[asterisk-dev] Asterisk Network Security Idea (using tcp_wrappers)

[Andrew Kohlsmith (lists)]

On March 29, 2009 06:00:47 pm Joseph Benden wrote:
> Yes, to an extent. I do believe that the system shouldn't "out of the
> box" be insecure to a point of having a tremendous number of security
> holes. In fact, it should default to being impossible to receive or
> place ANY calls, manager connections, etc. I think the model of deny-
> all is absolutely the best default. This is really something we all
> should consider for Asterisk. (eg: even the default sample "demo"
> context shouldn't be enabled.)
>
> However, I do not think that Asterisk should come, by default, set up
> to receive distributed lists of IP addresses and subnets to block,
> nor default to altering peoples IPTables lists, or refuse any
> connections, etc.

As a seasoned Asterisk user and developer, I agree with this sentiment 100%.

The default "sample" configurations that come with a new build should 
be "reasonably" secure, and should also be VERY vocal about why a call isn't 
getting accepted.  This can all be done through everyday normal dialplan 
logic.  There is *ZERO* need for central repositories of IPs to block, zero 
need for a tcp wrapper type interface, nada.

Make it reasonable, and give them links or keywords to search on if they want 
to jump to paranoia mode.  If Trixbox, etc. want to employ these lists, that 
is certainly up to them and is their perogative.  But Asterisk the product 
should not have any tie-ins to any of these things.

-A.