If your server is open to the internet and in SIP general section you have nat=no and in peers you have nat=yes or vice versa then it's possible to enumerate your extension. Because Asterisk responds with different messages if the extension exists or not based on that difference in the nat setting then it's possible to tell if an extension 100 exists or not. Over the past few years, Digium has come to realization to respond to all unauthenticated calls the same way in order to thwart any attack attempts or guesses on the extension but it's still not perfect yet as these improvements are done at a really slow pace. Regardless, they are being made and there truely is a security risk.<div>
<br></div><div>I always use nat=yes. I don't even know why nat=no exists as there is nothing that can't be done with nat=yes. Plus nat=yes will take care of some of the surprise one-way audio scenarios as well so why use nat=no at all?! I vote to totally get rid of the nat setting all together and hard code it and set it to yes but again there are others who may not agree.</div>
<div><br></div><div>-Bruce<br><div><br></div><div><br><br><div class="gmail_quote">On Sat, Feb 11, 2012 at 6:54 PM, sean darcy <span dir="ltr"><<a href="mailto:seandarcy2@gmail.com" target="_blank">seandarcy2@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I've been lurking on the dev discussion on creating nat=auto. It all leads me to think there's no reason to use nat=no.<br>
<br>
We have about 60 internal sip extensions connected to an multihomed asterisk box where the external ip is not nat'ed. Each of the internal sip contexts has nat=no. On startup I get a slew of warnings about intruders being able to distinguish real extensions. But that isn't right, is it? Or if it is, wouldn't the intruder have to be on the "inside" 10.0.0.0 net?<br>
<br>
But so what? Does nat=no buy you anything? faster? slicker? richer?<br>
<br>
sean<br>
<br>
<br>
<br>
--<br>
______________________________<u></u>______________________________<u></u>_________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/<u></u>mailman/listinfo/asterisk-<u></u>users</a><br>
</blockquote></div><br></div></div>