[asterisk-users] Securing Asterisk

[Paul Hayes]

On 23/07/11 18:38, CDR wrote:
> I beg to differ. Digium is hiding from the real world and somebody is
> going take the software and run with it. My customers lost in excess
> of $50.000 and cut my pay in half, because of hackers. The hackers
> figured out how to scan every asterisk for weak passwords or open
> ports, and bang them real good. We need two things: a) disable in
> sip.conf the reply for INVITES that have wrong user information, and
> also, b) disable any response to any REGISTER packet altogether. Can
> somebody please write  patch? Or should we go broke trying to stop the
> flood of criminals coming from abroad?
> Federico
>

Not looking for an argument here but you are asking for a solution to a 
problem that doesn't exist.  If you'd done your job properly in the 
first place you'd have put some basic intrusion detection on such as 
fail2ban, OSSEC or just a basic bash script of your own writing.  The 
solution is already there and it's not trying to bodge Asterisk into a 
firewall application.  If you'd done that (and instructions on how to 
are literally all over the Internet and this mailing list) then your 
customer wouldn't be $50,000 down, you'd still have your full pay and 
you'd not be asking for people to break Asterisk's SIP implementation 
(even more :P ) in order to stop you having to do things the right way.

Sorry if the truth hurts...