# AMI security

**URL:** <https://community.asterisk.org/t/ami-security/31840>\
**Category:** Asterisk General\
**Created:** [July 3, 2010, 1:44pm UTC](https://community.asterisk.org/t/ami-security/31840 "2010-07-03T13:44:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\
**Post date:** [July 3, 2010, 1:44pm UTC](https://community.asterisk.org/t/ami-security/31840/1 "2010-07-03T13:44:03Z")

</div>

Hi, our 1.6.2.8 asterisk box will be on a public network. We use the AMI interface on the box itself  
via a PHP script. We want to restrict ALL access from outside but still allow PHP scripts on the box access.  
Is this safe enough?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\
**Post date:** [July 6, 2010, 12:10pm UTC](https://community.asterisk.org/t/ami-security/31840/2 "2010-07-06T12:10:17Z")

</div>

Just wondering if we set the bindaddr to 127.0.0.1 on our asterisk box which has a public IP . Is this safe enough? We will only be using the AMI within the ‘box’.

---

<div class="post-metadata">

**Author:** ![ianplain](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/ianplain/32/1776_2.png) [@ianplain](https://community.asterisk.org/u/ianplain)\
**Post date:** [July 6, 2010, 12:48pm UTC](https://community.asterisk.org/t/ami-security/31840/3 "2010-07-06T12:48:12Z")

</div>

[user]  
secret = secret  
deny=0.0.0.0/0.0.0.0  
permit=127.0.0.1/255.255.255.0  
read = system,call,log,verbose,command,agent,user  
write = system,call,log,verbose,command,agent,user

should do it