Think Like a Hacker! Protect Your PBX - Part 1: Recon

[KyriakosP]

“To know your Enemy, you must become your Enemy.” ~ Sun Tzu, \"The Art of War\" The modern Internet landscape can be a landmine for the uninitiated. In order to keep an internet-facing PBX secure and on-line, you need to be aware of the security implications, and be able to manage them. This series of security-related articles will assist you i...

Continue reading the Original Blog Post.

 

[Chris9000]

nice article, any tips or guides on "hardening" the PBX software itself?

 

[KyriakosP]

Hi @Chris9000,

Thank you for your message. For now you can use the info and guidelines presented here:

https://www.3cx.com/docs/voip-security/

https://www.3cx.com/blog/voip-howto/pbx-security/

https://www.3cx.com/3cxacademy/videos/advanced/security-with-3cx-phone-system/

We will present more relevant info in upcoming posts in this series.

 

[jed]

Really nice job, look forward to read the rest

 

[KyriakosP]

Hi @jed,

Thank your for your reply and your kind words! The next part in this series is in the works and should come out soon.

 

[PvK]

Thank you for that, looking forward to the hardening part. Can I restrict the port 5060 and 5061 to just the trunk provider IP address to avoid random password trials?

 

[SteveITS]

Can I restrict the port 5060 and 5061 to just the trunk provider IP address

5060 for example is still used by WebRTC: https://www.3cx.com/docs/ports/

 

[KyriakosP]

Hi @PvK,

Glad you liked the article. You can generally safely restrict traffic on any unused ports. We'll be focusing on more specific info in an upcoming post in this series for hardening your PBX. For now you can refer to:

https://www.3cx.com/3cxacademy/videos/advanced/security-with-3cx-phone-system/