Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Access Control

|

225

Some SIP endpoints support MD5 authentication. So do Asterisk,

VOCAL, and other softPBX systems. MD5 authentication allows you

to hash (or scramble) SIP passwords so casual observers can’t view

them. Some SIP phones don’t properly support this feature, so check

with your vendor before building MD5 into your design. To try out

MD5-equipped SIP clients with Asterisk, see Project 10.1.

It’s also important to enforce access control policies on wireless Ethernet segments.

This means using WEP keys on wireless devices that access the network by 802.11a/

b/g means. Check your wireless IP phone’s specs to see if it can be a WEP client.

Finally, credentials can be enforced by the endpoint. In a centralized authentication

system, IP phones themselves can require a username and password or PIN from

prospective callers. This way, users are authenticated before they are able to even get

a dial-tone. Cisco, Avaya, and many other vendors’ proprietary solutions support

this kind of authentication, though usually through a built-in authentication scheme,

as opposed to Active Directory or RADIUS.

Project 10.1. Use MD5 Hash to Secure SIP Passwords

What you need for this project:

• Asterisk running on a Linux PC

• The X-Lite softphone

Endpoint authentication helps you prevent somebody from ...