<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<blockquote type="cite">
<pre wrap="">Despite of all the arguments on other things we could do, why not increase
the level of security in Asterisk if there is a possibility to do so?
</pre>
</blockquote>
Bottom line here, I think, is that the security holes aren't just in
Asterisk, they're in SIP, and Asterisk has to support SIP. It is SIP
that passes the usernames/passwords in plaintext. If SIP supported a
more secure authentication scheme, Asterisk would support it. <br>
<br>
Of course, that said, SIPS exists... I do believe Digium is working on
SIPS support, no?<br>
<br>
<div class="moz-signature">
<p align="left"><font face="Times New Roman, Times, serif" size="1">
<table border="0" width="317">
<tbody>
<tr valigh="top">
<td>
<div align="center"> <a href="http://www.anteil.com"><img
moz-do-not-send="false" src="cid:part1.08090907.00010000@anteil.com"
alt="Anteil, Inc." border="0"></a>
<table border="0" width="317">
<tbody>
<tr>
<td colspan="3">
<div align="center">
<table width="270">
<tbody>
<tr>
<td>
<hr></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr valign="top">
<td width="134">
<div align="right"><font color="#000000"
face="Times New Roman, Times, serif" size="2"> <strong>Andrew M.
Lauppe<br>
</strong> <em>Consultant</em> </font>
</div>
</td>
<td width="11"><br>
</td>
<td width="148"><font face="Times New Roman, Times, serif"><font
color="#666666" size="1">4051B Executive Park Dr.<br>
Harrisburg, PA 17111<br>
<hr align="left" width="105">+1 (877) OS-LINUX x23<br>
+1 (484) 421-9919 direct </font></font></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</font></p>
</div>
<br>
<br>
Remco Barendse wrote:
<blockquote
cite="mid:alpine.LRH.2.00.0903112000460.23809@raveon.vaag.nu"
type="cite">
<pre wrap="">Now i read a lot of messages with many arguments stating that we should
use iptables, fail2ban and some other things as well as that we should use
secure usernames and passwords.
While this may all be true and valid, obviously there is already an
authentication scheme implemented in Asterisk checking username and
password.
If it is difficult to implement what i suggested with all the options and
configurable settings, why not implement it in a more simple form?
Despite of all the arguments on other things we could do, why not increase
the level of security in Asterisk if there is a possibility to do so?
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
</body>
</html>