Security

Firewall

The installer configures firewalld (ufw is disabled) and opens the ports listed in INSTALL.md. Manage them on Firewall or with firewall-cmd.

Recommended: SIP (5060/udp+tcp, 5061/tcp) is scanned constantly on the internet. If only your carrier and local phones use SIP, remove the open ports and allow the sources instead:

for src in 203.0.113.10 10.0.0.0/8; do            # carrier IP, internal networks
  for pp in 5060/udp 5060/tcp 5061/tcp; do
    firewall-cmd --permanent --add-rich-rule="rule family=\"ipv4\" source address=\"$src\" port port=\"${pp%/*}\" protocol=\"${pp#*/}\" accept"
  done
done
for pp in 5060/udp 5060/tcp 5061/tcp; do firewall-cmd --permanent --remove-port=$pp; done
firewall-cmd --reload

The web softphone and the mobile apps connect over 443 and are not affected. RTP (10000–20000/udp) must stay open for carrier audio, and UDPTL (4100–4999/udp) for T.38 fax. The Firewall page shows and removes these rules.

Asterisk's own TLS WebSocket (8089) listens on loopback only: browsers and the mobile apps use 443 /ws, which goes through the nginx/Apache edge. Earlier versions opened 8089 publicly; installing or updating closes it.

SSH is left as the operating system configured it. If root can log in with a password, the installer prints a warning; prefer key-only logins and allow port 22 only from trusted networks.

fail2ban

Jails: asterisk (failed SIP registrations/auth), aipbx-web (portal logins, using the real client IP from the PROXY protocol) and sshd. Ban time, find time, max retries and the ignore list are set on the fail2ban page; the portal writes them to /etc/fail2ban/jail.d/zz-ai-pbx.local, which is read last so it overrides the installer's defaults. Add your internal networks and carrier to the ignore list so a misconfigured phone cannot lock them out.

• Failed registration alarm: The Failed registrations health check monitors Asterisk's security log and alarms in the bell and by e-mail when failed SIP authentication attempts exceed the configured threshold (see PBX fine tuning).

Toll fraud

Three brakes, all off until switched on:

• Night dialling protection (Dial permissions page): outside the night hours set there (and all weekend if wanted), calls to protected prefixes (default 00 international and 0900 premium) are blocked ("Your call cannot be completed as dialled", without answering the call) or need a night PIN (three tries). It runs before the permission groups, so it also covers trunk-to-trunk transit; portal faxes are exempt. Blocked calls carry NIGHT_GUARD in the CDR user field.
• Trunk limits (Trunks → Routing): concurrent channels and calls per minute, with the health alarm Trunk limits (see Trunks).
• Dial permission groups: which numbers a group of users may dial at all.

Root helper (aipbx-priv)

The portal never runs arbitrary commands as root. /etc/sudoers.d/aipbx allows www-data to run only /usr/local/sbin/aipbx-priv, whose subcommands each map to one fixed operation with validated arguments (service reloads, postfix relay, firewall rules, fail2ban, update check/start).

Apache sandbox

Ubuntu's apache2.service is hardened with systemd sandboxing. The installer's override (/etc/systemd/system/apache2.service.d/override.conf) relaxes only what the portal needs:

• /etc/sudoers and /etc/sudoers.d readable, so sudo aipbx-priv works;
• /etc/asterisk, /etc/postfix and /etc/fail2ban/jail.d writable (everything else under /etc stays read-only);
• /root, /boot, /etc/ssh, /etc/apt stay inaccessible.

Scheduled task sandbox

Scheduled background scripts run in a hardened systemd-run sandbox as the unprivileged user aipbx-task with an isolated filesystem, strict resource limits, and private network namespaces (see Scheduled tasks).

Read-only external databases

External database queries in IVR data steps and plugins run in strictly enforced read-only sessions with a 2.5-second statement timeout, single statement restrictions, and encrypted credentials (see External databases).

Other measures

TOTP two-factor authentication, passkeys, account/IP lockout with CAPTCHA, CSRF tokens on every form and API call, sessions revoked on password change, least-privilege database users (runtime vs. migrations), secrets only in /etc/ai-pbx.env (640 root:asterisk), Asterisk HTTP/AMI on loopback.