Comments on: The Incredible PBX: Safely Interconnecting Asterisk Servers

By: ward

ward — Tue, 18 Jan 2011 22:04:08 +0000

A major SIP security vulnerability was discovered in all versions of Asterisk today. You can read all about it here.

We have developed a script for Asterisk 1.8.x which will quickly patch your system and eliminate the problem. Log into your server as root and issue the following commands:

cd /root
wget http://incrediblepbx.com/sipfix
chmod +x sipfix
./sipfix

Please apply this patch immediately to protect your server!

By: ward

ward — Mon, 15 Nov 2010 17:37:02 +0000

From our pal, Tom King, who is away from the Internet at the moment:

A popular feature I use with my iax trunks between asterisk servers is the following:

encryption=aes128
auth=md5

must be in both peer and user sections

maxauthreq=3

must be in user section

this actually does work.while it is not very strong and it is subject to man in the middle attacks it seems to make it a little more difficult to hack. this is on a 2.5 version of freepbx but I don’t think there has been any changes to iax2 in a long time except for the require token option.

By: Trousle Undrhil

Trousle Undrhil — Mon, 15 Nov 2010 16:33:49 +0000

Ward, you make this look so easy! (And, of course, it *is* easy, but that’s beside the point.)

Thanks for this. I have been trying to get it to work and now I know why I couldn’t get it to work (iptables.)

Can this type of setup for used to allow the (new) Incredible PBX build to be just a dial-tone carrier for another Incredible PBX which hosts the extensions?

[WM: You bet!]

By: thegreatfixer

thegreatfixer — Mon, 15 Nov 2010 14:47:02 +0000

thanks for the updated info

By: Sergio Cury

Sergio Cury — Mon, 15 Nov 2010 14:02:14 +0000

Ward; I have my IAX2 trunks setup very similar to yours, but I can’t get two way video to pass through. I don’t know if it is my asterisk version or not, but I am using your locked 1.4 version. Any thoughts?