AiPBX turns standard Linux servers into high-concurrency telecommunications appliances. Real-time telephony traffic demands specialized security considerations: SIP signaling and RTP audio streams must maintain predictable low latency while defending against global automated scanner traffic, credential brute-force attacks, toll fraud, eavesdropping, and data leakage.
This document details AiPBX’s defense-in-depth threat model, trust boundaries, credential handling, data retention lifecycle, and AI permissions guardrails.
AiPBX separates untrusted public networks from internal telephony cores via strict architectural layers:
[ UNTRUSTED INTERNET / CARRIERS / CLIENTS ]
│
├─► [ Port 443 Ingress (Nginx TCP Stream with ALPN) ] ──(Loopback / TLS)──► Apache 2.4 / Web Portal & WebRTC WSS
├─► [ Public SIP 5060/5061 (Restricted via Rich Rules) ] ───────────────► Asterisk 22 Core (PJSIP)
├─► [ Media RTP 10000-20000 / UDPTL 4100-4999 (SRTP / DTLS) ] ─────────► Asterisk Media Engine
└─► [ TURN / STUN Relay 5349 ] ─────────────────────────────────────────► coturn (Ephemeral Tokens)
│
[ RESTRICTED LOCALHOST / OS BOUNDARY ] │
├─► Asterisk AMI (127.0.0.1:5038, strong password, root/asterisk only) │
├─► Asterisk WSS (127.0.0.1:8088/ws, isolated from public binding) │
├─► MariaDB Database (127.0.0.1:3306, strict permissions) ◄────────────────────┘
├─► Go Instant Messaging Core (127.0.0.1:8086/ws)
└─► Local AI Inference Engine (Whisper STT / Piper TTS / Ollama on loopback)
| Threat Vector | Potential Impact | AiPBX Mitigation |
|---|---|---|
Global SIP Scanners (sipvicious, friendly-scanner) |
High CPU load, port exhaustion, log pollution | • fail2ban asterisk jail: Monitors Asterisk security logs; bans attacking IPs after repeated failed authentications.• Carrier Rich Rules ( firewall-cmd): By default or via one-click configuration, administrators can bind SIP ports (5060/5061) strictly to trusted carrier IP subnets and internal LANs. Web softphones and mobile clients connect over port 443 (TLS/WSS) and never need raw 5060 exposed. |
| SIP Registration Brute-Force | Account takeover, unauthorized outbound calls | • High-entropy autogenerated SIP passwords (32-character hexadecimal). • Dynamic rate limiting in PJSIP. • Automated Health check alarms alerting via email/portal bell when failed registrations spike. |
| Toll Fraud (Unauthorized International / Premium Routing) | Financial loss via exploited trunks | • Three built-in toll fraud brakes (Security): Max concurrent external channels, strict destination prefix restrictions, and outbound velocity alarms. • Role-based permission controls restricting trunk modifications. |
| Asset / Boundary | Architecture | Security Guarantee |
|---|---|---|
Signaling (/ws) |
Nginx & Apache reverse-proxy to Asterisk 127.0.0.1:8088/ws. Raw Asterisk WSS port 8089 is never bound to public interfaces. |
TLS 1.3 / 1.2 mandatory. Plaintext WebSocket connections are rejected at the edge. |
| Media Streams (RTP) | WebRTC browser softphones and mobile clients negotiate media encryption via DTLS-SRTP. | Voice and video payloads are cryptographically encrypted in transit end-to-end; eavesdropping on UDP packets yields only encrypted ciphertext. |
| NAT Traversal (STUN/TURN) | Integrated coturn server. |
Ephemeral credentials (HMAC-SHA1): Softphones obtain short-lived TURN credentials generated by the PBX on demand with dynamic expiration. Static long-term TURN credentials are never hardcoded in client bundles. |
Telecommunications metadata and call recordings are strictly governed under the built-in Privacy & GDPR Engine:
1) / Opt-Out (9), and periodic FCC-compliant beeps (MixMonitor ,B(15)) for two-party consent jurisdictions.privacy_purge.php):
Nightly cron jobs at 03:45 enforce retention limits configured by administrators (e.g., 90 days for GDPR, 180 days for KVKK):
/var/spool/asterisk/monitor/) and voicemail audio.src = 'REDACTED', dst = 'REDACTED', clid = 'REDACTED'), preserving aggregate analytics without retaining personal phone numbers.AiPBX mobile softphones (Android and iOS) utilize push notifications for background battery efficiency:
Integrating AI assistants into communications systems requires strict boundaries to prevent data leakage and privilege escalation (following the principle of Least Privilege / AI-OS workflow isolation):
/privacy hard-disables all external Cloud AI providers. Any attempt by dialplan or background workers to query third-party APIs is blocked at the code level.PrivacyService::redactTranscriptPii() inspects the text and automatically redacts:
[REDACTED-CARD][REDACTED-CVV][REDACTED-ID]www-data. It cannot modify system services, firewall rules, or Asterisk configuration files directly.aipbx-priv):
Privileged operations (such as reloading Asterisk, restarting services, generating Let’s Encrypt certificates, or triggering backups) are mediated via /usr/local/sbin/aipbx-priv, a strictly audited wrapper with sudoers whitelisting and rigid parameter validation./var/lib/aipbx/settings.key, which is readable only by the root user and the application process.For production environments, follow these four hardening recommendations:
/etc/ssh/sshd_config (PasswordAuthentication no) and use Ed25519 SSH keys.aipbx-backup is running daily and configure AIPBX_BACKUP_COPY_TO in /etc/ai-pbx.env for automated off-site replication.