Chapter 26. Security

Table of Contents

Scanning for Valid Accounts
Authentication Weaknesses
Fail2ban
Installation
iptables
Sending email
Configuration
Encrypted Media
Dialplan Vulnerabilities
Securing Asterisk Network APIs
IAX2 Denial of Service
Other Risk Mitigation
Resources
Conclusion—A Better Idiot

We spend our time searching for security and hate it when we get it.

John Steinbeck

Security for your Asterisk system is critical, especially if the system is exposed to the Internet. There is a lot of money to be made by attackers in exploiting systems to make free phone calls. This chapter provides advice on how to provide stronger security for your VoIP deployment.