Switching to VoIP

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

244

|

Chapter 10: Security and Monitoring

Use a non-default log directory

Some attackers cover their tracks by removing commonly used logfiles that could

contain evidence of their tampering with the system. So it’s generally a good idea to

keep logfiles in a non-default place. This way, if the attacker uses an automated pro-

gram to remove logfiles, it will be less likely to find and destroy Asterisk’s. To change

Asterisk’s default log location, edit /etc/asterisk/asterisk.conf and change the astlogdir

directive to a path of your choosing. (Then make sure that path has appropriate per-

missions to allow Asterisk to write files in whichever path you choose.) A sample

asterisk.conf follows:

[directories]

astetcdir => /etc/asterisk

astmoddir => /usr/lib/asterisk/modules

astvarlibdir => /var/lib/asterisk

astlogdir => /var/log/asterisk

astagidir => /var/lib/asterisk/agi-bin

astspooldir => /var/spool/asterisk

astrundir => /var/run/asterisk

Enable syslog

syslog can be a target for Asterisk logging output, too. To enable it, use a syslog key-

word in the

[logfiles] section, similar to the console keyword:

syslog.local0 => warning,error

Snort and Nagios

Snort is an open source intrusion-detection system (IDS) and packet-logging appa-

ratus. Unlike NetFilter and syslog, Snort allows more customizable logging ...