Category: Security

Link: Linux Terminal: sshfs, Remote directory over ssh

by Admin

Often one wants a shared access to files across machines. Traditionally one uses the network file system (nfs). The network file server works as follows: There is an nfs server that exports some directories in its filesystem hiearchy to various nfs clients that mount these directory over the network into their file system hierarchy. As a result, each of the clients shares the directories exported by the nfs server.

However a lot of times you just have to mount a directory from a server to your local computer and in these cases NFS it’s not so useful, sshfs it’s much better

Sshfs is a filesystem client based on the SSH File Transfer Protocol. Since most SSH servers already support this protocol it is very easy to set up: i.e. on the server side there’s nothing to do.  On the client side mounting the filesystem is as easy as logging into the server with ssh.

Full article here:
Linux Terminal: sshfs, Remote directory over ssh (Linuxaria)

If you used the information from the article, “A possible way to thwart SIP hack attempts on your Asterisk (or other) PBX server”, please read this

by Admin

If you took the advice in the article, A possible way to thwart SIP hack attempts on your Asterisk (or other) PBX server, please be aware that an important note has been added:

IMPORTANT: Be sure to have a separate iptables rule (higher on the list than those above) that allows connections to port 5060 from devices on your local network. Otherwise, you may find that new extensions that you are adding for the first time will not register with your Asterisk server, or that after a system reboot, none of your local extensions will register!

Please take heed of that note, or you may be one power failure or reboot away from discovering that none of your local extensions are able to register with your PBX server.

Link: How To Configure Port Knocking Using Only IPTables on an Ubuntu VPS

by Admin

Servers that are connected to the internet are subjected to all manners of attacks and probes by malicious users, scripts, and automated bots. It is sometimes a balancing act to secure your server from attacks without affecting legitimate access to your services and resources.

Certain types of services are meant to be visible and consumable to the public internet. An example of this is a web server. Other types of services are typically used by only the system administrator or a select number of individuals and are not meant to be a public resource.

A concept known as port knocking is a way of shielding processes that fit into the latter description. Port knocking works by covering the ports associated with a process behind a firewall until a specific, predetermined sequence of network activity occurs. At this point, the port knocking service reconfigures the firewall to allow access to the protected application.

Full article here:
How To Configure Port Knocking Using Only IPTables on an Ubuntu VPS (DigitalOcean)
Related:
How To Use Port Knocking to Hide your SSH Daemon from Attackers on Ubuntu (DigitalOcean)

Links: A low-cost surveillance camera using the Raspberry Pi

by Admin

We have recently come across two articles on the same topic:

Although people have been toying with USB webcams on the Raspberry Pi for some time now, the release of the official camera module has reinvigorated interest in video related projects.

The official Raspberry Pi camera module is a Full HD camera that plugs into the Raspberry Pi via the Camera Serial Interface (next to the Ethernet port) on the device. The sensor on the camera is a 5MP with fixed focus lens. It can shoot still images with a maximum resolution of 2592×1944 as well as Full HD 1080p video @ 30 FPS and 720p video @ 60 FPS.

And you get all this in a module that’s only 25x20x9mm in size and weighs just 9 grams! This makes it ideal for projects that require a small steady camera, like surveillance.

Full article here:
Use the Raspberry Pi as a DIY Surveillance camera (Make Tech Easier)

This article describes how to build a surveillance cam based on a Raspberry Pi micro-computer which records HD video when something moves in the monitored area. Live picture can be viewed from any web browser, even from your mobile while you’re on the road.

What you will get:

  • See live stream in any web browser from anywhere
  • Record any motion into video file

Usually, such a cam will cost you around US$1.000, but with the result from this article, you will get such a cam for only about US$120.

Full article here:
Raspberry Pi as low-cost HD surveillance camera (CodeProject)

The only suggestion we might make as a possible addition to either project is that if you are using this to monitor an entry area (such as a front or back porch), why not include a few bright white LED’s to provide illumination at night?  Those could be turned on and off via a cron job on the Pi, or by some type if logic that detects when there’s not enough ambient light to get a decent image, and then applies power to the LEDs (which could be powered via a GPIO pin on the Raspberry Pi if they don’t draw too much current).

Link: Manage Multiple SSH Connections Easily With PAC Manager [Linux]

by Admin

If you have used SSH to connect to a remote machine before, you know the procedure: open a terminal, type in the SSH command and the host IP, enter the password. This is probably easy for a single connection, but if you are a system administrator looking after several remote machines and have a need to manage multiple SSH connections, you will need a better and easier solution. You need PAC Manager.

Full article here:
Manage Multiple SSH Connections Easily With PAC Manager [Linux] (Make Tech Easier)

Link: Install And Learn How To Use ufw Firewall In Linux

by Admin

Ubuntu does not have many open ports by default, but there are times when you want to restrict access to a port(ports) or a specific ip adress. Maybe you run a ssh server in your ubuntu machine and want to block everyone from connecting to it, except yourself. Have you ever thought how to accomplish such things or tried to do it? You need a firewall to do that. In this article I will explain what is a firewall and teach you how to use the ufw ubuntu firewall by giving real world examples of it.

Full article here:
Install And Learn How To Use ufw Firewall In Linux (LinOxide)

A possible way to thwart SIP hack attempts on your Asterisk (or other) PBX server

by Admin

If you’ve had the problem of hackers trying to break into your Asterisk server, you probably know that you can use tools like Fail2ban to at least slow them down.  But why let them know you even have an Asterisk server in the first place?  Maybe you need to leave port 5060 open so that remote users (not on your local network) can connect to the server, but that doesn’t mean that you have to advertise to the bad guys that you might have something of interest.  With that in mind, we direct your attention to this post in the DSLReports VoIP forum:

The Linux netfilter/iptables firewall is capable of stopping these attacks before they even start.

At a bare minimum, this stops 99% of the attacks when added to your iptables ruleset:

-A INPUT -p udp --dport 5060 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p udp --dport 5060 -m string --string "REGISTER sip:your.pbx.dns.name" --algo bm -j ACCEPT
-A INPUT -p udp --dport 5060 -m string --string "REGISTER sip:" --algo bm -j DROP
-A INPUT -p udp --dport 5060 -m string --string "OPTIONS sip:" --algo bm -j DROP
-A INPUT -p udp --dport 5060 -j ACCEPT

Warning
IMPORTANT: Be sure to have a separate iptables rule (higher on the list than those above) that allows connections to port 5060 from devices on your local network. Otherwise, you may find that new extensions that you are adding for the first time will not register with your Asterisk server, or that after a system reboot, none of your local extensions will register!

To understand how this works, read the original post by DSLReports user espaeth.

For another line of defense against such attacks, see the article Stop SOME SipVicious attacks from reaching your Asterisk, FreeSwitch, YATE, etc. PBX server.

Link: Securing Your Asterisk VoIP Server with IPTables

by Admin

Now that you have set up your personal Asterisk® server, it’s time to secure it. I can’t overstate the importance of this step. Without it, you could be leaving your server’s VoIP and SSH ports open for anyone on the Internet, which is a very bad idea and may cost you a lot of money.

Full article here:
Securing Your Asterisk VoIP Server with IPTables (Lin’s Tech Blog)

Why you can’t get SRTP encryption to work between Asterisk and your VoIP adapter or phone

by Admin

Some recent versions of Asterisk (Asterisk 11 in particular) have built-in SRTP support of sorts. As Wikipedia notes,

The Secure Real-time Transport Protocol (or SRTP) defines a profile of RTP (Real-time Transport Protocol), intended to provide encryption, message authentication and integrity, and replay protection to the RTP data in both unicast and multicast applications. It was developed by a small team of IP protocol and cryptographic experts from Cisco and Ericsson including David Oran, David McGrew, Mark Baugher, Mats Naslund, Elisabetta Carrara, James Black, Karl Norman, and Rolf Blom. It was first published by the IETF in March 2004 as RFC 3711.

In simple terms, SRTP encrypts the audio of your VoIP calls, making it much more difficult for anyone with a packet sniffer to listen in.

Let’s say you have an Android-based tablet and you are running CSipSimple. If you have configured it as an extension off your Asterisk 11 server, and you turn SRTP on in the security settings, you will likely find that outgoing calls work fine but incoming calls do not.  The reason is that you need to add one line to the extension’s configuration settings in Asterisk:

encryption=yes

If you are using FreePBX then it’s only a bit more complicated.  You’d need to add two lines to the /etc/asterisk/sip_custom_post.conf file:

[####](+)
encryption=yes

Replacing #### with the extension number. Once you have done this and reloaded Asterisk, it will only communicate with the endpoint using SRTP.

BUT there is one problem here.  With some other VoIP devices and softphones, once your have enabled SRTP, any attempt to place an outgoing call will not work.  And, if you watch the Asterisk CLI, you may see lines similar to this:

[2013-12-19 08:18:57] NOTICE[2949][C-000005e9]: sip/sdp_crypto.c:255 sdp_crypto_process: Crypto life time unsupported: crypto:1 AES_CM_128_HMAC_SHA1_80 inline:6aV+PFYMnVJVUZuxug9EM5yefPnfOrNhHcKLSABE|2^20
[2013-12-19 08:18:57] NOTICE[2949][C-000005e9]: sip/sdp_crypto.c:265 sdp_crypto_process: SRTP crypto offer not acceptable
[2013-12-19 08:18:57] WARNING[2949][C-000005e9]: chan_sip.c:10454 process_sdp: Rejecting secure audio stream without encryption details: audio 17100 RTP/SAVP 0 8 18 104 101

The problem is that in Asterisk, “any SRTP offers that specify the optional lifetime key component will fail”, as is detailed in this submitted patch to Asterisk:

(ASTERISK-17899) [patch] Adds a ‘ignorecryptolifetime’ (Ignore Crypto Lifetime) option to sip.conf for SRTP keys specifying optional ‘lifetime’

If if the device or softphone had a setting to disable sending the lifetime parameter, it probably would work. If users would go through the trouble of applying this patch to Asterisk, it would probably work, but many users either don’t know how to do that, or they are running a pre-built distribution and don’t want to or cannot tamper with it (also, any upgrades to Asterisk thereafter would require re-application of the patch). If Digium would apply this patch to Asterisk and push it out in upgrade releases, it probably would work. But for whatever reason, though this patch was first posted back in May of 2011, Digium has not seen fit to roll it into Asterisk.

So, this may very well be the reason, or at least one of the reasons, why you can’t get SRTP encryption to work between Asterisk and your VoIP adapter or phone! Basically, your VoIP device or softphone and Asterisk just don’t want to play nice with each other.

We’ve heard that some other varieties of PBX software, such as FreeSWITCH, might not have this issue, but since we don’t have a working FreeSWITCH installation at the moment we cannot comment on that.

Recent Posts

Recent Comments

Archives

Categories

Meta

GiottoPress by Enrique Chavez