Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

230

|

Chapter 10: Security and Monitoring

Hardening VoIP Servers

An important aspect of software security is hardening: the act of proactively making

your operating system and application software more secure. On a softPBX server,

hardening means removing unnecessary services and software agents, so that you

have less of a garden of possible security vulnerabilities to worry about.

On Windows servers, this often means removing unneeded services. If Microsoft

Internet Information Services isn’t needed, shut it down or remove it. That’s one less

risk. The same is true of Linux systems. Notoriously exploitable software like

Apache and BIND should be carefully patched or just removed from the system.

But hardening isn’t just disabling or removing software from telephony servers. It

also means optimizing the system configuration of every relevant device on the net-

work. On an Asterisk server on Linux, for example, this would mean establishing a

very restrictive local firewall policy. That way, only authorized traffic can get into,

and out of, the softPBX. This is sort of access control at the host level—the last line

of defense, if you will.

Even if a would-be intruder is sitting three feet away from your softPBX server, he

won’t be able to break in if it’s hardened correctly. Here are some ...