Security Considerations: Difference between revisions
Jump to navigation
Jump to search
Content deleted Content added
Dcunningham (talk | contribs) Created page with "* Disallow routes to countries that customers don't need, especially high fraud countries. * Set a daily spending limit for all customers. * Requiring long password lengths fo..." |
Dcunningham (talk | contribs) No edit summary |
||
| (10 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
Technical: |
|||
* Disallow routes to countries that customers don't need, especially high fraud countries. |
* Disallow routes to countries that customers don't need, especially high fraud countries. This is set in System -> Routes. |
||
* Set a daily spending limit for all customers. |
|||
* Set a daily spending limit and maximum concurrent calls limit for all customers. This is set in customers and rate plan fields "Maximum call spending per day" and "Maximum concurrent total calls". |
|||
* Requiring long password lengths for phones and people. |
|||
* Set phones and people to be locked out after too many failed login attempts. This is set in the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations. |
|||
* Require long password lengths for phones and people. This is set in the "Person minimum password length" and "Telephone line minimum password length" system configurations. |
|||
* Change the SSH port from 22 to something non-standard. |
|||
* Use iptables to lock out countries where you do not have customers. |
|||
* Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060. |
|||
* Make sure all handsets have a username and password which are not the devices default. |
|||
* Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected. |
|||
* Use SIPSentry to automatically block brute-force attacks: http://sipsentry.com/ |
|||
Secure provisioning with a solution such as: |
|||
* Use a provisioning password in Enswitch 4.1 and above. This is set in the "Provision password global" system configuration. |
|||
* Restrict telephones to specific IP address(es). This is set in the "Only allow from source IP address(es)" field on the edit telephone line page. |
|||
* Restrict access by user-agent, by customising the Apache configuration. |
|||
* Restrict access to a private domain, by customising the Apache configuration. |
|||
* Use HTTP basic authentication if supported by telephones, by customising the Apache configuration. |
|||
* Use TFTP username and password authentication if supported by telephones, by customising the TFTP configuration. |
|||
Non-technical: |
|||
* Educate customers on choosing good passwords. |
* Educate customers on choosing good passwords. |
||
* Have contracts to make sure the right person pays if they are hacked and run up a huge bill. |
* Have contracts to make sure the right person pays if they are hacked and run up a huge bill. |
||
Some systems have easySysAdmin or fail2ban (for example) automatically block brute force SSH or SIP registration attacks. |
|||
Latest revision as of 03:52, 8 September 2020
Technical:
- Disallow routes to countries that customers don't need, especially high fraud countries. This is set in System -> Routes.
- Set a daily spending limit and maximum concurrent calls limit for all customers. This is set in customers and rate plan fields "Maximum call spending per day" and "Maximum concurrent total calls".
- Set phones and people to be locked out after too many failed login attempts. This is set in the "Telephone line failed registrations lock" and "Person failed logins lock" system configurations.
- Require long password lengths for phones and people. This is set in the "Person minimum password length" and "Telephone line minimum password length" system configurations.
- Change the SSH port from 22 to something non-standard.
- Use iptables to lock out countries where you do not have customers.
- Set Asterisk servers to use non default ports for SIP like 5065 instead of 5060.
- Make sure all handsets have a username and password which are not the devices default.
- Monitor servers with a tool like Zabbix, Nagios, or Cacti to alert if there are more calls than expected.
- Use SIPSentry to automatically block brute-force attacks: http://sipsentry.com/
Secure provisioning with a solution such as:
- Use a provisioning password in Enswitch 4.1 and above. This is set in the "Provision password global" system configuration.
- Restrict telephones to specific IP address(es). This is set in the "Only allow from source IP address(es)" field on the edit telephone line page.
- Restrict access by user-agent, by customising the Apache configuration.
- Restrict access to a private domain, by customising the Apache configuration.
- Use HTTP basic authentication if supported by telephones, by customising the Apache configuration.
- Use TFTP username and password authentication if supported by telephones, by customising the TFTP configuration.
Non-technical:
- Educate customers on choosing good passwords.
- Have contracts to make sure the right person pays if they are hacked and run up a huge bill.