The intent of this post is to cover some basic security precautions that should be followed with PBXs that will minimize exposure to vulnerabilities. I am not writing this for those of you who are experienced and have been running FreePBX for years. This is for those new to FreePBX. Right now the social media AND the national news cycle are going bananas over this vulnerability because of the seriousness and the fact it’s been there in the Linux kernel for a decade, and that it’s so easy to exploit. The usual parties - shills funded by commercial software houses - usually, are stirring the pot with their “this is why open source software is bad” narratives, and there is a LOT of repeated information that really doesn’t tell anyone, anything.
FreePBX 17 at the current time of this writing requires Debian 12. Debian 12 is currently vulnerable to this security hole. Thus, any FreePBX is vulnerable. Period. See the following:
Note that this is being worked on as I write this. It may be fixed tomorrow. Or a week from now.
Note that Ubuntu Linux is derived from Debian but it’s not a simple modified Debian distribution, basically Ubuntu and Debian are braided together. And Ubuntu is big. I mean, REALLY BIG. It’s the largest Linux distro out there. What is going on in Ubuntu-land goes hand in hand with Debian-land and right now Ubuntu is a madhouse. It’s so bad in fact that the ubuntu.com website went off the Internet today, it is offline right now as I write this.
All of this was intentional. The security researcher who found this hole wasn’t working alone. He’s part of a startup company that is trying to make a name for itself by smashing big giant plate glass windows. This company setup a special vanity domain to boast about this:
And more importantly - they are PROMISING more to come, more windows will be smashed. This is detailed here:
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint
The quote is:
“…The scan also identified other high severity vulnerabilities, including another privilege escalation bug. These other bugs are still in the responsible disclosure process…”
So this isn’t going to be the first go around. This company is going to continue dribbling out these vulnerabilities, and engineering them as Zero-Days, to send the news feeds a-twitter. It’s pure advertising for them and they don’t really care how many people they screw over doing it. The responsible thing would have been to package ALL vulnerabilities they found into one omnibus kernel patch and be done with it. But that isn’t going to get the best advertising for them.
All of this means that it’s incumbent on anyone setting up a FreePBX system to really focus on doing it in a secure manner because the really bad actors - Russian Mafia, etc. - are working on exploits right now. These idiots at Xinit Code are laying out how they are going about what they are doing, and giving deep pocket dictatorships and organized crime a roadmap to do the same thing.
So how do you secure against this? Well, that is the point of this post! Here are MY guidelines for doing it. Hopefully more experienced members here on this forum will add theirs.
-
Don’t setup a FreePBX system with an unrestricted SIP port that any phone on any network on the Internet can register into. Yes I know you have dreams of making a million dollars selling Cloud PBXes. So do a ton of other people almost all of them could do it better than you. Just please - let go the dream.
-
use network access lists on your firewall/border gateway router to restrict incoming traffic to your PBX system to specific IPs. If you subscribe to a SIP provider on the Internet, great. Make them give you their source IPs for their trunks.
-
For “roaming” softphones use a VPN. You can run a VPN client on your cell phone, on your laptop, on your tablet, and VPN into a VPN server on your network. Then you can run your softphone and register into your PBX and go to town.
-
Do not expose the FreePBX webserver to ANY remote IP address other than the subnet you configure it from. Set the Require IP directives in /etc/apache2/sites-available/freepbx.conf
-
FreePBX should NOT be run on a “shared” server. Yes, the FreePBX system is a webserver. Yes you can setup multiple sites on it. But you are just expanding the attack surface.
-
This vulnerability is going to be most useful to a remote attacker in conjunction with other exploits so the more stuff you put on the PBX server the more potential stuff that can get exploited will be on it.
-
Don’t go off-script. Unless you know what you are doing, don’t compile your own Asterisk, don’t use chan_sip, don’t try to beat FreePBX into some Arm-based thing you bought for $10 off AliBaba, or some Piece of Garbage antique laptop that everyone in your family threw in the garbage that you “rescued” Use a standard desktop, with a hard disk, with a real ethernet port, and a real keyboard mouse and monitor.
-
Virtualizing a PBX while it brings lots of benefits, (and it’s what I do, incidentally) is advanced stuff.
-
Sticking a PBX into a cloud virtual server is also advanced stuff. Incidentally one of the big threats that Xinit is making is “It is a container escape primitive and a Kubernetes node compromise vector” In other words, they are saying someone could use a variant of this to break out of some Amazon Web Services virtual image and trash 10,000 AWS VMs.
Anyway, there you go - the basics! Have phun! 
