FreeSWITCH Security Hardening Project
While sitting here in the hospital I have been talking to Philip Zimermann (ZRTP) via phone... And we have talked about a FreeSWITCH hardening project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the MAX. I would like to start this project to make FreeSWITCH more secure in the long run. (not saying that its not secure now). Who would be interested in such a project? Thanks, -- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in security. m3 2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann (ZRTP) via phone... And we have talked about a FreeSWITCH hardening project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the MAX. I would like to start this project to make FreeSWITCH more secure in the long run. (not saying that its not secure now). Who would be interested in such a project?
Thanks, -- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I know we have some BSD folks using it but not sure how well tested it is. I think we need to have a deployment protocol for a secure environment. You have to not only worry about the machines security but the toll fraud aspect and various other attacks that can originate in that manner. /b On Feb 17, 2012, at 10:26 PM, Mario Augusto Mania wrote:
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in security.
m3
2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann (ZRTP) via phone... And we have talked about a FreeSWITCH hardening project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the MAX. I would like to start this project to make FreeSWITCH more secure in the long run. (not saying that its not secure now). Who would be interested in such a project?
Thanks, -- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
Oh yes, yes, I agree. :) I'm just talking about my skills and interests. :) m3 2012/2/18 Brian West <brian@freeswitch.org>
I know we have some BSD folks using it but not sure how well tested it is. I think we need to have a deployment protocol for a secure environment. You have to not only worry about the machines security but the toll fraud aspect and various other attacks that can originate in that manner.
/b
On Feb 17, 2012, at 10:26 PM, Mario Augusto Mania wrote:
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in security.
m3
2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann
(ZRTP) via phone... And we have talked about a FreeSWITCH hardening
project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the
MAX. I would like to start this project to make FreeSWITCH more secure in
the long run. (not saying that its not secure now). Who would be
interested in such a project?
Thanks,
--
Brian West
FreeSWITCH Solutions, LLC
Phone: +1 (918) 420-9266
Fax: +1 (918) 420-9267
brian@freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I personally think FreeSWITCH is already hardened enough - Only a fool or uninformed would allow the switch to be... well... left insecure in the first place. We could harden FreeSWITCH by just simply re-writing the dialplan from scratch. On Fri, Feb 17, 2012 at 8:45 PM, Brian West <brian@freeswitch.org> wrote:
I know we have some BSD folks using it but not sure how well tested it is. I think we need to have a deployment protocol for a secure environment. You have to not only worry about the machines security but the toll fraud aspect and various other attacks that can originate in that manner.
/b
On Feb 17, 2012, at 10:26 PM, Mario Augusto Mania wrote:
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in security.
m3
2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann
(ZRTP) via phone... And we have talked about a FreeSWITCH hardening
project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the
MAX. I would like to start this project to make FreeSWITCH more secure in
the long run. (not saying that its not secure now). Who would be
interested in such a project?
Thanks,
--
Brian West
FreeSWITCH Solutions, LLC
Phone: +1 (918) 420-9266
Fax: +1 (918) 420-9267
brian@freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I'm talking more of an OS level security protocol... best practice guide. I'm sure we could make an effort to document these steps. /b On Feb 17, 2012, at 10:50 PM, curriegrad2004 wrote:
I personally think FreeSWITCH is already hardened enough - Only a fool or uninformed would allow the switch to be... well... left insecure in the first place.
We could harden FreeSWITCH by just simply re-writing the dialplan from scratch.
On Fri, Feb 17, 2012 at 8:45 PM, Brian West <brian@freeswitch.org> wrote:
I know we have some BSD folks using it but not sure how well tested it is. I think we need to have a deployment protocol for a secure environment. You have to not only worry about the machines security but the toll fraud aspect and various other attacks that can originate in that manner.
/b
On Feb 17, 2012, at 10:26 PM, Mario Augusto Mania wrote:
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in security.
m3
2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann
(ZRTP) via phone... And we have talked about a FreeSWITCH hardening
project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the
MAX. I would like to start this project to make FreeSWITCH more secure in
the long run. (not saying that its not secure now). Who would be
interested in such a project?
Thanks,
--
Brian West
FreeSWITCH Solutions, LLC
Phone: +1 (918) 420-9266
Fax: +1 (918) 420-9267
brian@freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
Perfect. Is this even the right way. I worked on a project for a company here in Brazil, where I developed a layer of business logic that controls the resource limits, such as minutes,destinations, and especially monetary values. All this based on the usage profile of customers. The result has been fantastic. A little more work for administrators, however, far fewer headaches. I would be very happy to participate. 2012/2/18 Brian West <brian@freeswitch.org>
I'm talking more of an OS level security protocol... best practice guide. I'm sure we could make an effort to document these steps.
/b
On Feb 17, 2012, at 10:50 PM, curriegrad2004 wrote:
I personally think FreeSWITCH is already hardened enough - Only a fool or uninformed would allow the switch to be... well... left insecure in the first place.
We could harden FreeSWITCH by just simply re-writing the dialplan from scratch.
On Fri, Feb 17, 2012 at 8:45 PM, Brian West <brian@freeswitch.org> wrote:
I know we have some BSD folks using it but not sure how well tested it is.
I think we need to have a deployment protocol for a secure environment.
You have to not only worry about the machines security but the toll fraud
aspect and various other attacks that can originate in that manner.
/b
On Feb 17, 2012, at 10:26 PM, Mario Augusto Mania wrote:
Hi Brian, I am. I'm a brazilian developer and BSD oses user with focus in
security.
m3
2012/2/18 Brian West <brian@freeswitch.org>
While sitting here in the hospital I have been talking to Philip Zimermann
(ZRTP) via phone... And we have talked about a FreeSWITCH hardening
project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the
MAX. I would like to start this project to make FreeSWITCH more secure in
the long run. (not saying that its not secure now). Who would be
interested in such a project?
Thanks,
--
Brian West
FreeSWITCH Solutions, LLC
Phone: +1 (918) 420-9266
Fax: +1 (918) 420-9267
brian@freeswitch.org
--
Brian West
FreeSWITCH Solutions, LLC
Phone: +1 (918) 420-9266
Fax: +1 (918) 420-9267
brian@freeswitch.org
-- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I'm talking more of an OS level security protocol... best practice guide. If it is of any help, on all my systems here, I deploy SELinux - a security framework I am extremely happy with. All my system components (packages, programs etc) are confined in their own security realms by deploying appropriate security policies.
Most of these policy were designed from scratch - by myself, other were changed from the "standard" ones provided by my distro to reflect the particular settings of my host environment. I have been using SELinux for years and I can vouch for it - it provides sufficiently good (understand deep) level of security - it goes to the Linux core. As I am fairly new to FS (until about a month ago I didn't even know it existed and initially wanted to use and deploy Asterisk, but soon realised the error in my ways ;-) ), I am in a process of writing one such security policy for FS, which, after the appropriate testing and possible tweaking, will be deployed on the system I intend to use FS on. If there is a sufficient interest I will provide this new policy to everyone interested - as I already pointed out, SELinux provides a very good level of security when deployed properly, so it is capable of confining packages/applications where they belong - in their own security realm. As far as the non-OS level of security goes (i.e. securing FS itself from internal exploits of the protocol(s) it uses, including toll fraud etc) then I won't be of much use until I know more about FS - something I am in a process of correcting as I do read up about how FS works from various sources, including the FS book (and soon to get hold of the cookbook as well).
Hi Josh, On 02/18/2012 04:57 PM, Josh wrote: [snip]
I am in a process of writing one such security policy for FS, which, after the appropriate testing and possible tweaking, will be deployed on the system I intend to use FS on. If there is a sufficient interest I will provide this new policy to everyone interested
Definitely interested. Please keep the list updated with your progress and the location where the policy can be downloaded once you are ready to share it. Regards, Patrick
There is definitely a need for documentation on how to secure FS for idiots like me Recently I had to do it and yes there is some docs but without this list I would not have found it let alone fully understand it (still not sure I am better protected to be fair) So a guide on how to do it the proper way would be great for me My contribution would be to test it :) /Philippe On Feb 18, 2012 11:40 AM, "Patrick Lists" <freeswitch-list@puzzled.xs4all.nl> wrote:
Hi Josh,
On 02/18/2012 04:57 PM, Josh wrote: [snip]
I am in a process of writing one such security policy for FS, which, after the appropriate testing and possible tweaking, will be deployed on the system I intend to use FS on. If there is a sufficient interest I will provide this new policy to everyone interested
Definitely interested. Please keep the list updated with your progress and the location where the policy can be downloaded once you are ready to share it.
Regards, Patrick
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Definitely interested. Please keep the list updated with your progress and the location where the policy can be downloaded once you are ready to share it.
OK, will do. At this stage, I just managed to compile the whole FS distribution and package it into .rpm files and that was a challenge in itself (I did find some bugs in the process, which I will post through JIRA later on), so the next thing for me to do is to deploy this on my test harness and read up a bit more about FS itself before configuring it, running some pretty basic configuration, before I finish up the 2nd draft of the security policy and fine-tune it based on the feedback I get from SELinux/auditd. Will keep you posted on my progress.
On 19-02-12 20:51, Josh wrote:
Definitely interested. Please keep the list updated with your progress and the location where the policy can be downloaded once you are ready to share it.
OK, will do.
At this stage, I just managed to compile the whole FS distribution and package it into .rpm files and that was a challenge in itself (I did find some bugs in the process, which I will post through JIRA later on), so the next thing for me to do is to deploy this on my test harness and read up a bit more about FS itself before configuring it, running some pretty basic configuration, before I finish up the 2nd draft of the security policy and fine-tune it based on the feedback I get from SELinux/auditd. Will keep you posted on my progress.
Thanks! Does your FS RPM install to /opt/freeswitch/... or do you follow the FHS [1] and stick binaries in /usr/sbin, libs in /usr/lib64, configs in /etc/{sysconfig} etc.? Regards, Patrick [1] https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard
Thanks! Does your FS RPM install to /opt/freeswitch/... or do you follow the FHS [1] and stick binaries in /usr/sbin, libs in /usr/lib64, configs in /etc/{sysconfig} etc.?
FHS to a major extent - binaries in /usr/sbin, libs in /usr/lib[64]/%{name}, configs in /etc/%{name} as well as /etc/sysconfig etc. %{name} stands for freeswitch, obviously ;-) !
After seeing how easy toll fraud is on Asterisk, it's certainly something I want to investigate with FreeSWITCH. We put proxies in front just to add an extra layer of checking because FS is so big (or, Sofia is so complete) we aren't always sure what it'll do in every case (SIP is a huge mess of a spec, and following it exactly definitely means toll fraud). I think a lot of security can be quickly added by having clear documentation showing how to configure FS for common scenarios, like a VoIP provider. (Disabling 302s, refers, forcing NAT handling on for SIP in all cases, etc.) Another issue I know is just waiting for exploit is the argument passing style. Every application is forced to come up with its own syntax for cramming arguments and options together, each with its own (not formally documented) escaping rules. That's just ripe for someone exploiting bugs in other code. (I've seen a real-world, production system rooted precisely from this style of bug.) Or do you mean lower level things like C-style bugs? Stuff that doesn't exist in typesafe memory-verified languages? ;) -Michael From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: Friday, February 17, 2012 8:45 PM To: FreeSWITCH Users Help Subject: [Freeswitch-users] FreeSWITCH Security Hardening Project While sitting here in the hospital I have been talking to Philip Zimermann (ZRTP) via phone... And we have talked about a FreeSWITCH hardening project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the MAX. I would like to start this project to make FreeSWITCH more secure in the long run. (not saying that its not secure now). Who would be interested in such a project? Thanks, -- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org<mailto:brian@freeswitch.org> http://www.freeswitch.org
If that would include more frequent formal releases and periodic security updates, I'm all for it! Deploying from HEAD is usually a risky undertaking on most projects. -brian On Feb 17, 2012, at 10:44 PM, Brian West wrote:
While sitting here in the hospital I have been talking to Philip Zimermann (ZRTP) via phone... And we have talked about a FreeSWITCH hardening project (NO JOKES PLEASE). This is taking FreeSWITCH and security to the MAX. I would like to start this project to make FreeSWITCH more secure in the long run. (not saying that its not secure now). Who would be interested in such a project?
Thanks, -- Brian West FreeSWITCH Solutions, LLC Phone: +1 (918) 420-9266 Fax: +1 (918) 420-9267 brian@freeswitch.org http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (9)
-
Brian Cuthie
-
Brian West
-
curriegrad2004
-
georg＠riseup.net
-
Josh
-
Mario Augusto Mania
-
Michael Giagnocavo
-
Patrick Lists
-
Philippe Le Toquin