Security Guide - IPBRICK Update 11 v5.3

Transcription

1 Security Guide - IPBRICK Update 11 v5.3 iportalmais 27 de Junho de

2 Conteúdo 1 Introduction Basic security threats Security Policies Overview Master/Slave and Master/Client Troubleshooting Remote phones cannot register Cannot make calls via a SIP route Cannot send FAX over IP Practical examples - Adding a Firewall Rule Firewall rule for an IP Firewall rule for a Network

3 Lista de Figuras 1 Slave/Client Installation Warning Example 1 - Firewall rule insertion - For an IP Example 2 - Firewall rule insertion - For a Network

4 1 Introduction IPBRICK International prides itself in providing the most cost-effective solutions available. But IPBRICK has more than enough features to implement a VoIP solution with full security for all our customers and partners. Unfortunately, what we have seen in the past is that some of our customers opt for a easy and carefree outlook on security and do not follow IPBRICK International security guidelines. These new security rules prevent this kind of reckless behavior and forces everyone to abide by IPBRICK s security guidelines. From now on, if you use IPBRICK, security is not an option it is mandatory! 1.1 Basic security threats Threats on a daily basis are common; and it is up to IPBRICK International to secure your private information, from unauthorized access and even mismanagement, ensuring that this menace can be suppressed. The basic risks to network security are: Denial-of-service (DoS) attacks: Attempts to make a machine or network resource unavailable to its intended users; Eavesdropping: A network attack consisting of capturing packets and reading the data content in search of any kind of confidential information; Packet spoofing: Data falsification by a person or program (e.g.: Caller ID). IPBRICK s update_11-v5.3 aims at solving these issues by protecting your SIP trunks from unauthorized use. (Please consult section 2 Security Policies Overview of this document). 2 Security Policies Overview With our new update_11-v5.3, the SIP access via Internet is now more restricted, since all unknown VoIP communications (not configured at IPBRICK) to port UDP 5090 are blocked by the firewall. Any access, by an unknown route, must be accounted for by creating new firewall rules authorizing access to port 5090/UDP. 4

5 If all previous configured routes, at IPBRICK, are resolved by the DNS, they will be authorized and don t need any additional rule. But if the DNS doesn t resolve them you will have to add a firewall rule authorizing access to port 5090/UDP (please check Figure 2). Please bear in mind that, every remote phone access is permanently blocked and you will need to create a firewall rule in order to open up port 5090/UDP. Our recommendation is to use VPNs. All Phone passwords must also comply with new security policies: Minimum number of characters: 8 Cannot contain the phone s name. Must contain elements of at least three of the following four groups of characters: Uppercase letters (A through Z) Lowercase letters (a through z) Numbers (0 through 9) Special characters (such as!,$,%,#) IMPORTANTE NOTE: If your phones are configured by auto-provisioning all you need to do after altering the passwords is restart your phones. But if they are not configured this way, you will have to individually alter the passwords and restart your phones. 2.1 Master/Slave and Master/Client If your machine operates under a master/slave or master/client typology you must first install the update_11-v5.3 package at the master server. If you install it first on the slave or client server you will get an error message (Figure 1) stating that you must first install the deb package at the master server, only after may you install it at the slave or client server. 5

6 Figura 1: Slave/Client Installation Warning 3 Troubleshooting 3.1 Remote phones cannot register. After the update_11-v5.3 installation, port 5090/UDP is blocked by the firewall. As Remote phones use this port to register, it s expected that they will not be able to register. To solve this, please choose one of the following options: If the remote phone is behind an internet access with a static IP address, a firewall rule must be configured in order to accept incoming traffic from that IP to destination port 5090/UDP (please check Figure 2). If the remote phone is behind an internet access with a dynamic IP address, when possible, a VPN tunnel should be used. If the use of a VPN tunnel is not possible you will need to add a firewall rule in order to accept incoming traffic to port 5090/UDP from any location. In this case, you should accept only the provider s network from where the remote phone is registering (please check Figure 3). 3.2 Cannot make calls via a SIP route If you cannot make calls via a SIP route, it will be necessary to verify if that route s IP address is allowed at the firewall. If it is not allowed, you will have to insert a new firewall rule allowing access to the UDP port When the SIP route is set with a hostname, it will be necessary to identify which IP address are assigned to it. These IP addresses have to have firewall rules 6

7 allowing access to UDP port Every time you add a new SIP route make sure to allow access by adding a firewall rule. 3.3 Cannot send FAX over IP FoIP-SIP and FoIP-T38 routes If you cannot send FAXES over IP, it will be necessary to verify if the route s IP address is allowed by the firewall. If not insert a firewall rule allowing access to the UDP port Every time you add a new FAX route make sure to allow access by adding a firewall rule. 4 Practical examples - Adding a Firewall Rule 4.1 Firewall rule for an IP At the IPBRICK s web interface go to: Advanced Configurations > Network > Firewall Insert a new rule, as presented in Figure 2. NOTE: The IP provided here is presented merely as an example. You must replace it with the proper IP. 7

8 Figura 2: Example 1 - Firewall rule insertion - For an IP 4.2 Firewall rule for a Network At the IPBRICK s web interface go to: Advanced Configurations > Network > Firewall Insert a new rule, as presented in Figure 3. NOTE: The network IP address provided here is presented merely as an example. You must replace it with the one that fits your scenario. 8

9 Figura 3: Example 2 - Firewall rule insertion - For a Network 9