Switchvox VoIP Security

Security is always a concern when installing any new devices on a network, and Switchvox certainly is no exception. We frequently get asked about what steps Digium has taken to ensure security on their Switchvox SMB appliances. Chromis Technology addresses four main concerns that our customers ask us about: 1) access to the web interface, 2) access to the manufacturer console and asterisk core, 3) SIP authentication security, and 4) RTP session security.

Following are descriptions of Switchvox security relating to each concern:

1. Switchvox uses the web standard Secure Socket Layer (SSL) to access the web configuration interface. SSL is the same technology that banks use to conduct online banking. Switchvox allows for the creation of multiple administrators, each with different service level access to the administration web interface. Thus administrators may create different administrators so that powerful controls are limited according to the requirements for specific administrators. Users also may be granted or denied access to the user web interface. Users also use SSL to access their individual settings and must use a password to log in.

2. Switchvox runs using the secure operating system Linux. The server is locked down by default so that only PBX and web interface functions are permitted. The administrator may optionally enable or disable remote console access so that the manufacturer can access the server for advanced diagnostics or repair. The protocol used is Secure SHell (SSH), a high-security system for console access to servers. SSH is disabled by default and the manufacturer (Digium) only has access to the backend if an administrator chooses to grant a technician access. This will then allow a Digium support engineer to access the asterisk core.

3. Session Initiation Protocol (SIP) is the VoIP protocol that Switchvox uses to connect to telephones. SIP uses a password in a method that is analogous to the way that an email account uses a password to access an email server. Switchvox automatically configures Polycom and snom telephones with secure SIP passwords. This ensures that if a SIP device attempts to connect to Switchvox it will be prevented access unless it has the correct secure SIP password for that individual extension it is trying to register. This password is hidden and cannot be discovered. If a user or administrator forgets their password, they must reset with a new pasword. Switchvox employs complicated, secure passwords for SIP devices and informs the administrator if he or she attempts to create an insecure password.

4. Real Time Transfer (RTP) is the VoIP protocol that Switchvox uses to transport the audio calls between telephones and the server. RTP by itself does not prevent someone from collecting the data from the Switchvox network and listening to pieces of a call. Enhancements to RTP in the future will allow the audio data to be encrypted so that the data captured will not be audible. It is difficult to intercept RTP traffic and requires direct access to the telephone system network. However, until Digium incorporates a secure RTP technology, Chromis recommends that administrators not allow public access to the Local Area Network if they can help it. In other words, standard security procedures such as firewalls, building access control to network equipment, WiFi passwords, etc. should be employed for your network. If VoIP calls are placed over public Internet they may optionally be made through a VPN connection to secure the conversation.

So we want to know, what are your concerns with Switchvox VoIP security? Drop us a line in the comments section or email us at the address in the header above. We love hearing from you and I’m sure you have your own opinions on what I’ve left out…