[asterisk-users] Anonymous SIP calls

Fri Mar 27 23:41:54 CDT 2015

Hi James,

Fortunately, your theory about common "run for dollars" is false with many 
contra-examples. :)

jh

---------- Původní zpráva ----------
Od: Bruce Ferrell <bferrell at baywinds.org>
Komu: asterisk-users at lists.digium.com
Datum: 28. 3. 2015 0:17:54
Předmět: Re: [asterisk-users] Anonymous SIP calls

"James,

I'm a systems and telecom professional with experience going back more than 
thirty years, to the days of teletype, current loop, POTS (2600hz signalling
anyone?) and echo
cancellation via analog level control and hybrid balance.

Your read of the intent of the VOIP/SIP design correctly. The intent WAS to 
make making connections between endpoints as easy as using a browser.

Unfortunately, setting up ALL of the infrastructure, not JUST the 
registration/switching points (Asterisk/Kamailiao/Freeswitch), can be quite 
daunting... In general, simple DNS is
beyond most and the necessary specialized (and they aren't That SPECIAL) SRV
records make most systems admins run for the hills these days. 

When we see a statement regarding consideration of allowing anonymous calls,
we seeing someone who is (rightly) concerned about fraudulent use of an 
expensive resource... PSTN
interconnect. In the intended vision, that would be a "don't care" scenario,
because the PSTN interconnect wouldn't exist, but it does and it's billed by
it's use making it expensive.

In theory, E164 would have take up closer to that ideal. Asterisk has hooks 
and connections to use it and it's own, competing directory mechanism, 
DUNDi. Let's make special note
of a word I used in that last sentence... Competing. Is DUNDi better? I don'
t know and I'm fairly certain I just touched off a debate on the topic. But 
I do know that when
things start competing/contending, people do a few things:

1.) They take sides and fragment things
2.) The sit on the sidelines and wait for things to settle out

In my experience, this has a tendency to bring things to a halt.

Add to this, most of this tech is really, really only useful to businesses. 
I give my skills to people who need it (Family, friends my old gray haired 
mother-in-law). Businesses
are in the business of making money and if they want the use of my skills, 
they get to pay me. No one I know will perform this type of thing for free 
for a business and we all
compete for the limited pool of resource that business is willing to offer. 
What I have to offer is the "tricks of the trade" I've garnered over a 
lifetime career. There was a
time when systems admins freely swapped these tips, tricks and techniques 
(for the best example see the old Novell Users FAQ). As I mentioned before, 
we who know how to install
and maintain VOIP systems are now competing and the dollars come hard, so 
there seems (at least in the areana of VOIP) less willingness to do this. 
Oddly, VOIP seems to be more
cut throat that any other sector of IT.

Just my experience and I'm sticking to it... and wishing it weren't so and 
that unicorns really existed.

On 03/27/2015 01:03 PM, James B. Byrne wrote:
> On Thu, March 26, 2015 22:29, Michelle Dupuis wrote:
>> You have to consider whether you really want "anonymous" calls, or you
>> just want to enable SIP calls from trusted companies/partners. The
>> latter means setting up routes to these companies and (ideally)
>> registration between peers.
>>
> This is what I am trying to get a handle on. It seemed to me that the
> promise of VOIP was essentially that one could use the Internet as a
> replacement for the PSTN directly, providing that ones callers/callees
> were also directly connected via VOIP. SIP providers I had considered
> a necessary transition to act as gateways between PSTN dialing and
> VOIP until VOIP replaced PSTN virtually entirely if not completely.
>
> That is why we are on Asterisk. We had to replace our old keyed
> system and the thought was that we might as well get ready for VOIP
> even if we planned to stay on PSTN for the foreseeable future.
>
> However, the overwhelming evidence I find is that one simply does not
> employ VOIP in the same way that PSTN works. Actually, I have put
> that backwards. What I have discovered is that the most commonly
> recommended method is to switch from a Telco to A SIP provider and
> continue in a manner similar to the former set-up. External calls all
> have to travel through a third party provider.
>
> One does not accept incoming VOIP calls from just everyone,
> apparently. One only accepts VOIP calls from known correspondents. I
> am not clear why this is so other than vague warnings respecting
> (admittedly real and serious) security issues.
>
> Even limiting VOIP to known correspondents one is ultimately trusting
> that they themselves are secured sufficiently to prevent unauthorised
> access to your systems through theirs. And that seems a bit of a
> stretch by way of rationalisation to me.
>
> Also I do not understand is why the same issues do not exist from
> incoming calls via PSTN.
>
> I somewhat understand the process of getting devices to register and
> authenticate to obtain access to our outgoing routes. What is it
> about incoming SIP calls destined to our internal users that make
> those calls so dangerous? Why cannot incoming anonymous SIP calls not
> be treated exactly as incoming PSTN calls (other than PSTN have to go
> though DAHDI to turn them into digital VOIP calls). What is it that
> prevents them from being blocked from gatewaying through to our PSTN
> lines?
>
> Please forgive my abysmal ignorance on this matter. Perhaps I have
> been down in the weeds too long getting our internal FreePBX system
> working to see what is obvious to others. I have been going theough
> the Asticon Videos on security and have or already had implemented
> most of the suggestions: Outbound LD secured by pins and allowed only
> during work hours; IPTABLES rules and fail2ban checks; Separation of
> voice and data network segments and addresses; Private IP for VOIP
> desk-sets and internal provisioning; and so forth.
>
> However, I still have the sense that I am just not getting it. What
> am I missing?
>

-- 
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --
New to Asterisk? Join us for a live introductory webinar every Thurs:
http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20150328/3e54acf2/attachment-0001.html>