NameDateSize

..16-Mar-201612 KiB

.cleancount06-Jul-20123

.codesearch_no_update29-Jul-20140

addons/28-Jul-20144 KiB

agi/19-Oct-20124 KiB

apps/28-Jul-20144 KiB

autoconf/18-Jul-20144 KiB

bootstrap.sh08-May-20121 KiB

bridges/21-Jul-20144 KiB

BSDmakefile08-May-2012294

BUGS08-May-2012599

build_tools/08-Jul-20144 KiB

cdr/28-Jul-20144 KiB

cel/28-Jul-20144 KiB

CHANGES28-Jul-2014220 KiB

channels/28-Jul-20144 KiB

codecs/28-Jul-20144 KiB

config.guess18-Jul-201441.9 KiB

config.sub18-Jul-201434.9 KiB

configs/18-Jul-20144 KiB

configure22-Jul-2014880 KiB

configure.ac22-Jul-201482.2 KiB

contrib/01-Sep-20134 KiB

COPYING08-May-201217.6 KiB

CREDITS20-Dec-201312.6 KiB

default.exports23-Aug-2013126

doc/25-Jul-20144 KiB

formats/28-Jul-20144 KiB

funcs/28-Jul-20144 KiB

images/08-May-20124 KiB

include/28-Mar-20144 KiB

install-sh08-May-20126.3 KiB

LICENSE20-Dec-20133 KiB

main/28-Jul-20144 KiB

Makefile18-Jul-201437 KiB

Makefile.moddir_rules19-Oct-20125.8 KiB

Makefile.rules23-Jun-20145.2 KiB

makeopts.in01-Sep-20136.8 KiB

menuselect/18-Jul-20144 KiB

missing08-May-20126.3 KiB

mkinstalldirs08-May-2012671

pbx/28-Jul-20144 KiB

phoneprov/08-May-20124 KiB

README22-Sep-201213.3 KiB

README-addons.txt08-May-20121.5 KiB

README-SERIOUSLY.bestpractices.txt20-Dec-201315.4 KiB

res/28-Jul-201412 KiB

rest-api/10-Jul-20144 KiB

rest-api-templates/04-Jul-20144 KiB

sample.call08-May-20122.7 KiB

sounds/23-Apr-20144 KiB

static-http/19-Oct-20124 KiB

tests/25-Jul-20144 KiB

UPGRADE-1.2.txt08-May-20129.1 KiB

UPGRADE-1.4.txt08-May-201225.3 KiB

UPGRADE-1.6.txt08-May-201213.6 KiB

UPGRADE-1.8.txt08-Sep-201217.4 KiB

UPGRADE-10.txt18-Jul-20123.8 KiB

UPGRADE-11.txt31-Oct-201312.7 KiB

UPGRADE-12.txt10-Jan-201423.2 KiB

UPGRADE.txt25-Jul-201417.8 KiB

utils/07-Jul-20144 KiB

Zaptel-to-DAHDI.txt08-May-20121.7 KiB

README

1===============================================================================
2===                     The Asterisk(R) Open Source PBX
3===
4===                   by Mark Spencer <markster@digium.com>
5===                  and the Asterisk.org developer community
6===
7===                    Copyright (C) 2001-2009 Digium, Inc.
8===                       and other copyright holders.
9===============================================================================
10
11-------------------------------------------------------------------------------
12--- SECURITY ------------------------------------------------------------------
13
14  It is imperative that you read and fully understand the contents of
15the security information document before you attempt to configure and run
16an Asterisk server.
17
18  If you downloaded Asterisk as a tarball, see the security section in the PDF
19version of the documentation in doc/tex/asterisk.pdf.  Alternatively, pull up
20the HTML version of the documentation in doc/tex/asterisk/index.html.  The
21source for the security document is available in doc/tex/security.tex.
22-------------------------------------------------------------------------------
23
24-------------------------------------------------------------------------------
25--- WHAT IS ASTERISK ? --------------------------------------------------------
26
27  Asterisk is an Open Source PBX and telephony toolkit.  It is, in a
28sense, middleware between Internet and telephony channels on the bottom,
29and Internet and telephony applications at the top.  However, Asterisk supports
30more telephony interfaces than just Internet telephony.  Asterisk also has a
31vast amount of support for traditional PSTN telephony, as well.  For more
32information on the project itself, please visit the Asterisk home page at:
33
34           http://www.asterisk.org
35
36  The official Asterisk wiki can be found at:
37
38           https://wiki.asterisk.org
39
40  In addition you'll find lots of information compiled by the Asterisk
41community on this Wiki:
42
43           http://www.voip-info.org/wiki-Asterisk
44
45  There is a book on Asterisk published by O'Reilly under the Creative Commons
46License. It is available in book stores as well as in a downloadable version on
47the http://www.asteriskdocs.org web site.
48-------------------------------------------------------------------------------
49
50-------------------------------------------------------------------------------
51--- SUPPORTED OPERATING SYSTEMS -----------------------------------------------
52
53--- Linux
54  The Asterisk Open Source PBX is developed and tested primarily on the
55GNU/Linux operating system, and is supported on every major GNU/Linux
56distribution.
57
58--- Others
59  Asterisk has also been 'ported' and reportedly runs properly on other
60operating systems as well, including Sun Solaris, Apple's Mac OS X, Cygwin,
61and the BSD variants.
62-------------------------------------------------------------------------------
63
64-------------------------------------------------------------------------------
65--- GETTING STARTED -----------------------------------------------------------
66
67  First, be sure you've got supported hardware (but note that you don't need
68ANY special hardware, not even a sound card) to install and run Asterisk.
69
70  Supported telephony hardware includes:
71
72	* All Analog and Digital Interface cards from Digium (www.digium.com)
73	* QuickNet Internet PhoneJack and LineJack (http://www.quicknet.net)
74	* any full duplex sound card supported by ALSA, OSS, or PortAudio
75	* any ISDN card supported by mISDN on Linux
76	* The Xorcom Astribank channel bank
77	* VoiceTronix OpenLine products
78
79-------------------------------------------------------------------------------
80
81-------------------------------------------------------------------------------
82--- UPGRADING FROM AN EARLIER VERSION -----------------------------------------
83
84  If you are updating from a previous version of Asterisk, make sure you
85read the UPGRADE.txt file in the source directory. There are some files
86and configuration options that you will have to change, even though we
87made every effort possible to maintain backwards compatibility.
88
89  In order to discover new features to use, please check the configuration
90examples in the /configs directory of the source code distribution.  For a
91list of new features in this version of Asterisk, see the CHANGES file.
92-------------------------------------------------------------------------------
93
94-------------------------------------------------------------------------------
95--- NEW INSTALLATIONS ---------------------------------------------------------
96
97  Ensure that your system contains a compatible compiler and development
98libraries.  Asterisk requires either the GNU Compiler Collection (GCC) version
993.0 or higher, or a compiler that supports the C99 specification and some of
100the gcc language extensions.  In addition, your system needs to have the C
101library headers available, and the headers and libraries for ncurses.
102
103  There are many modules that have additional dependencies.  To see what
104libraries are being looked for, see ./configure --help, or run
105"make menuselect" to view the dependencies for specific modules.
106
107  On many distributions, these dependencies are installed by packages with names
108like 'glibc-devel', 'ncurses-devel', 'openssl-devel' and 'zlib-devel' 
109or similar.
110
111  So, let's proceed:
112
1131) Read this README file.
114
115  There are more documents than this one in the doc/ directory.  You may also
116want to check the configuration files that contain examples and reference
117guides. They are all in the configs/ directory.
118
1192) Run "./configure"
120
121  Execute the configure script to guess values for system-dependent
122variables used during compilation.
123
1243) Run "make menuselect" [optional]
125
126  This is needed if you want to select the modules that will be compiled and to
127check dependencies for various optional modules.
128
1294) Run "make"
130
131  Assuming the build completes successfully:
132
1335) Run "make install"
134
135  If this is your first time working with Asterisk, you may wish to install
136the sample PBX, with demonstration extensions, etc.  If so, run:
137
1386) "make samples"
139
140  Doing so will overwrite any existing configuration files you have installed.
141
142  Finally, you can launch Asterisk in the foreground mode (not a daemon) with:
143
144# asterisk -vvvc
145
146  You'll see a bunch of verbose messages fly by your screen as Asterisk
147initializes (that's the "very very verbose" mode).  When it's ready, if
148you specified the "c" then you'll get a command line console, that looks
149like this:
150
151*CLI>
152
153  You can type "core show help" at any time to get help with the system.  For help
154with a specific command, type "core show help <command>".  To start the PBX using
155your sound card, you can type "console dial" to dial the PBX.  Then you can use
156"console answer", "console hangup", and "console dial" to simulate the actions
157of a telephone.  Remember that if you don't have a full duplex sound card
158(and Asterisk will tell you somewhere in its verbose messages if you do/don't)
159then it won't work right (not yet).
160
161  "man asterisk" at the Unix/Linux command prompt will give you detailed
162information on how to start and stop Asterisk, as well as all the command
163line options for starting Asterisk.
164
165  Feel free to look over the configuration files in /etc/asterisk, where you
166will find a lot of information about what you can do with Asterisk.
167-------------------------------------------------------------------------------
168
169-------------------------------------------------------------------------------
170--- ABOUT CONFIGURATION FILES -------------------------------------------------
171
172  All Asterisk configuration files share a common format.  Comments are
173delimited by ';' (since '#' of course, being a DTMF digit, may occur in
174many places).  A configuration file is divided into sections whose names
175appear in []'s.  Each section typically contains two types of statements,
176those of the form 'variable = value', and those of the form 'object =>
177parameters'.  Internally the use of '=' and '=>' is exactly the same, so 
178they're used only to help make the configuration file easier to
179understand, and do not affect how it is actually parsed.
180
181  Entries of the form 'variable=value' set the value of some parameter in
182asterisk.  For example, in dahdi.conf, one might specify:
183
184	switchtype=national
185
186  In order to indicate to Asterisk that the switch they are connecting to is
187of the type "national".  In general, the parameter will apply to
188instantiations which occur below its specification.  For example, if the
189configuration file read:
190
191	switchtype = national
192	channel => 1-4
193	channel => 10-12
194	switchtype = dms100
195	channel => 25-47
196
197  The "national" switchtype would be applied to channels one through
198four and channels 10 through 12, whereas the "dms100" switchtype would
199apply to channels 25 through 47.
200  
201  The "object => parameters" instantiates an object with the given
202parameters.  For example, the line "channel => 25-47" creates objects for
203the channels 25 through 47 of the card, obtaining the settings
204from the variables specified above.
205-------------------------------------------------------------------------------
206
207-------------------------------------------------------------------------------
208--- SPECIAL NOTE ON TIME ------------------------------------------------------
209  
210  Those using SIP phones should be aware that Asterisk is sensitive to
211large jumps in time.  Manually changing the system time using date(1)
212(or other similar commands) may cause SIP registrations and other
213internal processes to fail.  If your system cannot keep accurate time
214by itself use NTP (http://www.ntp.org/) to keep the system clock
215synchronized to "real time".  NTP is designed to keep the system clock
216synchronized by speeding up or slowing down the system clock until it
217is synchronized to "real time" rather than by jumping the time and
218causing discontinuities. Most Linux distributions include precompiled
219versions of NTP.  Beware of some time synchronization methods that get
220the correct real time periodically and then manually set the system
221clock.
222
223  Apparent time changes due to daylight savings time are just that,
224apparent.  The use of daylight savings time in a Linux system is
225purely a user interface issue and does not affect the operation of the
226Linux kernel or Asterisk.  The system clock on Linux kernels operates
227on UTC.  UTC does not use daylight savings time.
228
229  Also note that this issue is separate from the clocking of TDM
230channels, and is known to at least affect SIP registrations.
231-------------------------------------------------------------------------------
232
233-------------------------------------------------------------------------------
234--- FILE DESCRIPTORS ----------------------------------------------------------
235
236  Depending on the size of your system and your configuration,
237Asterisk can consume a large number of file descriptors.  In UNIX,
238file descriptors are used for more than just files on disk.  File
239descriptors are also used for handling network communication
240(e.g. SIP, IAX2, or H.323 calls) and hardware access (e.g. analog and
241digital trunk hardware).  Asterisk accesses many on-disk files for
242everything from configuration information to voicemail storage.
243
244  Most systems limit the number of file descriptors that Asterisk can
245have open at one time.  This can limit the number of simultaneous
246calls that your system can handle.  For example, if the limit is set
247at 1024 (a common default value) Asterisk can handle approximately 150
248SIP calls simultaneously.  To change the number of file descriptors
249follow the instructions for your system below:
250-------------------------------------------------------------------------------
251
252-------------------------------------------------------------------------------
253--- PAM-based Linux System ----------------------------------------------------
254
255  If your system uses PAM (Pluggable Authentication Modules) edit
256/etc/security/limits.conf.  Add these lines to the bottom of the file:
257
258root            soft    nofile          4096
259root            hard    nofile          8196
260asterisk        soft    nofile          4096
261asterisk        hard    nofile          8196
262
263(adjust the numbers to taste).  You may need to reboot the system for
264these changes to take effect.
265
266== Generic UNIX System ==
267
268  If there are no instructions specifically adapted to your system
269above you can try adding the command "ulimit -n 8192" to the script
270that starts Asterisk.
271-------------------------------------------------------------------------------
272
273-------------------------------------------------------------------------------
274--- MORE INFORMATION ----------------------------------------------------------
275
276  See the doc directory for more documentation on various features. Again,
277please read all the configuration samples that include documentation on
278the configuration options.
279
280  If this release of Asterisk was downloaded from a tarball, then some
281additional documentation should have been included.
282     * doc/tex/asterisk.pdf --- PDF version of the documentation
283     * doc/tex/asterisk/index.html --- HTML version of the documentation
284
285  Finally, you may wish to visit the web site and join the mailing list if
286you're interested in getting more information.
287
288   http://www.asterisk.org/support
289
290  Welcome to the growing worldwide community of Asterisk users!
291-------------------------------------------------------------------------------
292
293--- Mark Spencer, and the Asterisk.org development community
294
295-------------------------------------------------------------------------------
296Asterisk is a trademark of Digium, Inc.
297

README-addons.txt

1===============================================================================
2===                       Asterisk Add-on Modules                           ===
3===============================================================================
4
5    This document pertains to the modules that reside in the addons/
6subdirectory of the source tree.  By default, these modules are not compiled
7and installed.  If you choose to enable them, you must be aware of what
8potential licensing and/or patent implications that has on your usage and
9distribution of Asterisk.
10
11    Even though Asterisk is released as open source under the terms of the
12GPLv2 (see LICENSE for details), no core functionality in Asterisk has any 
13dependencies on libraries that are licensed under the GPL.  One reason a module
14may be in the add-ons category is that it may have a GPL dependency.  Since
15these dependencies are not compatible with dual licensing of Asterisk, the
16dependant modules are set aside to make it clear that they may not be used 
17with commercial versions of Asterisk, unless other licensing arrangements are 
18made with the copyright holders of those dependencies.
19
20    Another reason that modules may be set aside is that there may be
21additional restrictions on the usage of the code imposed by the license or
22related patents.  The MySQL and MP3 modules are examples of this.
23       
24    If you have any questions, contact your lawyer.
25
26===============================================================================
27===============================================================================
28

README-SERIOUSLY.bestpractices.txt

1==================
2| Best Practices |
3==================
4
5The purpose of this document is to define best practices when working with
6Asterisk in order to minimize possible security breaches and to provide tried
7examples in field deployments. This is a living document and is subject to 
8change over time as best practices are defined.
9
10--------
11Sections
12--------
13
14* Filtering Data: 
15        How to protect yourself from redial attacks
16
17* Proper Device Naming: 
18        Why to not use numbered extensions for devices
19
20* Secure Passwords: 
21        Secure passwords limit your risk to brute force attacks
22
23* Reducing Pattern Match Typos: 
24        Using the 'same' prefix, or using Goto()
25
26* Manager Class Authorizations:
27        Recognizing potential issues with certain classes of authorization
28
29* Avoid Privilege Escalations:
30        Disable the ability to execute functions that may escalate privileges
31
32----------------
33Additional Links
34----------------
35
36Additional links that contain useful information about best practices or
37security are listed below.
38
39* Seven Steps to Better SIP Security:
40        http://blogs.digium.com/2009/03/28/sip-security/
41
42* Asterisk VoIP Security (webinar):
43        http://www.asterisk.org/security/webinar/
44
45
46==============
47Filtering Data
48==============
49
50In the Asterisk dialplan, several channel variables contain data potentially 
51supplied by outside sources. This could lead to a potential security concern 
52where those outside sources may send cleverly crafted strings of data which 
53could be utilized, e.g. to place calls to unexpected locations.
54
55An example of this can be found in the use of pattern matching and the ${EXTEN}
56channel variable. Note that ${EXTEN} is not the only system created channel
57variable, so it is important to be aware of where the data you're using is
58coming from.
59
60For example, this common dialplan takes 2 or more characters of data, starting 
61with a number 0-9, and then accepts any additional information supplied by the
62request.
63
64[NOTE: We use SIP in this example, but is not limited to SIP only; protocols
65       such as Jabber/XMPP or IAX2 are also susceptible to the same sort of
66       injection problem.]
67       
68
69[incoming]
70exten => _X.,1,Verbose(2,Incoming call to extension ${EXTEN})
71exten => _X.,n,Dial(SIP/${EXTEN})
72exten => _X.,n,Hangup()
73
74This dialplan may be utilized to accept calls to extensions, which then dial a
75numbered device name configured in one of the channel configuration files (such
76as sip.conf, iax.conf, etc...) (see the section Proper Device Naming for more
77information on why this approach is flawed).
78
79The example we've given above looks harmless enough until you take into
80consideration that several channel technologies accept characters that could
81be utilized in a clever attack. For example, instead of just sending a request
82to dial extension 500 (which in our example above would create the string
83SIP/500 and is then used by the Dial() application to place a call), someone
84could potentially send a string like "500&SIP/itsp/14165551212".
85
86The string "500&SIP/itsp/14165551212" would then be contained within the 
87${EXTEN} channel variable, which is then utilized by the Dial() application in
88our example, thereby giving you the dialplan line of:
89
90exten => _X.,n,Dial(SIP/500&SIP/itsp/14165551212)
91
92Our example above has now provided someone with a method to place calls out of
93your ITSP in a place where you didn't expect to allow it. There are a couple of
94ways in which you can mitigate this impact: stricter pattern matching, or using
95the FILTER() dialplan function.
96
97Strict Pattern Matching
98-----------------------
99
100The simple way to mitigate this problem is with a strict pattern match that does
101not utilize the period (.) or bang (!) characters to match on one-or-more 
102characters or zero-or-more characters (respectively). To fine tune our example
103to only accept three digit extensions, we could change our pattern match to
104be:
105
106exten => _XXX,n,Dial(SIP/${EXTEN})
107
108In this way, we have minimized our impact because we're not allowing anything
109other than the numbers zero through nine. But in some cases we really do need to
110handle variable pattern matches, such as when dialing international numbers
111or when we want to handle something like a SIP URI. In this case, we'll need to
112utilize the FILTER() dialplan function.
113
114Using FILTER()
115--------------
116
117The FILTER() dialplan function is used to filter strings by only allowing
118characters that you have specified. This is a perfect candidate for controlling
119which characters you want to pass to the Dial() application, or any other
120application which will contain dynamic information passed to Asterisk from an
121external source. Lets take a look at how we can use FILTER() to control what
122data we allow.
123
124Using our previous example to accept any string length of 2 or more characters, 
125starting with a number of zero through nine, we can use FILTER() to limit what 
126we will accept to just numbers. Our example would then change to something like:
127
128[incoming]
129exten => _X.,1,Verbose(2,Incoming call to extension ${EXTEN})
130exten => _X.,n,Dial(SIP/${FILTER(0-9,${EXTEN})})
131exten => _X.,n,Hangup()
132
133Note how we've wrapped the ${EXTEN} channel variable with the FILTER() function
134which will then only pass back characters that fit into the numerical range that
135we've defined.
136
137Alternatively, if we didn't want to utilize the FILTER() function within the
138Dial() application directly, we could save the value to a channel variable,
139which has a side effect of being usable in other locations of your dialplan if
140necessary, and to handle error checking in a separate location.
141
142[incoming]
143exten => _X.,1,Verbose(2,Incoming call to extension ${EXTEN})
144exten => _X.,n,Set(SAFE_EXTEN=${FILTER(0-9,${EXTEN})})
145exten => _X.,n,Dial(SIP/${SAFE_EXTEN})
146exten => _X.,n,Hangup()
147
148Now we can use the ${SAFE_EXTEN} channel variable anywhere throughout the rest
149of our dialplan, knowing we've already filtered it. We could also perform an
150error check to verify that what we've received in ${EXTEN} also matches the data
151passed back by FILTER(), and to fail the call if things do not match.
152
153[incoming]
154exten => _X.,1,Verbose(2,Incoming call to extension ${EXTEN})
155exten => _X.,n,Set(SAFE_EXTEN=${FILTER(0-9,${EXTEN})})
156exten => _X.,n,GotoIf($[${EXTEN} != ${SAFE_EXTEN}]?error,1)
157exten => _X.,n,Dial(SIP/${SAFE_EXTEN})
158exten => _X.,n,Hangup()
159
160exten => error,1,Verbose(2,Values of EXTEN and SAFE_EXTEN did not match.)
161exten => error,n,Verbose(2,EXTEN: "${EXTEN}" -- SAFE_EXTEN: "${SAFE_EXTEN}")
162exten => error,n,Playback(silence/1&invalid)
163exten => error,n,Hangup()
164
165Another example would be using FILTER() to control the characters we accept when
166we're expecting to get a SIP URI for dialing.
167
168[incoming]
169exten => _[0-9a-zA-Z].,1,Verbose(2,Incoming call to extension ${EXTEN})
170exten => _[0-9a-zA-Z].,n,Dial(SIP/${FILTER(.@0-9a-zA-Z,${EXTEN})
171exten => _[0-9a-zA-Z].,n,Hangup()
172
173Of course the FILTER() function doesn't check the formatting of the incoming
174request. There is also the REGEX() dialplan function which can be used to
175determine if the string passed to it matches the regular expression you've
176created, and to take proper action on whether it matches or not. The creation of
177regular expressions is left as an exercise for the reader.
178
179More information about the FILTER() and REGEX() dialplan functions can be found
180by typing "core show function FILTER" and "core show function REGEX" from your
181Asterisk console.
182
183
184====================
185Proper Device Naming
186====================
187
188In Asterisk, the concept of an extension number being tied to a specific device
189does not exist. Asterisk is aware of devices it can call or receive calls from,
190and how you define in your dialplan how to reach those devices is up to you.
191
192Because it has become common practice to think of a specific device as having an
193extension number associated with it, it only becomes natural to think about
194naming your devices the same as the extension number you're providing it. But
195by doing this, you're limiting the powerful concept of separating user from
196extensions, and extensions from devices.
197
198It can also be a security hazard to name your devices with a number, as this can
199open you up to brute force attacks. Many of the current exploits deal with
200device configurations which utilize a number, and even worse, a password that
201matches the devices name. For example, take a look at this poorly created device
202in sip.conf:
203
204[1000]
205type=friend
206context=international_dialing
207secret=1000
208
209As implied by the context, we've permitted a device named 1000 with a password
210of 1000 to place calls internationally. If your PBX system is accessible via
211the internet, then your system will be vulnerable to expensive international
212calls. Even if your system is not accessible via the internet, people within
213your organization could get access to dialing rules you'd prefer to reserve only
214for certain people.
215
216A more secure example for the device would be to use something like the MAC
217address of the device, along with a strong password (see the section Secure
218Passwords). The following example would be more secure:
219
220[0004f2040001]
221type=friend
222context=international_dialing
223secret=aE3%B8*$jk^G
224
225Then in your dialplan, you would reference the device via the MAC address of the
226device (or if using the softphone, a MAC address of a network interface on the
227computer).
228
229Also note that you should NOT use this password, as it will likely be one of the
230first ones added to the dictionary for brute force attacks.
231
232
233================
234Secure Passwords
235================
236
237Secure passwords are necessary in many (if not all) environments, and Asterisk 
238is certainly no exception, especially when it comes to expensive long distance
239calls that could potentially cost your company hundreds or thousands of dollars
240on an expensive monthly phone bill, with little to no recourse to fight the
241charges.
242
243Whenever you are positioned to add a password to your system, whether that is
244for a device configuration, a database connection, or any other secure 
245connection, be sure to use a secure password. A good example of a secure
246password would be something like:
247
248aE3%B8*$jk^G
249
250Our password also contains 12 characters with a mixture of upper and
251lower case characters, numbers, and symbols. Because these passwords are likely 
252to only be entered once, or loaded via a configuration file, there is
253no need to create simple passwords, even in testing. Some of the holes found in
254production systems used for exploitations involve finding the one test extension
255that contains a weak password that was forgotten prior to putting a system into
256production.
257
258Using a web search you can find several online password generators such as
259http://www.strongpasswordgenerator.com or there are several scripts that can be
260used to generate a strong password.
261
262
263============================
264Reducing Pattern Match Typos
265============================
266
267As of Asterisk 1.6.2, a new method for reducing the number of complex pattern
268matches you need to enter, which can reduce typos in your dialplan, has been
269implemented. Traditionally, a dialplan with a complex pattern match would look
270something like:
271
272exten => _[3-5]XXX,1,Verbose(Incoming call to ${EXTEN})
273exten => _[3-5]XXX,n,Set(DEVICE=${DB(device/mac_address/${EXTEN})})
274exten => _[3-5]XXX,n,Set(TECHNOLOGY=${DB(device/technology/${EXTEN})})
275exten => _[3-5]XXX,n,GotoIf($[${ISNULL(${TECHNOLOGY})} | ${ISNULL(${DEVICE})}]?error,1)
276exten => _[3-5]XXX,n,Dial(${TECHNOLOGY}/${DEVICE},${GLOBAL(TIMEOUT)})
277exten => _[3-5]XXX,n,Set(vmFlag=${IF($[${DIALSTATUS} = BUSY]?b:u)})
278exten => _[3-5]XXX,n,Voicemail(${EXTEN}@${GLOBAL(VOICEMAIL_CONTEXT)},${vmFlag})
279exten => _[3-5]XXX,n,Hangup()
280
281exten => error,1,Verbose(2,Unable to lookup technology or device for extension)
282exten => error,n,Playback(silence/1&num-not-in-db)
283exten => error,n,Hangup()
284
285Of course there exists the possibility for a typo when retyping the pattern
286match _[3-5]XXX which will match on extensions 3000 through 5999. We can
287minimize this error by utilizing the same => prefix on all lines beyond the
288first one. Our same dialplan with using same => would look like the following:
289
290exten => _[3-5]XXX,1,Verbose(Incoming call to ${EXTEN})
291same => n,Set(DEVICE=${DB(device/mac_address/${EXTEN})})
292same => n,Set(TECHNOLOGY=${DB(device/technology/${EXTEN})})
293same => n,GotoIf($[${ISNULL(${TECHNOLOGY})} | ${ISNULL(${DEVICE})}]?error,1)
294same => n,Dial(${TECHNOLOGY}/${DEVICE},${GLOBAL(TIMEOUT)})
295same => n,Set(vmFlag=${IF($[${DIALSTATUS} = BUSY]?b:u)})
296same => n,Voicemail(${EXTEN}@${GLOBAL(VOICEMAIL_CONTEXT)},${vmFlag})
297same => n,Hangup()
298
299exten => error,1,Verbose(2,Unable to lookup technology or device for extension)
300same => n,Playback(silence/1&num-not-in-db)
301same => n,Hangup()
302
303
304============================
305Manager Class Authorizations
306============================
307
308Manager accounts have associated class authorizations that define what actions
309and events that account can execute/receive.  In order to run Asterisk commands
310or dialplan applications that affect the system Asterisk executes on, the
311"system" class authorization should be set on the account.
312
313However, Manager commands that originate new calls into the Asterisk dialplan
314have the potential to alter or affect the system as well, even though the
315class authorization for origination commands is "originate".  Take, for example,
316the Originate manager command:
317
318Action: Originate
319Channel: SIP/foo
320Exten: s
321Context: default
322Priority: 1
323Application: System
324Data: echo hello world!
325
326This manager command will attempt to execute an Asterisk application, System,
327which is normally associated with the "system" class authorication.  While some
328checks have been put into Asterisk to take this into account, certain dialplan
329configurations and/or clever manipulation of the Originate manager action can
330circumvent these checks.  For example, take the following dialplan:
331
332exten => s,1,Verbose(Incoming call)
333same => n,MixMonitor(foo.wav,,${EXEC_COMMAND})
334same => n,Dial(SIP/bar)
335same => n,Hangup()
336
337Whatever has been defined in the variable EXEC_COMMAND will be executed after
338MixMonitor has finished recording the call.  The dialplan writer may have
339intended that this variable to be set by some other location in the dialplan;
340however, the Manager action Originate allows for channel variables to be set by
341the account initiating the new call.  This could allow the Originate action to
342execute some command on the system by setting the EXEC_COMMAND dialplan variable
343in the Variable: header.
344
345In general, you should treat the Manager class authorization "originate" the
346same as the class authorization "system".  Good system configuration, such as
347not running Asterisk as root, can prevent serious problems from arising when
348allowing external connections to originate calls into Asterisk.
349
350===========================
351Avoid Privilege Escalations
352===========================
353
354External control protocols, such as Manager, often have the ability to get and
355set channel variables; which allows the execution of dialplan functions.
356
357Dialplan functions within Asterisk are incredibly powerful, which is wonderful
358for building applications using Asterisk. But during the read or write
359execution, certain diaplan functions do much more. For example, reading the
360SHELL() function can execute arbitrary commands on the system Asterisk is
361running on. Writing to the FILE() function can change any file that Asterisk has
362write access to.
363
364When these functions are executed from an external protocol, that execution
365could result in a privilege escalation. Asterisk can inhibit the execution of
366these functions, if live_dangerously in the [options] section of asterisk.conf
367is set to no.
368
369In Asterisk 12 and later, live_dangerously defaults to no.
370