Security Best Practices

From FreeSWITCH Wiki
Jump to: navigation, search


Warning

Superseded by https://confluence.freeswitch.org/display/FREESWITCH/Security

 


Contents

Informal Security Discussion

  • What are your security best practices?
  • What techniques do you use?
  • How do you balance security vs. ease of use?

Security is about mitigating risks and providing ease of use, problem detection and remediation while protecting the most important characteristics of the system. This section will provide a number of directions to look at.

General Recommendations

If you are not using VPN or on a local intranet with the FS server make sure to use SIP_TLS as all sip traffic and authentication is in the clear otherwise.

The most basic things for any system include:

  • Have a router with SPI firewall between your system and the Internet
    Do not put your system in the router DMZ (where all default incoming traffic will be sent)
  • Change all system passwords and set them to strong ones.
  • Install the latest patches for your OS
  • Setup an IDS like Snort or AIDE
  • Use fail2ban to limit password / id guessing (linux only)
  • Setup a firewall - configuration to be described later in the page
  • Install an Anti-Virus (Windows)
    Remember that AVG seems to interfere with compilation
  • ... please add to this list ...

Sources to consider:

  • SNORT [1]
  • Linux only: AIDE [2]
  • Windows only: Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista [3]

Freeswitch Configuration

Passwords and other confidential information to change and protect

Your freeswitch configuration will have a number of areas where confidential information is stored. Here is a list to start with:

  • User names and passwords
  • Proxies or Gateways names and passwords
  • Other module configuration... please add ...

Please change the following elements of the default configuration:

  • users 1000 to 1019 and their passwords (good ideas to remove them completely)
  • change the default vm password

Local Registrations

  • For company that accept only static IP address should use registeracl and add there customers IP to the ACL for register protection.
  • Limit the number of connections per second or per minute, depending on your setup, on your firewall. This way if there are more attempts than there should be, your firewall should block them before they even get to FS. Your firewall rules may follow this general scheme: (1) Accept signaling or media traffic from trusted IPs and apply connections per second rules based on their traffic pattern; (2) Accept signaling or media traffic from any IP but with the condition that if a single IP exceeds a certain connections per second number then block that IP temporarily or permanently (depending on the situation). pfSense blocks that IP for one hour automatically if the rule has this setting enabled. Using iptables it is also easy to create such a rule (see Using iptables to rate-limit incoming connections).

Firewall configuration

An example configuration for iptables can be found at Iptables on debian.

General Settings

SIP specific settings

Accepting SIP registrations from outside your network