Security Nightmare of the Day

[wardmundy]

A new iPhone app was released today called Pocket Asterisk. Trademark issues aside, here's the recommended setup for system access to your Asterisk server at the office. No mention of a need for a secure password. Yikes!

Support

You need to enable the Asterisk Manager Interface on your server, just edit your /etc/asterisk/manager.conf file to look something like this:


[general]
enabled=yes
port=5038

[foo]
secret=bar
read=system,call,command
write=system,call,command





Save and restart your Asterisk server, done.
Your Asterisk server is behind a firewall? Just forward whatever port you defined in /etc/asterisk/manager.conf, works great.

 

[mark-hc]

wow.

At least it's keeping hackers busy and away from my box

 

[heavylogic]

Hi guys! I'm the developer for Pocket Operator (http://pocketoperator.com), previously Pocket Asterisk.

Certainly security should be considered in all things we do and using the Asterisk Manager Interface is no exception.

Most good Asterisk admins would use a VPN for access to their private network and not expose the Asterisk Manager Interface to the public Internet. The iPhone has great VPN support.

Unfortunately, the Asterisk Manager Interface only supports plain text, but you could use a simple md5 challenge/response if you're exposing to the public Internet and concerned about the security implications.

Obviously (at least to me) the manager.conf sample posted on the Pocket Operator website was an example of where to start, "foo" and "bar" are generally accepted standard example text and shouldn't actually be used as the username and password. Absolutely complex passwords should be used.

Asterisk 1.6 introduces TLS encryption that can be used with the Asterisk Manager Interface. If the app gains some popularity I'll update it to include TLS support for Asterisk 1.6 based installations.

Your feedback is very much appreciated and certainly welcome.

Edit: I'm also working on an iPad version called Operator Anywhere.

Bill Kervaski / HeavyLogic