I have been working with quite a few clients and one of the things I noticed is that many clients aren't properly securing their boxes from harm properly. I would suggest running iptables on your boxes and restrict connections coming to your Trixboxes to only allow tftp and ssh access from trusted ips.
If you're of the mindset of, "Well, I'm behind a firewall and thus, I must be protected." All I can say is if your box is accessible from the internet, it isn't as protected as you think. Here's a little something you might want to try just to prove my point.
1. If your box is accessible via ssh (even on a non-standard port) from the internet, type the following at the shell prompt.
cat /var/log/secure|grep 'nvalid user'
you'll see all the ssh attempts at accessing your box from unsavory script kiddies and blackhats.
You can do something similar to your http logs to get an idea of how many http attempts at authentication into your admin interface as well.
Now the question is.. What do you do about it? While you can't secure yourself from every unsavory character on the internet, you can do a little "magic" to protect your box.
There's a wonderful little application called "fail2ban" that (if configured properly) will actually shut out an ip address from intrusion attempts for a certain period of time (as per your definition). After the set period of time, it will unban the ip address so your iptables chains don't get ridiculously long.
While fail2ban isn't a simple "click to configure" kind of thing, it is incredibly effective at stopping some of that bad mojo that's on the internet.
I've got mine doing some pretty cool stuff (like banning invalid users on ssh and the web portals). Basically, any type of ssh probing automatically gets banned for 60000 seconds after the first attempt. Failed Web Authentications get banned after the third attempt for the same amount of time.
The setup basically makes my PBX unresponsive to those ip addresses for some period of time. It also gives me peace of mind.
On another note, people might want to look into Argus as well. This wonderful little network monitoring program allows me to monitor my SIP and IAX trunks and if they become unresponsive, it basically reloads the sip and iax trunk registrations accordingly (while notifying me on my cellphone via text messaging).
You'd be surprised at how easily it is to catch your ITSPs doing something they're not supposed to be doing in the middle of the day (like taking down SIP proxies, et. al.) In other words, monitor your boxes for security and your trunks and ITSPs for uptime.
While these things require a fair amount of setup time, the headache and pain they save you in the long run is well worth the time investment. If you don't have the skill-base to accomplish these two things, but would like them installed, I'm available for hire (shameless plug for my consulting services).
In all seriousness though, anyone running a trixbox that is even remotely accessible on the internet really should look into implementing these features. You really get alot of insight into how reliable and insecure your boxes really are. Oh yeah.. one word of advice... CHANGE THE DEFAULT PASSWORDS PEOPLE.
Cheers.
Member Since:
2007-04-30