I have submitted a pro-bono proposal to provision an Asterisk system at a non-profit organization here in NH that gets its telephone connections from a state government agency via their PBX.
The non-profit’s Asterisk system would connect to the Internet via DSL, so that some of the employees, volunteers, and officers of the non-profit could receive calls at their homes and participate in teleconferences.
The state government agency that provides the non-profit’s phone service has expressed a concern about connecting a PC to “their” phone system, especially a PC that is connected to the Internet.
As best I can tell, their concern seems to be that crackers might be able to break into the non-profit’s Asterisk system and somehow use that to break into the government agency’s phone system.
I suppose they’re worried about phreakers, or about someone breaking into their phone system and then breaking into whatever other systems or computers they may have tied in to their PBX.
(I have no idea what kind of a PBX the government agency has. I don’t think even THEY have any idea what they have.)
Just to clarify something … The non-profit would connect to the state government agency’s PBX only via analog phone lines and something like a Digium TDM400P, and not via any kind of digital network connection.
I’d start by saying that linux can be made MUCH more secure than Windows can, with much less work. Provided they have the system firewalled correctly and are not running extraneous processes that don’t need to be, a system running Asterisk is just as safe as any other commercial PBX.
Most of your security issues with be with the OS, not Asterisk itself. And Asterisk can be secured (to a great deal) via the dialplan.
If they don’t even know what kind of PBX they have, I honestly don’t think that they can say that security is of paramount concern - if it was, they would know what their legacy PBX was, how it was connected, and what security measures were in place.
I don’t have any security concerns with Asterisk, but then again, our old PBX was a windows-based app that ran poorly at best and required us to reboot the systems every night. Security was the last thing on our minds - just keeping those phones up was enough of a headache…
I’d start by saying that linux can be made MUCH more secure than Windows can,
with much less work. Provided they have the system firewalled correctly and are
not running extraneous processes that don’t need to be, a system running
Asterisk is just as safe as any other commercial PBX.
Good morning, whoiswes.
I guess my main question is, is it even possible for a cracker to do the things they seem to be concerned about? Do the electrical pathways even exist for someone who comes in over the Internet and breaks into the Asterisk machine to then be able to work their way through the TDM400P card, over the phone line, to the host’s PBX, and then do whatever damage it is they’re looking to do?
I can talk about security and firewalls and etc. until I’m blue in the face, but I suppose there could always be someone with more authority than knowledge, who says “As long as it’s even POSSIBLE, we aren’t interested”.
that gets more into the blackbox and tonebox type of stuff that i’m too young to know about, but if there WERE a vulnerability, it would have to be on the legacy PBX side.
let’s assume that they CAN get into * and that they CAN open a connection to the legacy PBX - the only way they’d be able to get in would be if there were holes in THAT PBX - asterisk would only be a gateway.
however, i highly doubt anyone would be able to do any damage, and the very low risk there would be eliminated by only allowing SSH/console access to the * box from certain addresses or only the physical console - that way nobody can remotely access the box and muck up the dialplan.
again, alot of the security (as i see it, anyway) resides in the network/firewall configuration. if you have this box out on the internet with a wide open IP, you are going to be less secure that if it’s behind a firewall, etc.
anything is possible, with enough time and information…but i don’t think Asterisk is any less secure than any other program or system out there…i could be totally wrong, however.
If you are only connected via analog lines, the absolute worst that could happen is attacker breaks into *, and gets access to those lines. He makes a SIP exten for himself that dials directly into those lines, maybe to make expensive calls or whatever. This could be used as part of another attack, perhaps a social engineering one (he calls them pretending to be you, callerid matches, and asks for private data).
So if they are worried about an attacker running up their phone bill, that is theoretically possible. If they are worried about an attacker crashing their PBX, that is highly unlikely unless their PBX is insecure to begin with.
Which doesnt even take into account the * box security- if you set up your dialplans right and pay attention to your use of contexts and includes, it will be secure from a telephonic POV. If you run up2date/yum update/equivalent every now and then, set up your firewall (iptables and the LAN firewall) to only allow required ports, and don’t run things you dont need to on the * box, you will have a very secure system.