Security Considerations - Revision history

Dcunningham at 03:52, 8 September 2020

2020-09-08T03:52:42Z

Dcunningham at 04:47, 8 January 2020

2020-01-08T04:47:40Z

← Older revision		Revision as of 04:47, 8 January 2020
Line 13:		Line 13:

	Secure provisioning with a solution such as:		Secure provisioning with a solution such as:
	* Use a provisioning password in Enswitch 4.1 and above		* Use a provisioning password in Enswitch 4.1 and above.
	* Use the source IP setting in Enswitch telephones.		* Use the source IP setting in Enswitch telephones.
	* Restrict access by user-agent.		* Restrict access by user-agent.

Dcunningham at 04:47, 8 January 2020

2020-01-08T04:47:29Z

Dcunningham at 21:52, 16 July 2019

2019-07-16T21:52:21Z

← Older revision		Revision as of 21:52, 16 July 2019
Line 10:		Line 10:
	* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.		* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.

	~~Some~~ ~~systems~~ ~~have~~ ~~tools like SIPSentry~~ to automatically block brute-force ~~SIP~~ attacks.		SIPSentry can be used to automatically block brute-force attacks: http://sipsentry.com/

	Secure provisioning with a solution such as:		Secure provisioning with a solution such as:

Acunningham at 00:35, 15 December 2018

2018-12-15T00:35:28Z

← Older revision		Revision as of 00:35, 15 December 2018
Line 3:		Line 3:
	* Set a daily spending limit and maximum concurrent calls limit for all customers.		* Set a daily spending limit and maximum concurrent calls limit for all customers.
	* Set the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations to be non-zero.		* Set the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations to be non-zero.
	* ~~Requiring~~ long password lengths for phones and people.		* Require long password lengths for phones and people.
	* Change the SSH port from 22 to something non standard.		* Change the SSH port from 22 to something non standard.
	* Use iptables to lock out countries where you do not have customers.		* Use iptables to lock out countries where you do not have customers.
Line 15:		Line 15:
	* Use the source IP setting in Enswitch telephones.		* Use the source IP setting in Enswitch telephones.
	* Restrict access by user-agent.		* Restrict access by user-agent.
	* Restrict access to a ~~privately used (almost secret)~~ domain.		* Restrict access to a private domain.
	* Use HTTP basic authentication.		* Use HTTP basic authentication.
			* Use TFTP username and password authentications.

	Non-technical:		Non-technical:

Dcunningham at 01:05, 12 November 2018

2018-11-12T01:05:06Z

← Older revision		Revision as of 01:05, 12 November 2018
Line 2:		Line 2:
	* Disallow routes to countries that customers don't need, especially high fraud countries.		* Disallow routes to countries that customers don't need, especially high fraud countries.
	* Set a daily spending limit and maximum concurrent calls limit for all customers.		* Set a daily spending limit and maximum concurrent calls limit for all customers.
			* Set the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations to be non-zero.
	* Requiring long password lengths for phones and people.		* Requiring long password lengths for phones and people.
	* Change the SSH port from 22 to something non standard.		* Change the SSH port from 22 to something non standard.

Dcunningham at 22:46, 14 September 2018

2018-09-14T22:46:36Z

← Older revision		Revision as of 22:46, 14 September 2018
Line 12:		Line 12:

	Secure provisioning with a solution such as:		Secure provisioning with a solution such as:
	* Use the source IP setting in Enswitch telephones		* Use the source IP setting in Enswitch telephones.
	* Restrict access by user-agent		* Restrict access by user-agent.
	* Restrict access to a privately used domain		* Restrict access to a privately used (almost secret) domain.
	* Use HTTP basic authentication		* Use HTTP basic authentication.

	Non-technical:		Non-technical:

Dcunningham at 22:45, 14 September 2018

2018-09-14T22:45:59Z

← Older revision		Revision as of 22:45, 14 September 2018
Line 1:		Line 1:
			Technical:
	* Disallow routes to countries that customers don't need, especially high fraud countries.		* Disallow routes to countries that customers don't need, especially high fraud countries.
	* Set a daily spending limit and maximum concurrent calls limit for all customers.		* Set a daily spending limit and maximum concurrent calls limit for all customers.
	* Requiring long password lengths for phones and people.		* Requiring long password lengths for phones and people.
⚫	* Educate customers on choosing good passwords.
⚫	* Have contracts to make sure the right person pays if they are hacked and run up a huge bill.
	* Change the SSH port from 22 to something non standard.		* Change the SSH port from 22 to something non standard.
	* Use iptables to lock out countries where you do not have customers.		* Use iptables to lock out countries where you do not have customers.
	* Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060.		* Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060.
	* Make sure all handsets have a username and password which are not the devices default.		* Make sure all handsets have a username and password which are not the devices default.
	* Monitor servers with a tool like Nagios ~~and~~ or Cacti ~~where there is an~~ alert if there is more ~~than X~~ calls ~~per customer, system~~ ~~etc~~.		* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.

	Some systems have ~~easySysAdmin~~ or ~~fail2ban~~ ~~(for example)~~ automatically block brute force ~~SSH or~~ SIP ~~registration~~ attacks.		Some systems have tools like SIPSentry to automatically block brute-force SIP attacks.

			Secure provisioning with a solution such as:
			* Use the source IP setting in Enswitch telephones
			* Restrict access by user-agent
			* Restrict access to a privately used domain
			* Use HTTP basic authentication

			Non-technical:
		⚫	* Educate customers on choosing good passwords.
		⚫	* Have contracts to make sure the right person pays if they are hacked and run up a huge bill.

Dcunningham at 21:26, 5 November 2017

2017-11-05T21:26:01Z

← Older revision		Revision as of 21:26, 5 November 2017
Line 1:		Line 1:
	* Disallow routes to countries that customers don't need, especially high fraud countries.		* Disallow routes to countries that customers don't need, especially high fraud countries.
	* Set a daily spending limit for all customers.		* Set a daily spending limit and maximum concurrent calls limit for all customers.
	* Requiring long password lengths for phones and people.		* Requiring long password lengths for phones and people.
	* Educate customers on choosing good passwords.		* Educate customers on choosing good passwords.

Dcunningham at 21:29, 23 May 2016

2016-05-23T21:29:14Z

← Older revision		Revision as of 21:29, 23 May 2016
Line 4:		Line 4:
	* Educate customers on choosing good passwords.		* Educate customers on choosing good passwords.
	* Have contracts to make sure the right person pays if they are hacked and run up a huge bill.		* Have contracts to make sure the right person pays if they are hacked and run up a huge bill.
	* Change the SSH port from 22 to something non standard ~~like 9900~~.		* Change the SSH port from 22 to something non standard.
	* Use ~~IPTables~~ to lock out countries where you do not have customers.		* Use iptables to lock out countries where you do not have customers.
	* Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060.		* Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060.
	* Make sure all handsets have a username and password which are not the devices default.		* Make sure all handsets have a username and password which are not the devices default.

← Older revision		Revision as of 03:52, 8 September 2020
Line 1:		Line 1:
	Technical:		Technical:
	* Disallow routes to countries that customers don't need, especially high fraud countries.		* Disallow routes to countries that customers don't need, especially high fraud countries. This is set in System -> Routes.
	* Set a daily spending limit and maximum concurrent calls limit for all customers.		* Set a daily spending limit and maximum concurrent calls limit for all customers. This is set in customers and rate plan fields "Maximum call spending per day" and "Maximum concurrent total calls".
	* Set the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations ~~to be non-zero~~.		* Set phones and people to be locked out after too many failed login attempts. This is set in the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations.
	* Require long password lengths for phones and people.		* Require long password lengths for phones and people. This is set in the "Person minimum password length" and "Telephone line minimum password length" system configurations.
	* Change the SSH port from 22 to something non-standard.		* Change the SSH port from 22 to something non-standard.
	* Use iptables to lock out countries where you do not have customers.		* Use iptables to lock out countries where you do not have customers.
Line 9:		Line 9:
	* Make sure all handsets have a username and password which are not the devices default.		* Make sure all handsets have a username and password which are not the devices default.
	* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.		* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.
		⚫	* Use SIPSentry to automatically block brute-force attacks: http://sipsentry.com/

⚫	~~SIPSentry~~ ~~can~~ ~~be used~~ to automatically block brute-force attacks: http://sipsentry.com/

	Secure provisioning with a solution such as:		Secure provisioning with a solution such as:
	* Use a provisioning password in Enswitch 4.1 and above.		* Use a provisioning password in Enswitch 4.1 and above. This is set in the "Provision password global" system configuration.
			* Restrict telephones to specific IP address(es). This is set in the "Only allow from source IP address(es)" field on the edit telephone line page.
	* Use the source IP setting in Enswitch telephones.
	* Restrict access by user-agent.		* Restrict access by user-agent, by customising the Apache configuration.
	* Restrict access to a private domain.		* Restrict access to a private domain, by customising the Apache configuration.
	* Use HTTP basic authentication.		* Use HTTP basic authentication if supported by telephones, by customising the Apache configuration.
	* Use TFTP username and password authentication.		* Use TFTP username and password authentication if supported by telephones, by customising the TFTP configuration.

	Non-technical:		Non-technical: