems are all spot-on. Sad to say I got hacked a few months ago in spite of having hardened my system (FreePBX 1.4).

I check my logs daily, so I discovered a spike in call volume pretty quickly. I took the PBX offline to make backups of all the log files and configuration, then started my analysis to find and close the breach.

It turns out the hacker found my open SIP ports and kept trying to authenticate with various extension/password combinations until he/she found one that worked. They were then able to log into an extenstion on my PBX remotely and place outbound calls. My passwords were short enough that they could be brute-forced and have since been changed.

I’ll be upgrading to FreePBX 1.5, but want to know if under FreePBX 1.4 there’s any way to prevent extensions from logging in remotely.

If I can add to your list, I’d offer the following suggestions:

* Use the PIN feature to restrict access for international calls, or block them altogether. I also use an ENUM trunk to see if the call can be made for free.
* Make sure your passwords are long and complex. They’re stored in your device configuration so you don’t need to enter them each time — you can afford to make one you won’t remember!

And, of course, check your logs regularly!

[WM: Get your existing system up to date with the latest version of FreePBX and do a FreePBX backup. Copy that backup to another machine. Then install the latest version of PBX in a Flash and get that machine up to the latest version of FreePBX. Create a FreePBX backup. Now copy the off-site backup you previously made to the new backup directory and restore it using FreePBX. Finally, run the fail2ban-update script again, and you’ll be all set.]

I think you need a good tutorial on how to use ssh to build a tunnel between the outside system to the internal asterisk system behind the firewall.

http://thinkhole.org/wp/2006/05/10/howto-secure-firefox-and-im-with-putty/

If someone has to have external gui access, use ssh to set it up.

JJS

The same can be said of almost anything you place on the net these days.

I applaud the efforts the PiaF team has made to make the PiaF distro easy to lockdown, use fail2ban and Hamachi VPN.

I have good stories, but this is to say thanks and I am happy to purchase a PiaF Flash if they are available.

cosmicwombat

It should/would cut down on the amount of logs to sort through, as anything that came in through the net that tried to get into the wired only network should be more easily seen and acted upon. The main network would be like a fence around the house whie the second network would be the house itself and thus (theoretically) more secure if the proper security measures are implemented on each network.

For the paranoid, a third network would be like the safe inside the house. Remember to poke holes in the tin foil hat that surrounds the router or it will get too hot and stop working.

I remember reading about turning OFF Plug N Play in routers as there is ZERO security on it from the users network, so that if a computer was compromised INSIDE the network, it could access the router and open up holes in the router. I have it turned OFF and have told others about turning it OFF as well. Unfortunately it is ON by default on my router. It would be nice if this was OFF by default on all routers, or if the router could be updated with it being OFF instead of being on by default. Hope that helps fill another hole in the wall.

If you install for other keep a record of your clients and every time there is a security update call your clients, explain the issue and try to make them a deal to update! It give us all a bad name if asterisk gets hacked. Please be responsible.

BTW Great post Ward, security is often overlooked, and is one of the most important parts of any network, let alone a PBX.