Registration against domain auth

[PitzKey (Itzik)]

2FA for Extension Registration

Chan_PJSIP doesn’t allow anonymous users to auth unless they either are match by an IP or there is an anonymous endpoint that has been created. Chan_PJSIP doesn’t have the concept of “allow guests” which means it won’t just default to a peer if nothing else matches. So you don’t want anonymous users trying to auth to make calls, no problem. You don’t create an anonymous endpoint and you remove/don’t allow the anonymous identifier to be used. As for using domains, Chan_PJSIP’s username identifi…

Referring to the below

; Matches on user [email protected] in the From user field
[[email protected]]
type=endpoint

;matches on user [email protected] in the From user field
[[email protected]]
type=endpoint

;matches on any 100 user that does not have domain1 or domain2 in the From user field.
 [100]
 type=endpoint

I am testing this, and it works fine.

A couple of questions…

1. Where can I find the documentation for this?
2. Can I use wildcards here? for example *.domain.com
3. If not, is there a way to set multiple domains? Or perhaps aliases.

Thanks

[PitzKey (Itzik)]

Registration against domain auth

[lgaetz (Lorne Gaetz)]

Thanks @PitzKey, if I’m reading this correctly, FreePBX could have a field on the extension advanced tab to accept a ‘Domain’ such that only registration attempts to that domain would be successful. All other registration attempts would receive a 403 and there appears to already be a fail2ban regex to act on the corresponding registration failure log line. Other fields in Asterisk SIP settings could allow aliases to be defined.

I don’t see a practical way of adding the domain manually by editing conf files.

[PitzKey (Itzik)]

@lgaetz

I don’t see a practical way of adding the domain manually by editing conf files.

That’s correct. I’ve been thinking about contributing something to either, like you said, in the advanced tab enter a domain and FreePBX will regenerate the config with [email protected] Or a module which allows you to enter domains, group domains together (helpful if the extension passes a proxy sometimes) and then in the extension advanced tab select a domain or domain group from a drop-down menu.

[cloudpbxfuzz (Lucas Ryan)]

I am very interested in this. Have you implemented this in your FPBX system? If so, how are you doing it? I have seen other PBXs use this ( Like FreeSwitch) and they say that it dramatically cuts down on bots trying to hammer the server.

[dicko]

I believe that currently you can reorder the transport priorities , but there is no way to actually disable the IP transport which kinda allows everything to eventually 'get hammered '.

(This might have changed though )

[PitzKey (Itzik)]

@cloudpbxfuzz

and they say that it dramatically cuts down on bots trying to hammer the server

Asterisk will still respond with a 401 when this is implemented. This does not stop bots from discovering your server, Rather, it’s another layer of security and if you have fail2ban tuned properly it can be another way to lower the amount of requests that do not contain a domain in the REGISTER request.

@cloudpbxfuzz

Have you implemented this in your FPBX system?

No. As this requires modifying the script that actually writes out these conf files. I had no success yet in locating the scripts, so I haven’t done anything yet with this.