{"id":177,"date":"2020-02-12T01:31:47","date_gmt":"2020-02-12T01:31:47","guid":{"rendered":"https:\/\/blog.lns.com\/?p=177"},"modified":"2020-05-03T23:03:37","modified_gmt":"2020-05-03T23:03:37","slug":"protecting-your-asterisk-pbx","status":"publish","type":"post","link":"https:\/\/blog.lns.com\/?p=177","title":{"rendered":"Protecting your Asterisk PBX…"},"content":{"rendered":"

Disclaimer:\u00a0 This is likely not everything you should do in securing your FreePBX box, but it is a good starting point.\u00a0 \u00a0It is meant to limit your exposure to the public Internet, but this doesn’t cover exploits that can happen after you lock that down such as from address space you are allowing.\u00a0 Having good credentials, among other security measures is also expected.<\/em><\/p>\n

FreePBX<\/a>‘s GUI makes setting up Asterisk<\/a> a breeze.\u00a0 This is a great product that\u00a0Sangoma has been supporting for a while.\u00a0 You can get the main package at https:\/\/www.freepbx.org\/downloads\/freepbx-distro<\/a>\u00a0for running on your own server or VM.\u00a0 I am running RasPBX<\/a> that is a slightly slimmed down version that runs very nicely on a Raspberry Pi.<\/p>\n

The packages are built on a Debian-based Linux but have some exposure that one needs to do to really lock it down.\u00a0 There are a bunch of applications that are on FreePBX that are listening and waiting for the rest of the Internet to exploit them.\u00a0 You can easily see them by running the command “lsof -i | grep LISTEN”.\u00a0 You may see something like:<\/p>\n

root@asterisk:\/etc\/network# lsof -i | grep LISTEN<\/span>\r\nsshd\u00a0 \u00a0 \u00a0 \u00a0 <\/span>612\u00a0 \u00a0 \u00a0 \u00a0 <\/span>root\u00a0 \u00a0 <\/span>3u\u00a0 <\/span>IPv4 \u00a0 <\/span>10163\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:ssh (LISTEN)<\/span>\r\nsshd\u00a0 \u00a0 \u00a0 \u00a0 <\/span>612\u00a0 \u00a0 \u00a0 \u00a0 <\/span>root\u00a0 \u00a0 <\/span>4u\u00a0 <\/span>IPv6 \u00a0 <\/span>10165\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:ssh (LISTEN)<\/span>\r\nmysqld \u00a0 \u00a0 <\/span>1149 \u00a0 \u00a0 \u00a0 <\/span>mysql \u00a0 <\/span>10u\u00a0 <\/span>IPv4 \u00a0 <\/span>10996\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP localhost:mysql (LISTEN)<\/span>\r\nexim4\u00a0 \u00a0 \u00a0 <\/span>1592 Debian-exim\u00a0 \u00a0 <\/span>4u\u00a0 <\/span>IPv4 \u00a0 <\/span>11165\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP localhost:smtp (LISTEN)<\/span>\r\nexim4\u00a0 \u00a0 \u00a0 <\/span>1592 Debian-exim\u00a0 \u00a0 <\/span>5u\u00a0 <\/span>IPv6 \u00a0 <\/span>11166\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP localhost:smtp (LISTEN)<\/span>\r\nasterisk \u00a0 <\/span>1971\u00a0 \u00a0 <\/span>asterisk \u00a0 <\/span>13u\u00a0 <\/span>IPv6 \u00a0 <\/span>15624\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:omniorb (LISTEN)<\/span>\r\nasterisk \u00a0 <\/span>1971\u00a0 \u00a0 <\/span>asterisk \u00a0 <\/span>14u\u00a0 <\/span>IPv6 \u00a0 <\/span>15625\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:8089 (LISTEN)<\/span>\r\nasterisk \u00a0 <\/span>1971\u00a0 \u00a0 <\/span>asterisk \u00a0 <\/span>15u\u00a0 <\/span>IPv4 \u00a0 <\/span>13884\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP localhost:5038 (LISTEN)<\/span>\r\nnode \u00a0 \u00a0 \u00a0 <\/span>6868\u00a0 \u00a0 <\/span>asterisk \u00a0 <\/span>13u\u00a0 <\/span>IPv6 2435746\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:8001 (LISTEN)<\/span>\r\nnode \u00a0 \u00a0 \u00a0 <\/span>6868\u00a0 \u00a0 <\/span>asterisk \u00a0 <\/span>14u\u00a0 <\/span>IPv6 2435747\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:8003 (LISTEN)<\/span>\r\napache2 \u00a0 <\/span>24214\u00a0 \u00a0 <\/span>asterisk\u00a0 \u00a0 <\/span>4u\u00a0 <\/span>IPv6 \u00a0 <\/span>10221\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:http (LISTEN)<\/span>\r\napache2 \u00a0 <\/span>24214\u00a0 \u00a0 <\/span>asterisk\u00a0 \u00a0 <\/span>6u\u00a0 <\/span>IPv6 \u00a0 <\/span>10225\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:https (LISTEN)<\/span>\r\napache2 \u00a0 <\/span>24215\u00a0 \u00a0 <\/span>asterisk\u00a0 \u00a0 <\/span>4u\u00a0 <\/span>IPv6 \u00a0 <\/span>10221\u00a0 \u00a0 \u00a0 <\/span>0t0\u00a0 <\/span>TCP *:http [...]<\/span>\r\n\r\nroot@asterisk:\/etc\/network# <\/span><\/pre>\n
The first column shows the application that is bound and listening to that port.\u00a0 The last column shows the protocol, what IP address it is bound to and what port.\u00a0 Anything that shows “*:…” means it is listening to all IP addresses on the server.\u00a0 Anything that shows “localhost:…” means it is listening to a local IP address and is not exposed to the public Internet.<\/p>\n
So what are these applications and why do they need to be open to the net?\u00a0 The first one is “sshd” which you likely are using to log into the server with.<\/p>\n
“mysqld<\/a>” is the daemon for the MySQL database that FreePBX uses for configuration and it is bound to the “localhost” so no worry here.\u00a0 If it isn’t you can see\u00a0https:\/\/serversforhackers.com\/c\/mysql-network-security<\/a> for a guide on how to lock down MySQL.<\/span><\/p>\n
“exim4<\/a>” is a mail server.\u00a0 Normally this is used for delivery of mail to users when there is voicemail or there is a report that needs to be mailed out to an administrator.\u00a0 <\/span><\/p>\n
“asterisk” has a number of ports open.\u00a0 The “omniorb” port really is port “8088”.\u00a0 You can see this in the file \/etc\/services.\u00a0 The 8089 port is used by the same feature in Asterisk.\u00a0 This is the “Asterisk GUI<\/a>” framework.\u00a0 FreePBX uses this for interaction with Asterisk.\u00a0 It really should be locked down to the localhost IP address.\u00a0 \u00a0 You can change this to the localhost IP address of “127.0.0.1” in FreePBX’s “Settings” -> “Advance Settings” tab.\u00a0 Change the HTTP and HTTPS bind address entries for these ports and click on “Submit” and then “Apply Config”.\u00a0 Port\u00a05038 is used for the API<\/a> for Asterisk.\u00a0 By the default config, it is already bound to locahost \/ 127.0.0.1.<\/span><\/p>\n
“node” that is listening on ports 8001 and 8003 is the FreePBX\u00a0nodejs<\/a> application that is used for the “User Control Panel (UCP) Node Server<\/a>” that FreePBX uses.\u00a0 This is used for a user to check voicemail, etc.\u00a0 \u00a0You can map Asterisk to use the localhost IP address by going into the “Settings” and then “Advanced Settings” and go to the section called “UCP NodeJS Server” and update the “Bind Address” to “127.0.0.1”.\u00a0 (This seems to be not on FreePBX 15 and is already mapped to the localhost.)<\/p>\n
Session Initiation Protocol<\/b>\u00a0(SIP<\/b>)<\/p>\n
SIP is going to be your biggest risk.\u00a0 \u00a0Depending on the distribution of FreePBX\/RasPBX\/etc., asterisk really has to listen to the SIP ports (5060\/5061) so your phones and providers can send commands to Asterisk to do things like making a call.\u00a0 Having Asterisk just exposed to the Internet at large means that your Asterisk box will be cracked in 30 seconds once you put it on the net.\u00a0 Hackers love to find an exposed SIP server out there to make outbound calls through your box.\u00a0 This obscures who is making the call and they don’t have to pay for the VoIP service.\u00a0 You are.<\/p>\n
There are a number of ways to deploy an Asterisk box.\u00a0 You can either do it behind a firewall with rules on the firewall to allow certain IP addresses to be passed to the Asterisk box or you can have Linux do the filtering.\u00a0 \u00a0FreePBX and RasPBX both have FAIL2BAN<\/a> as an option.\u00a0 \u00a0Fail2Ban is a program that scans the logs of various programs like SSH and Asterisk and looks for times that an IP address is trying to crack into your site and was unsuccessful.\u00a0 If so, it will add a firewall rule on Linux to prevent that IP address from accessing the box for some time frame.\u00a0 By default, this is about 10 minutes.\u00a0 After that, the rule is taken out and that IP address can try again.\u00a0 This can retard the progress of someone trying to crack into your box, but do you really want the hassle?\u00a0 What happens if they do make through?\u00a0 Then you may find some rather expensive bills from your VoIP provider.\u00a0 \u00a0Unless you really want to be serving up SIP to the rest of the Internet, let’s lock this puppy down.<\/p>\n
My installation has a public IP address and I rely on using Linux’s “netfilter” to firewall.\u00a0 Netfilter can be configured a couple of ways.\u00a0 The more traditional is to use IPTABLES.\u00a0 I am not going into detail on how to use IPTABLES as there are plenty of sites that can show you that.<\/p>\n
First off, identify the IP addresses you need to allow to connect to your Asterisk box.\u00a0 This will include your VoIP provider’s\u00a0session border controller\u00a0(SBC) that will be protecting their SIP server.\u00a0 I use VoIP.ms out of Canada and they list their servers on their wiki<\/a>.\u00a0 Also, identify the IP addresses that your phones will be using.\u00a0 This may be on your local LAN or they may be coming from other sites.\u00a0 Hopefully, these are IP addresses that won’t be changing much.\u00a0 In times past, I had to run an Asterisk server that had a number of home employees, so they were coming from cable providers that would change the IP address on occasion.\u00a0 Normally this wouldn’t change that often so it was manageable.\u00a0 Let’s say you have the following IP\u00a0 addresses…<\/p>\n