are your SIP/IAX logins coming from internal LAN or outside?
I would be interested to hear more ways to secure this option too.
I am using CSF but will be switching to ip tables with Fail2ban for future builds as I get better at using iptables, as CSF with LFD has too many additional functions going on that I dont really need or want or know what it is doing.
I currently have csf.allow populated with just the phone LAN and my VoIP provider ip networks. I may restrict this further to specific ip ranges on the Phone LAN.
in csf.conf I block all inbound traffic completely on udp and tcp.(that way only items in csf.allow can come through)
and ports are restricted on outbound too with essentials only, like port 53 for DNS, 123 for NTP etc...
I have set csf.conf so it emails me if anyone logs in using ssh, though I dont know if there are ways for an experienced hacker to bypass this yet. I have heard of people getting in and then setting up ssh logins and using .call hidden files to 'borrow' a PBX.
at which point even SIP/IAX blocking might be ineffectual.
there is also a lot of processes in lfd you have to disable from reporting if you dont want email floods once you get the email working.
I am also restricting SIP extensions to particular ip addresses on the PBX so only the phone I want can access it, theoretically.
expanding on the topic a little but here is a good thread on PBX security that may help you make the choices on action to take with csf & lfd. This comes from people who got hacked and they advised me of the above settings with csf, what better way to learn I guess...
http://forums.whirlpool.net.au/archive/1516379
I would also add that I am considering adding ACL restrictions on the switch to restrict traffic coming into the PBX from the LAN, and the router is locked down as much as possible to the VoIP provider with NO SSH inbound allowed from public side, not even on a different port as this is the way I have heard most people get hacked.
