RECOMMENDATIONS Security on a hosted VPS?

awair

Member
Joined
Mar 10, 2009
Messages
87
Reaction score
4
I've been reading over the old and new threads about securing a PBX.

In summary there has been a subtle shift (over the years) from making the PIAF distro "a well-maintained PBX, with security in mind" to "a machine with no open ports, secured behind a hardware firewall".

Realising that total security consists of many layers and a multi-faceted approach, what are the recommendations when a hardware firewall is not available?

In the case of a hosted (VPS), whether from a PBX-oriented or a more general provider, what are the options for best securing a PIAF server connected directly to the internet, unable to use a hardware firewall?
 

wardmundy

Nerd Uno
Joined
Oct 12, 2007
Messages
19,170
Reaction score
5,199
When you're on the wide open Internet, the options are more limited, but it's still the Bundle of Sticks approach. It's harder to break a bundle of sticks than it is to break one.

Our recommendation is an air-tight WhiteList using Travelin' Man 3* coupled with Fail2Ban which will block most (not all) brute force attacks. You also obviously need very secure extension passwords and very, very secure root and maint passwords. Also be sure your hosted VPS has a patched version of OpenSSL in place that addresses the recent Heartbleed Bug.

* Don't make it so air-tight that you lock yourself out. Include entries for the IP address of your cloud-based server and your home and smartphone public IP addresses.
 

awair

Member
Joined
Mar 10, 2009
Messages
87
Reaction score
4
Ward, thank you again. I had already completed most of these steps, but will need to look again at the Travellin' Man option.

I requested a stock CentOS 6.5 for my VPS, ran the PIAF script and patched OpenSSL myself. All the passwords are random 20+ characters.

I only have 2 Trunks setup at the moment, both (deliberately) with no outward dialling capability. But I see in the CDR logs, numerous attempted connections from random numbers (e.g. 100, 101, 123, 1234 etc) all with destination 's'. I am trying to understand and prevent this, before linking this VPS to my primary PBX. I've used the Blacklist feature successfully on some numbers, but different random ones are used subsequently over the next few hours.
 

wardmundy

Nerd Uno
Joined
Oct 12, 2007
Messages
19,170
Reaction score
5,199
Blacklists are next to worthless. Add TM3 and you'll sleep better.
 

howardsl2

Guru
Joined
Aug 5, 2013
Messages
88
Reaction score
25
Travelin' Man 3 surely will help as Ward mentioned. Also see my tutorial here which provides other important tips on securing your Asterisk PBX with IPTables.
 

Albert S

Member
Joined
Jul 21, 2013
Messages
122
Reaction score
7
I can't find the custom url additions after http:mydomain.com:83/??xx??

Where do I find them for every extension?

Another question. Let's say I have an office with 10 phones and I have TM3 deployed.

Do I have to authorize all the extensions at least once if I don't want to touch iptables manually? Or is it OK authorizing the office's IP with one extension?
 

wardmundy

Nerd Uno
Joined
Oct 12, 2007
Messages
19,170
Reaction score
5,199
Read the Traveling Man 2 tutorial. We've been discussing TM3.
 

Albert S

Member
Joined
Jul 21, 2013
Messages
122
Reaction score
7
Hi Ward,

You are referring to this one correct? http://nerdvittles.com/?p=689

Quick question, how long does Travellin' man white lists the IP address if the custom URL was clicked?
(I am asking to see if my users needs to keep clicking it from their office which has a static IP or not, is there a way to allow an IP forever? that's not written in TM2's article)
 

Albert S

Member
Joined
Jul 21, 2013
Messages
122
Reaction score
7
Also when I visit custom URL, what permissions does it give? Like SSH and everything ?

Because we are opening UDP 5060 and 10000-20000 for public anyways?
 

Albert S

Member
Joined
Jul 21, 2013
Messages
122
Reaction score
7
Now when I install Travellin' man 3 on PIAF Green. I only had Ext 104 configured.

Travellin' Man 3 came preconfigured for Ext 501...

When I visited 501's URL I got the sitting man picture :) but it did not allow my Ext 104 to register (I believe it's expected)

I created extension 501 and tried the URL again but it did not allow me to register that neither.
(As this is a test box I left extensions's secret as blank I believe that wouldn't have caused)

Any ideas?


--

Also, let's say I have an Incredible PBX with TM, and lost my administration IP, let's say I moved or deleted / released that IP address that I set as administrator.

How do I administrate Incredible PBX? If I go to a client site that's whitelisted could I SSH in from there?
 

wardmundy

Nerd Uno
Joined
Oct 12, 2007
Messages
19,170
Reaction score
5,199
Internal subnets are always whitelisted in TM3, e.g. 192.168.0.x and 10.0.0.x.
 

Members online

Forum statistics

Threads
25,783
Messages
167,515
Members
19,203
Latest member
frapu
Get 3CX - Absolutely Free!

Link up your team and customers Phone System Live Chat Video Conferencing

Hosted or Self-managed. Up to 10 users free forever. No credit card. Try risk free.

3CX
A 3CX Account with that email already exists. You will be redirected to the Customer Portal to sign in or reset your password if you've forgotten it.
Top