I apologize if I have missed someone’s post, but I have four different customers using a mix of PBXact and Freepbx free distro that have been used to make calls to (for some reason) South Dakota (area code 605) and Iowa (area code 641). All these customers are using Flowroute and each has on their respective Flowroute account IP authentication on and outgoing credentials disabled. But that’s not the source of the problem, it’s the PBX that’s being used to making the unauthorized calls.
I really did a lot of research before I decided to post this and I learned from posts by Lorne Gaetz, Dicko, and a few other experts that I needed to do a few things like remove the T from the Asterisk Outbound Trunk Dial Options in Advanced Settings and remove the Tt from the Asterisk Dial Options in Advanced Settings. I also have fail2ban on and all extensions are using the default complex password assigned by the system.
So the question is this: what else do I need to do to totally stop unauthorized calls from being made? My customers are hopping mad that almost $100 worth of calls were made from people’s extensions (usually, one or two extensions on each system).
To stem the tide of calls to those area codes, I used the advice put forth in this post: https://www.freepbx.org/restricting-outbound-calls-in-freepbx-blacklist/ but I’m not sure that the things I put in place from that post are the right things to do because tomorrow, someone could breach a system and call a completely different area code.
Again, I have searched the forums and the rest of what Google has to offer using all kinds of search terms and all I came up with is mentioned in this post.
Is there a definitive guide that details without a bunch of Linux file manipulation how to make a system bulletproof against unauthorized calls?