Common Asterisk Password Mistakes and How to Fix ThemAsterisk is a powerful open-source PBX widely used for VoIP telephony. Like any communications system, its security depends heavily on how you manage credentials. Weak or misconfigured passwords expose your system to toll fraud, voicemail compromise, SIP registration hijacking, and other costly problems. This article covers the most common Asterisk password mistakes, explains why each is dangerous, and provides concrete steps to fix and prevent them.
1. Using Default or Weak Passwords
Why it’s a problem
- Default credentials are widely known and often scanned for by automated bots.
- Weak or common passwords (e.g., “1234”, “password”, “asterisk”) are easily brute-forced.
How to fix it
- Immediately change any default passwords for SIP peers, extensions, voicemail, and the Asterisk Manager Interface (AMI).
- Enforce strong password policies: minimum length 12, mix of upper/lowercase letters, digits, and symbols.
- Use passphrases (e.g., “Blue!River7_Sail”) which are easier to remember but strong.
- Store credentials in a secure password manager rather than plaintext configuration files when possible.
Practical example
- In sip.conf/pjsip.conf, replace simple secret values with generated random strings, and avoid using identical secrets across multiple accounts.
2. Reusing Passwords Across Accounts and Systems
Why it’s a problem
- If one account is compromised, attackers can pivot to others using the same credential.
- Reuse creates a single point of failure across devices, users, and services.
How to fix it
- Assign unique passwords per device and per user.
- Implement centralized credential management for provisioning (e.g., encrypted provisioning templates, secure APIs).
- Rotate secrets regularly and after any suspicious event.
Practical tip
- Use a deterministic but unique pattern only if needed for provisioning — ideally with per-device salts — but prefer truly unique random secrets.
3. Storing Passwords in Plaintext Files or Repositories
Why it’s a problem
- Asterisk configuration files (sip.conf, pjsip.conf, voicemail.conf, manager.conf) often contain secrets. If these files are accessible, secrets leak.
- Committing configs to git or shared storage without filtering exposes credentials.
How to fix it
- Never commit credentials to version control. Use .gitignore or configuration templates.
- Use environment variables or external secret stores (Vault, AWS Secrets Manager, etc.) and inject them at deployment time.
- Restrict file system permissions: ensure config files are readable only by the asterisk user and administrators (e.g., chmod 640).
- Encrypt backups and restrict access to archives.
Example commands
- Set secure permissions:
chown asterisk:asterisk /etc/asterisk/*.conf chmod 640 /etc/asterisk/*.conf
4. Weak or Missing SIP Authentication Settings
Why it’s a problem
- Misconfigured SIP authentication allows unauthenticated registration or call origination, enabling toll fraud.
- Missing authentication on trunks or misapplied peer/host settings can leave services open.
How to fix it
- For chan_sip: ensure type=peer/user/friend is used correctly; use “type=peer” for providers and “type=friend” only when necessary. Set “context”, “host”, and “secret” appropriately.
- For PJSIP: configure authentication and identify sections properly, and require matching endpoints for registration and authentication.
- Use “permit” and “deny” with correct CIDR ranges to limit who can connect.
- Use secure transport (TLS, SRTP) for signaling and media whenever possible.
Sample (pjsip):
[endpoint-example] type=endpoint transport=transport-tls context=from-trunk aors=trunk-aor [auth-example] type=auth auth_type=userpass username=trunkuser password=[STRONG_PASSWORD] 5. Not Using Rate-Limiting, Fail2Ban, or Other Protections
Why it’s a problem
- Automated scanners and brute-force tools can try thousands of credentials per minute. Without protections, attackers will eventually succeed against weak secrets.
- Excessive failed attempts may not be logged or blocked.
How to fix it
- Install and configure fail2ban with Asterisk filters to block repeated failed registrations or authentication attempts.
- Use iptables/nftables rate limiting for SIP ports (UDP/TCP 5060 and any other configured ports).
- Consider using an Intrusion Prevention System (IPS) or a cloud-based SIP firewall.
Basic fail2ban example in jail.local:
[asterisk-iptables] enabled = true filter = asterisk action = iptables[name=AST, port=5060, protocol=udp] logpath = /var/log/asterisk/messages maxretry = 3 bantime = 3600 6. Weak AMI and ARI Credentials
Why it’s a problem
- Asterisk Manager Interface (AMI) and Asterisk REST Interface (ARI) provide powerful control. Compromised credentials allow full control over calls, configuration, and dialplan events.
- Often left enabled with default or weak passwords.
How to fix it
- Disable AMI/ARI if not needed.
- If required, limit access by binding to localhost or internal management networks only.
- Use strong credentials and unique user accounts for AMI/ARI.
- Use TLS and HTTPS for ARI and configure HTTP authentication properly.
- Log and monitor AMI/ARI usage.
Example AMI config (manager.conf):
[admin] secret = [STRONG_SECRET] permit=127.0.0.1/32 read = system,call,log,verbose,command,agent write = system,call,command,agent 7. Forgetting to Secure RTP and Signaling
Why it’s a problem
- Even with strong SIP passwords, unencrypted RTP and signaling can expose call content and metadata, undermining privacy and compliance.
- Attackers may perform SIP man-in-the-middle attacks to capture credentials or inject SIP messages.
How to fix it
- Configure TLS for SIP signaling and SRTP for media.
- For chan_sip, TLS support is limited; prefer PJSIP for modern encryption features.
- Use TURN/STUN and secure NAT traversal methods only with authenticated peers.
- Ensure certificates are valid and rotated appropriately.
PJSIP transport example:
[transport-tls] type=transport protocol=tls bind=0.0.0.0:5061 8. Overly Permissive Host/Network Settings
Why it’s a problem
- Setting host=0.0.0.0 or using “allowguest=yes” and wide permit ranges lets unauthorized clients attempt registrations.
- Accepting connections from everywhere invites attacks.
How to fix it
- Set explicit host IPs or use dynamic host with secure authentication.
- Disable allowguest unless you have a specific, controlled use case.
- Use “permit” and “deny” ranges to restrict acceptable IPs.
- For remote users, use VPNs to tunnel into the PBX rather than exposing SIP ports.
Configuration suggestions:
- In sip.conf/pjsip.conf, replace broad settings with specific IPs and ranges and prefer authentication-only mechanisms.
9. No Regular Password Rotation or Auditing
Why it’s a problem
- Static passwords increase the window of exposure. Forgotten or orphaned accounts remain attack vectors.
- Lack of auditing means compromises go unnoticed.
How to fix it
- Implement a rotation policy (e.g., every 90 days) and rotate high-privilege credentials more frequently.
- Audit accounts regularly: remove unused extensions, update shared devices, and reconcile provisioning templates.
- Keep logs for authentication and review them for anomalies.
Practical workflow
- Maintain an inventory spreadsheet or CMDB listing all SIP accounts, owners, devices, and last rotation date.
10. Poor User Education and Provisioning Practices
Why it’s a problem
- Users may choose weak PINs for voicemail or share credentials across devices.
- Automatic provisioning systems that embed plaintext passwords in templates can leak secrets.
How to fix it
- Train users on secure password practices and the risks of reuse.
- Use secure provisioning: HTTPS, encrypted files, or randomized one-time provisioning tokens.
- Require voicemail PIN complexity and periodic reset.
Provisioning tip
- Use HTTPS for provisioning files and include per-device credentials instead of a single shared secret.
Checklist: Quick Actions to Secure Asterisk Passwords
- Change default passwords immediately.
- Use unique, strong passwords for each account.
- Restrict access with permit/deny and bind AMI/ARI to localhost when possible.
- Protect configs: disable commits of secrets, set file permissions, and use secret managers.
- Enable encryption: TLS for signaling, SRTP for media.
- Add brute-force protections: fail2ban + firewall rate limiting.
- Rotate and audit passwords regularly.
- Disable unused services (AMI/ARI) or lock them down.
- Educate users and secure provisioning workflows.
If you want, I can:
- produce sample hardened sip.conf/pjsip.conf and manager.conf snippets tailored to your Asterisk version;
- create fail2ban filters and iptables/nftables rules; or
- produce a short rotation and auditing policy template.
Leave a Reply