Loren,

  You did not explain why the allstar server has to be on DMZ? If there are other ports you need forwarded echolink, irlp, etc. to that computer you can do that. It would be much better to take the time and get the proper ports working then to have it open to the world. DMZ is OK for testing but not continuous use.

You can certainly add protection to the linux box in the form of firewall, PW protection etc. but the best place to do it is at the source in the router. Why make it complicated!!  The BeagleBone Black Allstar does have a pre-configured firewall that can be implemented easily in a situation where you might need it.

73 Doug
WA3DSP
http://www.crompton.com/hamradio


Date: Thu, 25 Sep 2014 08:58:58 -0500
Subject: Re: [App_rpt-users] Security Issues
From: lorentedford@gmail.com
To: doug@crompton.com

Doug


We are using a ARRIS/Motorola SBG6580 SURFboard DOCSIS 3.0 Cable Modem and WiFi-N Router. This unit is DMZ to our Allstar box for a few purposes one being that the node is also being utilized for more that just repeater functions.. 2nd we have changed our port for ssh for security purposes first off just in the event we get attacked with a bunch of ssh hackers like my Linode server was under the past 3 weeks... We keep getting Chinese Ips trying to hack access to our public servers... Anyway back to the point.. We didnt realize that the server over all is open so.. If this is the case isnt there a firewall built into the acid distro? if not would it be easier for us to throw like Debian like what i have on my other servers that I use and still be capable of running allstar setup with both repeaters.. Lots of questions here i know.. But if the software cant handle its own firewall functions I need to look at a more long term solutions. I at least figured it had Iptables in it unless i looked in the wrong place..
also in the Moduels.conf


;
; Asterisk configuration file
;
; Module Loader configuration file
;

[modules]
autoload=yes
noload=chan_oss.so
noload=chan_alsa.so
noload=chan_phone.so
noload=chan_sip.so

[global]


I really like remoting the system do it all the time from work using ssh via my phone when making adjustments to my stuff..

Thanks so much for getting back to me so quickly and let me know if there is anything i did wrong or any other suggestions based on this.. I am also using the Echolink.conf file for now it will one day be moved to the 2 meter repeater once we get our duplexer problem fixed been a rough couple of weeks from everything to unauthorized access attempts to damaged product during shipping gotta love UPS thanks again 73's Loren~



On Wed, Sep 24, 2014 at 9:43 PM, Doug Crompton <doug@crompton.com> wrote:
I assume you have the linux box behind a router? If so why would you have sip even routed to your linux box if you are not using it? Routers make good firewalls. The only thing you should have routed is 4569 (udp) and 222 (tcp)   neither have to be routed.  4569 would only need to be routed if you wanted to accept incoming connections. Outgoing would work fine without it. 222 would only be needed for administration.

From what you are saying you obviously must not have a front-end (router firewall etc.) on your system . It sounds like you are just hanging on the raw Internet!! Some people go the easy route and put thhings in the DMZ of their routers which does open them up to the world. I went into an Allstar system this week to help with setup and I immediately knew it was on the DMZ. In the Asterisk client I was getting sip messages left and right. I unloaded the sip module and they went away. Not the right way to do it though as it should not be on dmz to begin with. Simply not having a sip.conf file does not prevent sip traffic!!!

Assuming you have a router there should be no need to disable sip as it is never going to get to your box unless you port forward it there. It would be a good idea thought to not load the code for it if you are not using it. A noload=chan_sip.so   in modules.conf would take care of that.

Most good routers also allow you to specify specific or blocks of IP addresses to disallow. If there is a specific foreign block, say in China you can identify you could probably block it.

So the bottom line is you could make your linux system tottally unavailable to the outside world by just not forwarding any ports. The downside is no one could connect to you (sometimes desirable) and you could not remotely administer your system.  


73 Doug
WA3DSP
http://www.crompton.com/hamradio


Date: Wed, 24 Sep 2014 20:52:22 -0500
From: lorentedford@gmail.com
To: app_rpt-users@ohnosec.org
Subject: [App_rpt-users] Security Issues


Hey its Loren here again...

Was curious what everyone found was the most substantial security risk with a Acid installation connected too two repeaters.. The sip.conf was deleted from the asterisks folder..  Noticed a strange node connection that didn’t match all stars normal node numbers 3101702 also found some thing with x.allstarlink.org in it anybody know what this is?? Anyway my linode server has been under constant attack from China they keep wanting to ssh into the server we had to drastically beef up things on the server such as changing the whole root user issue and moving to another port number etc.. Any thoughts ideas did i just become victum of a Sip attack too besides 19 ddos attacks this week already and over a million failed ssh attempts into my person linode server...

_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.