Security is about mitigating risks and while providing ease of use, problem detection, and remediation while protecting the most important characteristics of the system. This section will provide a number of points to consider.
- What are your security best practices?
- What techniques do you use?
- How do you balance security vs. ease of use?
If you are not using a VPN or nor on a local intranet with the FS server make sure to use SIP_TLS as all sip traffic and authentication is in the clear otherwise.
- Have a router with SPI firewall between your system and the Internet; do not put your system in the router DMZ (where all default incoming traffic will be sent)
- Change all system passwords and set them to strong ones.
- Install the latest patches for your OS
- Setup an IDS like Snort or AIDE
- Use fail2ban to limit SIP password / id guessing (linux only)
- Setup a firewall - configuration to be described later in the page
- Install an Anti-Virus (Windows); remember that AVG seems to interfere with compilation
- Use ipset to manage your own i.p. addresses, ports, MAC addresses, etc at much lower performance penalty
- bkw's example script f-off friendly scanner.pl
Sources to consider:
- SNORT 
- Linux only: AIDE 
- Windows only: Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista 
Other Confidential Information
- User names and passwords
- Proxies Proxy or Gateways Gateway names and passwords
- Other module configuration... please add ...
- users 1000 to 1019 and their passwords (good ideas to remove them completely)
- change the default vm voicemail password
- For company Companies that accept only static IP address should use registeracl and add there customers their customer's IP to the ACL for register registration protection.
- Limit the number of connections per second or per minute, depending on your setup, on your firewall. This way if there are more attempts than there should be, your firewall should block them before they even get to FS. Your firewall rules may follow this general scheme:
- (1) Accept signaling or media traffic from trusted IPs and apply connections-per-second rules based on their traffic pattern;
- (2) Accept signaling or media traffic from any IP but with the condition that if a single IP exceeds a certain connections-per-second number then block that IP temporarily or permanently (depending on the situation). pfSense blocks that IP for one hour automatically if the rule has this setting enabled. Using iptables it is also easy to create such a rule (see Using iptables to rate-limit incoming connections).
An example configuration for iptables can be found at Iptables on debian.
SIP specific settings
Accepting SIP registrations from outside your network
by Bret McDanel
It may be interesting to add rate-limiting of incoming SIP traffic. Below is an example of how this can be done. If you use the default internal and external sip profiles then you should block on both ports 5060 and 5080.
# Trixter's SIP rate limiter (This helps protect you from DoS attacks) iptables -A INPUT -p udp --dport 5060 -m limit --limit 5/s --limit-burst 5 -i eth0 -j REJECT iptables -A INPUT -p udp --dport 5080 -m limit --limit 5/s --limit-burst 5 -i eth0 -j REJECT
DoS REGISTER Attack Prevention
iptables -A INPUT -m string --string "REGISTER sip:" --algo bm --to 65 -m hashlimit \ --hashlimit 4/minute --hashlimit-burst 1 --hashlimit-mode srcip,dstport \ --hashlimit-name sip_r_limit -j ACCEPT iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm
iptables -A INPUT -d YOUR_FS_IP -p udp -m udp --dport YOUR_FS_PORT -m string \ --string "REGISTER" --algo kmp --from 20 --to 60 -j dos-filter-register-external iptables -A dos-filter-register-external -m hashlimit --hashlimit 5/sec \ --hashlimit-burst 8 --hashlimit-mode srcip --hashlimit-name REGISTER \ --hashlimit-htable-size 24593 --hashlimit-htable-expire 90000 -j RETURN iptables -A dos-filter-register-external -j REJECT --reject-with icmp-admin-prohibited