Alright, I need use external tools as fail2ban and better use TLS, but in configuration...

I understand the security configuration is on "sip_profiles". My current configuration is:

    <param name="auth-calls" value="true"/>
    <param name="inbound-reg-force-matching-username" value="true"/>
    <param name="auth-all-packets" value="false"/>
    <param name="log-auth-failures" value="true"/>

Is there some other option recommended to use on "sip_profiles"?

On the directory. Is it possible use only "user id" for authentication and don't accepts "number-alias" as username?

Thanks.