<br><br><div class="gmail_quote">On Sun, Feb 12, 2012 at 12:59 AM, Bruce B <span dir="ltr"><<a href="mailto:bruceb444@gmail.com">bruceb444@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If your server is open to the internet and in SIP general section you have nat=no and in peers you have nat=yes or vice versa then it's possible to enumerate your extension. Because Asterisk responds with different messages if the extension exists or not based on that difference in the nat setting then it's possible to tell if an extension 100 exists or not. Over the past few years, Digium has come to realization to respond to all unauthenticated calls the same way in order to thwart any attack attempts or guesses on the extension but it's still not perfect yet as these improvements are done at a really slow pace. Regardless, they are being made and there truely is a security risk.<div>
<br></div><div>I always use nat=yes. I don't even know why nat=no exists as there is nothing that can't be done with nat=yes. Plus nat=yes will take care of some of the surprise one-way audio scenarios as well so why use nat=no at all?! I vote to totally get rid of the nat setting all together and hard code it and set it to yes but again there are others who may not agree.</div>
<span class="HOEnZb"><font color="#888888">
<div><br></div></font></span><div><span class="HOEnZb"><font color="#888888">-</font></span></div><div><span class="HOEnZb"><font color="#888888"><br></font></span></div></blockquote><div><br></div><div>I'm stunned.</div>
<div><br></div><div><br></div><div><br></div><div> </div></div><br>