What kind of trunk (pjsip or chan sip) for your carrier? Is port 5060 on your box ties to pjsip or chan sip?
In Reports->Asterisk Info, does Peers show the trunk as online? If using registration, does Registries show it as registered? If not, fix those things first. pjsip logger should show REGISTER and OPTIONS requests and any responses.
If the trunk is online, pjsip logger should show an outgoing INVITE for a call attempt and any responses.
Let me say, thanks for your patience and assistance.
All is working and each of the issues that have been raised in this thread addressed.
In reviewing security settings Flowroute documentation suggested to disable SIP Credentials if using a static IP host as I am. Doing this now appears to have what disabled outbound calling. Enabling SIP Credentials restored outbound calls. Great.
But we lost inbound calls. (Really!?) As I said, I had changed the SIP port but changed it in both: CONNECTIVITY-TRUNKS - SIP SERVER PORT and
SETTINGS - ASTERISK SIP SETTINGS - CHAN PJSIP SETTINGS - UDP - PORT TO LISTEN ON
and change the port at Flowroute. I realized this was wrong and changed it back,
Though I had changed the SIP Port back to 5060 in CONNECTIVITY-TRUNKS - SIP SERVER PORT and in Inbound Routes at Flowroute, it was still using the modified port number. Deleting and recreating the Inbound Route at Flowroute fixed that.
So, to address Suspicious Activity we have:
- Changed all passwords for users and device secret words.
- Made all device secret words longer and unique, had been all the same and 8 chars.
- Changed provisioning to http rather than tftp.
- Verified all IP addresses in whitelist
- Verified Firewall enabled
- Verified Responsive Firewall was enabled for SIP.
- Enabled IP Authorization for connection to SIP provider.
- Verified all open ports and confirmed standard ports not used for http and ssh.
Best guess as to how the attacker got access was promiscuous TFTP provisioning.
What I need to learn yet is how to read log files and SIP traffic.
This wonât do you any good unless either itâs password protected (the phone or other device must supply a password to retrieve its provisioning info) or itâs firewalled (only authorized IP addresses can access provisioning data).
Using an obscure port is a big help if you do it from the start; the bad guys canât afford to scan every port on the internet. But once your machine has been compromised, unless you have changed your IP address, they will scan every port on your IP in an attempt to regain access.
Each phone has a unique password for provisioning. Obscuring the provisioning port is a good idea, thanks. I have to assume someone has my ip.
Switch to using a domain and change the IP, if possible.
HTTPS provisioning will encrypt the registration.
https://wiki.freepbx.org/display/FPG/System+Admin+-+Provisioning+Protocols#SystemAdmin-ProvisioningProtocols-HTTP(s)Authentication
That is in the PRO version of Admin.
So youâre saying after being pwned and having traffic pumps twice in a week period that $25 is too much for your security measures?
3 Likes
Understood resources may be constrained, but for what it is worth, this is one of the best modules offered, price to features provided.
We do almost everything custom and in dialplan/AGI these days, but we still make it a point to buy this module for every box. It saves time and is very helpful in making sure we have the basic security needed in place. It also gives back to the people you are counting on to continue support (youâve been receiving support from employees via your forum posts too) and patching. The final consideration is the one-time $25 is much less than you would pay if the box was compromised due to something the module could help you avoid.
Time Saved + Security Provided + Funds The Project At Reasonable Price = WIN 
I strongly recommend you purchase this module.
1 Like
This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.