Asterisk PBX Support

Connect your open source PBX to our SIP trunks.

IPComms began connecting our SIP trunks to Asterisk® PBXs in 2002. And not to brag, but since then, we've successfully provided over 30,000 SIP/IAX trunks to almost every version of Asterisk on the market.

So, whether you're a forum-surfing, wiki-reading, ISO-burning open source PBX newbie or a full-fledged, Digium® certified, card-carrying member of every Asteriskusers group on the Web... we're sure to be the SIP Trunking service provider you want in your SIP.conf file

Our USA-based support staff is here to help you get your Asterisk PBX connected to our IPComms' SIP trunks. In fact, we'll prove it to you!  Sign up for our Free SIP Trunk Trial and experience our extremely high-quality service and technical support for yourself.  We also have plenty of Asterisk PBX Videos and Asterisk Tutorials available online.

ASTERISK PBX SECURITY TIP #1

ASTERISK PBX SECURITY TIP #1

If you own or operate an Asterisk PBX, trust us, security will be a priority for you... either now or later! If you only do one thing to secure your PBX, take this next piece of advice seriously! What ever you do, no matter how tempting it may be, Never, Never, Never...

... use the default passwords on any PBX. Password security is one of the easiest security measures you can take and by far one of the best ways to stop the top 99% of all hacks as weak password security is easily the most common way hackers enter IP PBX systems.

When installing your IP PBX, the very first step should be to replace both the username and passwords of any account with administrator access. Secondly, when creating user accounts, be sure not to use or allow easy to guess passwords like “1234”, “password”, “companyname1”, extension numbers, etc. Be sure to use strong and unique passwords. This can't be stressed enough.

As tempting and simple as it may be to use your business name with a single digit added to the end of it, don't do it. You would be surprised what these password detectors can figure out with just a little of your business information.

If you need help securing your PBX, contact a member of our technical support team. We'll be happy to help you secure your Asterisk PBX.

PBX in a Flash (Resetting the root password)

Resetting a root Password

How to reset a root password in PIAF and generic RHEL(Red Hat Enterprise Linux) based systems.

Having the ability to reset your PIAF password in-case of a lock-out is very vital when it's necessary to keep an open communication. Resetting a password may take a few minutes.

    • Reboot your server
    • When you see the GRUB loader quickly press a key to disrupt the normal booting process

    • Press the letter "e" to edit
    • Highlight the vmlinuz ...Kernel selection and press the "e" to edit

    • On the end of that line, type,"single" to make the server boot in "single-user mode". Then type "b" this boot the system,and the bash prompt will appear.

    • Once the kernel is booted, you should see a command prompt
    • Type "passwd root" to reset your password
    • Reboot as normal and log in using your new password

You can see, there are options to reset other passwords in PIAF from this menu as well.

*This should work on most RHEL-based systems

***Some devices may have SELINUX enabled or enforced, so it may not work if that is the case.

FreePBX EndPoint Manager

EndPoint Manager

EndPoint Manager is a module within FreePBX®, that can be used to install and provision IP phones as well as manage firmware updates. This is a very useful tool that works with the most of the major brands. As an example we will setup a Cisco phone, to begin select Install on Cisco. Next, you will see available models for that brand, select Enable for your current model. Next, go to the Advanced Settings and set the IP Address of the PBX, and set the directory where phones will update the firmware from.

 

Through the use of this module, you can optimize provisioning, and manage phones without having to physically configure the phones through each GUI interface, or creating multiple configuration files.

 

FreePBX® is a Registered Trademark of Schmooze Com, Inc.

Setting up your IAX Trunk inside PBX in a Flash/FreePBX

Setting up your IAX Trunk inside PBX in a Flash

  • Setting up a IAX Trunk is very similar to a SIP Trunk, the biggest difference in registration is the Register String. The IAX trunk contains more information than a SIP Trunk. Trunk information can be copied over just like setting up the SIP Trunks
  • Make sure to set the registration string as; username:password@domain
  • If you would like to see if trunks are registered you can go to the FreePBX System Status and look at IP Trunk Registrations.
  • In the SIP Trunk make sure the contact field behind the registration string. The setup for the registration string will be username:password@domain/sipContact(username)
  • After you have created your IAX Trunk you need to modify the Asterisk IAX Settings inside the Tools.
  • Inside here you will be able to make changes to the Codec's, bandwidth control, and multiple other settings.
  • These items will need to be checked if you have any special type of NAT setup inside the firewall or company.
  • Be sure to open up Port 4569 inside your firewall, as well as ports 10,000-20,000 which are mainly for SIP, but IAX uses some of those ports

How to Install Asterisk PBX with Ubuntu/Debian (Linux OS)

Below are the steps to building Asterisk PBX on a Debian/Ubuntu Linux OS

The current build was done on Ubuntu 12.04.3 LTS. This should world on Debian Wheezy and Higher.
This is a vanilla install of Asterisk 13, with no Web Interface or extra features.

 

Let's start by running these commands:

root@asterisk-13-build-ubu~# sudo apt-get update
root@asterisk-13-build-ubu:~# sudo apt-get install build-essential

  

Build essentials will install the following Packages:

binutils
cpp
cpp-4.6
dpkg-dev
fakeroot
g++
g++-4.6
gcc gcc-4.6
libalgorithm-diff-perl
libalgorithm-diff-xs-perl
libalgorithm-merge-perl
libc-bin
libc-dev-bin
libc6
libc6-dev
libdpkg-perl
libgomp1
libmpc2
libmpfr4
libquadmath0
libstdc++6-4.6-dev
linux-libc-dev
make manpages-dev

 

You will then install these below packages:

root@asterisk-13-build-ubu:~#
apt-get install –y git-core subversion libjansson-dev sqlite autoconf automake libtools libxml2-dev libncurses5-dev

 

From here, you are able to download asterisk 13 and compile it.

root@asterisk-13-build-ubu:~# cd /usr/src/
root@asterisk-13-build-ubu:~# wget http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-13-current.tar.gz
root@asterisk-13-build-ubu:~# tar –xzvf asterisk-13-current.tar.gz
root@asterisk-13-build-ubu:~# cd asterisk-13.0.0/
root@asterisk-13-build-ubu:~#./contrib/scripts/install_prereq install ( this will install more packages, a lot of them)
root@asterisk-13-build-ubu:~# ./bootstrap.sh
root@asterisk-13-build-ubu:~# ./configure
root@asterisk-13-build-ubu:~# make && make install
root@asterisk-13-build-ubu:~# make samples
root@asterisk-13-build-ubu:~# sudo make config
root@asterisk-13-build-ubu:~# asterisk

 

From here, asterisk should already be running and you can log in with this command:

root@asterisk-13-build-ubu:~# asterisk -r


Connected to Asterisk 13.0.0 currently running on asterisk-13-build-ubu (pid = 7459)
asterisk-13-build-ubu*CLI>

 

Asterisk is Ready.

 

Connecting SIP trunks with IP Authentication (Asterisk/FreePBX)

IPComms allows two types of SIP trunking when connecting to our network. Our default registration method and by far the most common, is basic SIP Registration.  This method uses a SIP username and password with a registration string to connect to our SIP network.  The second methog, which is less common, but useful in many scenarios, is SIP IP Authentication.  

This article will cover registering your Asterisk PBX to IPComms using SIP IP Authentication.

 

NOTE: Be careful when editing information within your configuration files. It is best practice to perform a complete back up before modifying settings within your PBX. Any custom configurations may cause you phone system to behave differently than intended.

 

We'll begin by creating an outbound SIP trunk.

To place outbound calls in Asterisk systems, you will need to create an outbound trunk entry which will route outbound calls to the IPComm's SIP network and also configure how phone numbers will be delivered by configuring your dial plan settings in your extensions.conf file.  This article will walk you through this process.

This sample configuration shows how to add and configure an outbound SIP trunk using the FreePBX front end interface. Most importantly, we will be adding entries into the Peer Details and User Details sections.

 

 Step-by-step SIP trunk creation:

  • To begin, navigate to the Trunks section of the main menu.
  • From here, you will provide an arbitrary trunk name (you can make this anything you want).
  • Next, you will name your trunk in the Trunk Name field.  (Again, you can name this anything you want to.)
  • Now, you will paste your peer details into the area given.  This information should have been sent to you by IPComms in your provisioning letter.  It should look similar to the sample screenshot given below.
  • Next, you will paste the same information into your user details into the area given.  
  • There will be no registration string as this example is for IP Authentication.  For SIP registration, see our SIP registration example.
  • Finally click Submit Changes, and you are all set.

 

FreePBX Screenshot -Add SIP Trunk (click to enlarge)

IPAuth FreePBX Config

 

 

 

 

 

The next step is to create an outbound route in FreePBX/Asterisk PBX.

The outbound route is used to determine what numbers will be routed to the new Outbound Trunk you just created.  Your specific outbound routing rules might differ, but below is an example of sending 7, 10 and 11 digit phone numbers out of the SIP trunk you just created.  

In this example, we've created 3 entries

  • 1NXXNXXXXXX ....(11-digit dialing)
  • NXXNXXXXXX ....(10-digit dialing)
  • NXXXXXX .... (7-digit dialing)

Then we'll route these calls to our IPComms-Static trunk in the Trunk Sequence for Matched Routes section of our FreePBX/Asterisk PBX outbound route page.

 

Outbound Routes

 

 

IPComms SIP Trunk Registration (Asterisk/FreePBX)

IPComms SIP Trunk Registration (Asterisk/FreePBX)

The first step in making and receiving phone calls using the IPComms SIP trunking network is registering your SIP device to our network using SIP registration. This article will cover registering your Asterisk PBX to IPComms using SIP IP Authentication.

 

NOTE: Be careful when editing information within your configuration files. It is best practice to perform a complete back up before modifying settings within your PBX. Any custom configurations may cause you phone system to behave differently than intended.

 

We'll begin by creating a SIP trunk.

SIP registration is the process in which the endpoint sends a SIP REGISTER request to our SIP trunking (the SIP SERVER) to let the server know where it is.  SIP registration requires a SIP username, SIP password, and the SIP server address.  To place and receive calls in Asterisk PBX, you will need to first add a SIP trunk entry which will be used to connect to IPComm's SIP network.   This article will walk you through this process.

This sample configuration shows how to add and configure an IPComms SIP trunk using the FreePBX front end interface. Most importantly, we will be adding entries into the Peer Details and User Details sections.

Note: Alternatively you can choose to connect to IPComms with IP authentication rather than SIP username/password registration.  To enable IP authentication on your IPComms account, contact technical support and request the change.

 

 Step-by-step SIP trunk creation:

  • To begin, navigate to the Trunks section of the main menu.
  • From here, you will provide an arbitrary trunk name (you can make this anything you want).
  • Next, you will name your trunk in the Trunk Name field.  (Again, you can name this anything you want to.)
  • Now, you will paste your peer details into the area given.  This information should have been sent to you by IPComms in your provisioning letter.  It should look similar to the sample screenshot given below.
  • Next, you will paste the same information into your user details into the area given.  
  • There will be no registration string as this example is for IP Authentication.  For SIP registration, see our SIP registration example.
  • Finally click Submit Changes, and you are all set.

 

IPComms SIP Trunk Registration - FreePBX/Asterisk -  (click to enlarge)

SIP TRUNK REGISTRATION IPCOMMS FREEDID

 

 

 

To verify that your PBX is registered with IPComms, Click FreePBX System Status on the main menu, and you will see the number of IP Trunk Registrations under the FreePBX Conections section:

 

FreePBX System Status

 

 

The next step is to create an outbound route in FreePBX/Asterisk PBX.

The outbound route is used to determine what numbers will be routed to the new Outbound Trunk you just created.  Your specific outbound routing rules might differ, but below is an example of sending 7, 10 and 11 digit phone numbers out of the SIP trunk you just created.  

In this example, we've created 3 entries

  • 1NXXNXXXXXX ....(11-digit dialing)
  • NXXNXXXXXX ....(10-digit dialing)
  • NXXXXXX .... (7-digit dialing)

Then we'll route these calls to our IPComms-Static trunk in the Trunk Sequence for Matched Routes section of our FreePBX/Asterisk PBX outbound route page.

 

Outbound Routes

 

 

What is Telecom Fraud?

What is Telecom Fraud?

Plain and Simple.  Telecom fraud is theft!

So, you just received your monthly phone bill from your phone service provider.  What you expect to see is a total somewhere around 30 or 40 bucks.  However, to your amusement, you read "Total Due: $84,534.00" at the bottom of the bill.   After a lengthy conversation with a department that you didn't even know existed until now "The Fraud Management Department" you are informed that the bill is accurate your IP PBX has placed more than 100,000 minutes of outbound calls to Cuba and North Korea.  Furthermore, they want to know when and how you plan to pay.

Unfortunately, the scenario described above is not fictional and in no way exaggerated; more understated if anything.   As with anything connected to the public Internet these days, VoIP-based phone systems

are the ultimate find for internet thieves.  Actually, it is probably more accurate to label this activity as Organized Crime due to the amount of sophistication and organization that is needed to carry out these big hits with so much damage, so quickly.  Telecom fraud has become increasingly more common due to the growing popularity of IP PBXs.  

Unfortunately, this problem is only getting worse and continues to greatly impact VoIP service providers as well as individual businesses that operate through IPPBXs or Hosted Phone Systems. As the cost of ownership of IP PBXs decreases or even becomes free in the case of systems like Asterisk and 3CX, the number of systems being placed on the public Internet also increases.  

How does it happen?

Most commonly, hackers find holes in IPPBXs that are connected to the public internet by using SIP scanners and exploiting system weaknesses.  Typically these are default passwords being left in place, extensions being left unsecured, open SIP ports or incorrectly managed or non-existent of firewalls.  All of which are relatively easy to fix and usually free.  However, security is usually the last thing on the mind of your system integrator or that part-time PBX-Guru/buddy of yours that installed a free version of Asterisk for you (absolutely nothing wrong with Asterisk by the way!).  Once these hackers enter your system, they move quickly.  They operate undetected and terminate as many calls to the most expensive locations possible for as long as it takes for you or your service provider to recognize that your system just passed over a million calls to Cuba and North Korea. Never mind your issues with the State Department, you now have a  $90K+ phone bill on your hands.  And yes, your service provider will expect payment in full!

What is my responsibility?

While your service provider may actively monitor its network for suspicious activity and traffic patterns, it is ultimately the responsibility of the customer to protect their own network.  Customers are responsible for all charges associated with their account whether fraudulent or not. It is the customer’s sole responsibility to take immediate action to prevent or block any fraudulent use.  As the IP PBX owner, you are responsible for the security and administration of your phone system.  This includes both physical security of the system and phones, as well as passwords, pins, remote users and network security.  Your service provider may have systems in place to help detect and notify you of hacking attempts and fraud as a courtesy, but you are responsible for any charges incurred.

What can I do to protect my business?

It is not an impossible task to secure your IP PBX from the top 99.9% of all intrusion attempts and minimize the damage done by any intruder that sneaks past your security.  Remember, Hackers are lazy (otherwise they'd have a real Job!), they are not going to spend hours trying to hack a system when they can just move on to another that is wide-open.

 

Summary:

Here are some easy to implement procedures to help protect your IP IPBX from intruders:

Be sure that your IP PBX and your network is secure and limited only to those with appropriate access permissions.

Never, never, never use the default passwords on any system.

Never use the same Username and password on your extensions.

Place your PBX behind a firewall

Make it private – Nat is your friend!

Keep inbound and outbound routing separate (asterisk)

Limit registration by extensions to your local subnet.

Disable channels and services that are not in use

Make it harder for SIP scanners

Limit and restrict routing and phone number dial plans

Audit your system security regularly

For a complete list of security steps, please see (11 steps to secure your IP PBX).

 

11 Steps to Secure your PBX

11 Steps to Secure your PBX

 

Don't be a victim of telecom theft

If you are reading this, you're probably like most of us... after many hours, or even several days of downloading software, setting up servers, configuring trunks, and cracking open firewall ports, you finally achieve success - your PBX is working, and calls are passing.   So, you wipe the sweat from your forehead, push away your ergonomic mesh-backed office chair (with lumbar support), and walk away pleased - not giving a second thought to security.  Until one day, you log into your PBX and see the skull-and-boned call sign of a hacker that has decided to pay you’re perfectly running PBX a visit. 

 

As a SIP trunking provider, our support team at IPComms sees this very scenario much more than we’d like to.  For those PBX owners who are lucky, they’re only faced with hours of downtime and a complete system rebuild.  However, unlike getting your personal computer hacked, getting hacked into your business PBX, gives the unscrupulous instant access into your virtual wallet via what is known as toll fraud.

Using toll fraud, a well-informed hacker can siphon thousands of dollars in as little as one night while you sleep blissfully.  With heavy volumes of wholesale phone traffic at the ready, a single hacked PBX can transmit thousands of minutes worth of phone calls to destinations with calling rates as high as five bucks a minute or more!  

Scared yet?  Well, you should be, especially, if you have just downloaded, installed and SIP "trunked" your new Asterisk PBX server without implementing even basic Asterisk PBX security.  Trust us, it's not a question of if your PBX will be hacked, it's just a matter of how long it will be before it happens!  So, why not take a few minutes and finish your Asterisk PBX installation by performing some relatively simple PBX security; that could pay off big in the long run? Ever heard the old adage, "An ounce of prevention is worth a pound of cure"?  Well, that author was undoubtedly referring to PBX security! 

PBX security - is not rocket science

Hopefully, you’re here proactively, and not after the damage has been done.  But, if not, at least you have learned your lesson and plan to do things right this time.

While PBX security, like most other security, requires constant attention and is a continuous work-in-progress, there are some basic common-sense steps that you can perform that will safeguard your system from the most common of attacks. 

As mentioned in our “What is Telecom Fraud” blog, most hackers are not looking for a long drawn out hack and would much rather move on to easier targets if you would only put up a little fight.  So we’ve put together a list of “11 steps to secure your Asterisk® PBX”.  While this list speaks directly to Asterisk PBX owners, many of the steps can easily be carried over to most other IP PBX (VoIP) manufacturers.

 

Here are the 11 Steps to Secure your Asterisk PBX

  1. Physically secure your IP PBX and network hardware.
    Physical security is critical and commonly overlooked. Be sure access to your hardware is limited to only those with appropriate access permissions, actually require access, and most importantly, know what they are doing!  We tech's like to play around with stuff, but that's why we have labs.

  2. Never, Never, Never use the default passwords on any system. (Use Strong Passwords)
    If you are truly concerned about PBX security, you will take this one piece of advice seriously!  Password security is easy and by far the best way to stop the top 99% of all hacks as it is easily the most common way hackers enter IP PBX systems.

    When installing your IP PBX, the very first step should be to replace both the username and passwords of any account with administrator access. Secondly, when creating user accounts, be sure not to use or allow easy to guess passwords like “1234”, “password”, “companyname1” etc.  

    Also, be sure to use a strong and unique password.  This can't be stressed enough.  As tempting and simple as it may be to use your business name with a single digit added to the end of it, don't do it.  You would be surprised what these password detectors can figure out with just a little information. 

  3. Never use the same username and password on your extensions.
    This is another VERY common issue, especially within the Asterisk community.  Using password 101 for extension 101 is asking for big trouble.  DON’T DO IT!

    An example of what NOT to do on your extensions: 
    ; sip.conf  
    [101] 
    username=101 
    secret=101
    host=dynamic 

  4. Place your PBX behind a firewall
    Lets’s face it, working on your PBX from home or allowing co-workers access to the system remotely is necessary and often unavoidable.  However, doing it correctly can be the difference between security success and total and utter failure.  VPNs are a good way to limit access and enable co-worker remote management. Placing your PBX behind a firewall and Restrict remote access to your IP PBX to specific IP Address will greatly discourage even the most determined hacker.  While hardware firewalls typically provide the most security, software firewalls can be just as effective and much cheaper (many are free).   

    Firewalls, of course, are only as good as the rules defined within them.  So be sure to only activate ports that are absolutely essential to run your PBX. Block anonymous WAN requests (P-I-N-G).  Let's face it; if they can find you, they can hack you.

    When possible, place your IP PBX on a LAN with Network Address Translation (NAT).  NAT basically gives your IP PBX a private IP Address and makes it much more difficult to gain access to from the internet.  While it may be easy to simply disable NAT for simplicity (especially when you run into that pesky one-way audio issue, don't do it.  Take the time to set it up correctly, and you'll be glad you did.

  5. Use the “permit=” and “deny=” lines in sip.conf
    Use the “permit=” and “deny=” lines in sip.conf to only allow a small range of IP addresses access to extension/user in your sip.conf file. This is true even if you decide to allow inbound calls from “anywhere” (default), it won't let those users reach any authenticated elements!

  6. Keep inbound and outbound routing separate (asterisk)
    This is probably the biggest cause and source of toll fraud.  By keeping your inbound call routing in a different context than your outbound routing, if an intruder does happen to make it into your system, he can’t get back out again.  

  7. Limit registration by extensions to your local subnet.
    Restrict the IP addresses your extensions can register onto the local subnet.  Asterisk PBXs can use the ACL (permit/deny) in SIP.conf to block IP addresses.  This can fend of brute force registration attempts.


  8. Disable channels and services that are not in use
    Disable channels that you aren’t using like skinny and MGCP.  For Asterisk PBXs, you can “unload” these modules in the /etc/modules.conf file like this:

    noload => chan_mgcp.so
    noload => chan_skinny.so 
    noload => chan_oss.so

  9. Make it harder for sip scanners (Set “alwaysauthreject=yes” )
    Set “alwaysauthreject=yes” in your sip configuration file. What this does is prevent Asterisk from telling a sip scanner which extensions are valid by rejecting authentication requests on existing usernames with the same rejection details as with nonexistent usernames.  If they can't find you they can't hack you!

    Another way to make it hard for SIP scanners is to install a SIP port firewall.  This will block “scanning” of port 5060 and 5061 and can disable the attempting endpoint for a specific time when it detects a violation.


  10. Limit and restrict routing and phone number dial plans
    Restrict calling to high-cost calling destination and don’t allow calling to 0900 + Premium numbers)

  11. Audit your system security regularly
    Once you’ve reached this point, it's not a bad idea to put your Hacker hat on, and have a try at your own system.  Think like a hacker and try to look for weaknesses or holes in your system security.  It is a good idea to review your system security regularly.  Don’t sleep on security… you can guaranty that thieves aren’t.

The above steps mainly focus on PBX calling and traffic security and do not cover topics related to software protection (e.g. protection against Spyware, Trojans or viruses).   These are also very important and should also be taken into consideration when securing & protecting your PBX.

Did you know...

By switching to a cloud-based PBX service, you can make the 11 steps to secure your IP PBX someone else's responsibility.  Learn more about cloud-based PBX services.

 

Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames,