Asterisk ARI allowed_origins

martinnystrom · July 13, 2023, 9:23am

Hello,

Perhaps I do not understand this feature but I am trying to restrict so that only localhost can use the ARI on port 8088.

Here’s my configuration, I have tried both allowed_origin http://localhost:8088 and without protocol localhost:8088

[general]
enabled = yes
allowed_origins = http://localhost:8088

[ariuser]
type=user
read_only=no
password_format=plain
password=1234

Despite having this I can still send requests remotely like this
curl http://my-test-asterisk.com:8088/ari/channels -u ariuser:1234

<--- ARI request received from: 8.8.8.8:49388 --->
Host: my-test-asterisk.com:8088
Authorization: Basic YXJpdXNlcjoxMjM0
User-Agent: curl/7.88.1
Accept: */*
body:


<--- Sending ARI response to 8.8.8.8:49388 --->
200 OK
Content-type: application/json
[]

Is there a way to limit ARI access to localhost, but having WS exposed externally?

Asterisk version 20.3.0

jcolp · July 13, 2023, 9:54am

There is currently no ACL functionality. You would want to put a proxy in front for Websockets and bind the Asterisk HTTP server to localhost only.

martinnystrom · July 13, 2023, 9:57am

OK, well as of now that is not an option. We’ll just live with the fact that ARI is exposed externally and use strong passwords.

Do you happen to know if there’s an existing feature request on such a functionality? Or at least segregating ARI from WS.

TheMark · July 13, 2023, 2:32pm

block it in your firewall

jcolp · July 13, 2023, 2:34pm

Feature requests are put on Github[1]. There is no such feature request currently.

[1] Issues · asterisk/asterisk-feature-requests · GitHub

martinnystrom · July 13, 2023, 2:52pm

I have created a Feature Request to the best of my ability.

github.com/asterisk/asterisk-feature-requests

Add permit/deny ACL to the ARI, or the possibility to separate them via network ports.

opened 02:52PM - 13 Jul 23 UTC

nnew2

**Is your feature or improvement request related to a problem? Please describe.*…* Wouldn't say it's a problem but it could potentially be one for sure. Bundling WS and ARI together on the same port without the possibility of ACLs or port segregation, the Asterisk could be forced to expose more than necessary. In our case we need the WS to be accessible externally over the internet but we do not wish to expose the ARI publicly. **Describe the solution you'd like** Use the already existing permit/deny parameters already available for the AMI or make it possible to define a different networking port for the ARI. Since the permit/deny parameters are already available for some Asterisk modules it would make sense to extend that to ARI as well. **Describe alternatives you've considered** The only alternative that was presented to us was via the Community Forum adding a proxy in front of the Asterisk. We feel this shouldn't be necessary to achieve this layer of protection. **Additional context** My community thread https://community.asterisk.org/t/asterisk-ari-allowed-origins/97776

system · August 12, 2023, 2:53pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.