Grandstream Networks UCM6100 Series Montageanleitung

Grandstream Networks, Inc.

UCM6100 Security Manual

UCM6100 Security Manual Page 1 of 23

Index

Table of Contents

OVERVIEW ................................................................................................3

WEB UI ACCESS.......................................................................................4

UCM6100 HTTP SERVER ACCESS.....................................................................................................4

PROTOCOL TYPE.................................................................................................................................4

USER LOGIN.........................................................................................................................................4

LOGIN TIMEOUT...................................................................................................................................5

TWO-LEVEL USER MANAGEMENT ....................................................................................................5

EXTENSION SECURITY............................................................................7

SIP/IAX PASSWORD.............................................................................................................................7

STRATEGY OF IP ACCESS CONTROL ...............................................................................................7

EXAMPLE: LOCAL SUBNET ONLY...............................................................................................7

SRTP....................................................................................................................................................10

TRUNK SECURITY..................................................................................11

OUTBOUND RULE PERMISSIONS....................................................................................................11

PRIVILEGE LEVEL....................................................................................................................... 11

SOURCE CALLER ID FILTER .....................................................................................................12

IVR DIAL TRUNK.................................................................................................................................12

ALLOW GUEST CALLS.......................................................................................................................13

TLS...........................................................................................................14

FIREWALL ...............................................................................................16

STATIC DEFENSE...............................................................................................................................16

STATIC DEFENSE EXAMPLE: BLOCKING TCP CONNECTION FROM A SPECIFIC HOST....17

STATIC DEFENSE EXAMPLE: BLOCKING SSH CONNECTION TO UCM6100........................18

DYNAMIC DEFENSE ..........................................................................................................................20

FAIL2BAN ............................................................................................................................................20

AMI...........................................................................................................23

UCM6100 Security Manual Page 2 of 23

Table of Figures

Figure 1: UCM6102 Web UI Login................................................................................................................4

Figure 2: Strategy –Local Subnet Only........................................................................................................8

Figure 3: Registration Failed From Subnet Not Allowed For Registration....................................................9

Figure 4: Registration Successful From Allowed Subnet..............................................................................9

Figure 5: Outbound Rule Permissions........................................................................................................11

Figure 6: Source Caller ID Filter .................................................................................................................12

Figure 7: IVR Dial Trunk..............................................................................................................................13

Figure 8: PBX->SIP Settings->TCP/TLS ....................................................................................................14

Figure 9: Firewall Rule Custom Configuration............................................................................................17

Figure 10: Static Defense Blocking Host 192.168.40.142 Using TCP Connection.....................................17

Figure 11: Host blocked by UCM6100 ........................................................................................................18

Figure 12: UCM6100 SSH Access..............................................................................................................18

Figure 13: Block SSH Connection ..............................................................................................................19

Figure 14: Putty Setup for SSH Connection ...............................................................................................19

Figure 15: SSH Connection Blocked by UCM6100 ....................................................................................20

Figure 16: Fail2Ban Default Configuration..................................................................................................21

Figure 17: Asterisk Service Fail2Ban setting ..............................................................................................22

This document is subject to change without notice. The latest electronic version of this document is

available for download here:

http://www.grandstream.com/support

Reproduction or transmittal of the entire or any part, in any form or by any means, electronic or print, for

any purpose without the express written permission of Grandstream Networks, Inc. is not permitted.

UCM6100 Security Manual Page 3 of 23

OVERVIEW

This document presents a summary of security concerns on UCM6100. It covers the security risks and

related configurations that users need to consider when deploying the UCM6100.

The following sections are covered in this document:

Web UI access

Web UI is secured by user login and login timeout mechanism. Two-level user management is

configurable. Admin with limited access can be created by the default super administrator.

Extension security

This includes SIP/IAX password for authentication, IP access control and SRTP.

Trunk security

Trunk security is achieved mainly by setting the privilege level, configuring source caller ID filter to filter

out outbound call requests from unwanted source

TLS

This is to secure the SIP signaling.

Firewall mechanism

Three types of firewall mechanism can be configured to protect UCM6100 against malicious attacks:

Static Defense, Dynamic Defense (UCM6510 and UCM6102 only) and Fail2ban.

AMI

Using AMI feature comes with security concerns for UCM6100 administrators to consider.

UCM6100 Security Manual Page 4 of 23

WEB UI ACCESS

UCM6100 HTTP SERVER ACCESS

The UCM6100 embedded web server responds to HTTP/HTTPS GET/POST requests. Embedded HTML

pages allow users to configure the device through a web browser such as Microsoft IE, Mozilla Firefox,

Google Chrome and etc. This is the most important tool to configure all the settings on the UCM6100. It’s

also the immediate interface for the administrator to access configurations, user status and all the system

information. Therefore, it’s crucial to understand that directly placing the UCM6100 on public network could

expose the domain name / IP address of the UCM6100 and pose serious security concerns.

PROTOCOL TYPE

HTTP and HTTPS (default) are supported to access the UCM6100 web UI. It can be configured under web

UI->Settings->HTTP Server. The protocol type is also the protocol used for zero config when the endpoint

device downloads the config file from the UCM6100. Therefore, it’s recommended to use HTTPS instead

of HTTP to secure the transactions and prevent unauthorized access.

USER LOGIN

UCM6100 web UI access is restricted by user login. Username and password are required when logging in

to web UI.

Figure 1: UCM6102 Web UI Login

The factory default value of “Username” and “Password” is “admin” and “admin”. It is highly recommended

UCM6100 Security Manual Page 5 of 23

to change the default password after login for the first time.

To change the password for the default user “admin”, go to web GUI->Settings->Change Password page.

The new password has to be at least 4 characters. The maximum length of the password is 30 characters.

The minimum requirement for the login password is as below if “Enable Strong Password” (on web GUI->

PBX->Internal Options->General) is turned on:

Must contain numeric digit;

Must contain at least one lowercase alphabet, uppercase alphabet or special character.

Strong password with a combination of numbers, lowercase alphabet characters, uppercase characters

and special characters is always recommended to protect your login.

An authenticated user of the UCM6100 web UI may log in the system and then leave the active session on

a terminal unattended without intentionally logging-off from the system. An adversary with access to the

terminal could then have access to the UCM6100, meaning all the configuration and status information

could be exposed and changed intentionally or unintentionally.

UCM6100 provides protection from such vulnerability using login timeout. After the user logs in the

UCM6100 web UI, the user will be automatically logged out after certain timeout. This timeout value can be

specified under UCM100 web GUI->Settings->Login Timeout Settings page. In the case that the user

doesn’t make any operation on web GUI within the timeout period, the user will be logged out automatically

and the web UI will be redirected to the login page, requiring password to access the web pages.

If the login timeout period is set to a short enough time, the chances of an adversary gaining access to an

unattended terminal are significantly reduced. However, the timeout period cannot be too short that an

authenticated user becomes annoyed by frequent automatic logouts during normal use. Therefore, users

shall set it to a value according to actual usage and situation. The default value of login timeout is 10

minutes.

TWO-LEVEL USER MANAGEMENT

On UCM6100, two privilege levels for web UI users are supported:

Super Admin: high priority

Admin: low priority

Super administrator can access all pages on UCM6100 web UI, change configuration for all options and

UCM6100 Security Manual Page 6 of 23

execute all the operations, while normal administrator created by super administrator has limited access.

Normal administrator can access all pages on UCM6100 web UI except the following:

Maintenance->Upgrade

Maintenance->Backup

Maintenance->Cleaner

Maintenance->Reset/Reboot

Settings->User Management->Operation Log

A “Super Admin” user with username “admin” is innately configured in the UCM6100 at the factory setting.

It is the only allowed “Super Admin” account and cannot be deleted and changed. This super administrator

could create, edit and delete new user accounts with lower privilege “Admin”.

Super Admin also has the authority to view operations done by all the users in web GUI->Settings->User

Management->Operation Log where normal users with lower privilege level “Admin” don’t have access.

If there are more than one PBX administrator required to manage the UCM6100 in your enterprise, it’s

highly recommended for the super administrator to create lower privilege administrators in order to

manage the UCM6100 together, instead of handing out super administrator password to all the other users

who may need access the UCM6100 web UI. The super administrator can also monitor the operation log

to keep a record as well as ensure no abnormal operations done on the PBX.

UCM6100 Security Manual Page 7 of 23

EXTENSION SECURITY

SIP/IAX PASSWORD

When creating a new SIP/IAX extension, the UCM6100 administrator is required to configure “SIP/IAX

Password” which will be used for account registration authentication.

If “Enable Random Password” (on web GUI->PBX->Internal Options->General) is enabled, “SIP/IAX

Password” is automatically filled with a randomly generated secure password when creating the extension

on the UCM6100.

If “Enable Strong Password” (on web GUI-> PBX->Internal Options->General) is enabled, the password

must be alphanumeric which should contain numeric digit and at least one lower case alphabet or upper

case alphabet, or special character.

It is recommended to use random password and strong password to reduce the chance that the password

being guessed or cracked out.

STRATEGY OF IP ACCESS CONTROL

The UCM6100 administrator could control what IP address(s) is allowed to register to a certain extension

by editing “strategy” option under extension configuration dialog->“Media” tag. Make sure to configure the

“strategy” option to the smallest set to block registration attempts from anyone that doesn’t need to register

to the account.

The strategy options are:

“Local Subnet Only”: allows register requests from local IPs only. By default the local subnet where the

UCM6100 is location is allowed. User could also add more local subnets where devices are allowed to

“A Specific IP Address”: allows register requests from one user specified IP only.

“Allow All”: the registration address is the entire Internet which is least recommended.

EXAMPLE: LOCAL SUBNET ONLY

1. Assuming there are multiple subnets within the office and the devices in all subnets can reach each

UCM6100 Security Manual Page 8 of 23

other. The network administrator would like to allow only devices in 192.168.40.x network to register to

this UCM6100.

2. Under UCM6100 web UI extension dialog, configure “Local Subnet Only” for “Strategy” option and

192.168.40.0 for “Local Subnet”.

Figure 2: Strategy –Local Subnet Only

3. Save and Apply changes.

Now if the SIP end device is in subnet other than 192.168.40.x, e.g., 172.18.31.x subnet, the UCM6100

will not allow registration using this extension. The following figure shows the SIP device IP address is

172.18.31.17. The UCM6100 on IP 192.168.40.171 replies 404 Not Found for the registration request.

UCM6100 Security Manual Page 9 of 23

Figure 3: Registration Failed From Subnet Not Allowed For Registration

Once moving this device to 192.168.40.x subnet, registration will be successful. The following figure shows

the IP address for the same SIP end device is 192.168.40.190. The UCM6100 on IP address

192.168.40.171 replies 200 OK for the registration request.

Figure 4: Registration Successful From Allowed Subnet

Andere Handbücher für UCM6100 Series

Inhaltsverzeichnis

Andere Grandstream Networks Netzwerk-Hardware Handbücher

Grandstream Networks

Grandstream Networks GVR3550 Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6510 Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6510 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GHP6 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6116 Bedienungsanleitung

Grandstream Networks

Grandstream Networks HT8 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks GRP261 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6100 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks GVR3550 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GXV3500 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GVR3550 Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM630 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks GWN70 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks GVR3552 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GRP262 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM P2000 Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6100 Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM630 A Series Bedienungsanleitung

Grandstream Networks

Grandstream Networks UCM6 series Bedienungsanleitung

Grandstream Networks

Grandstream Networks GVR3550 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GSC3570 Bedienungsanleitung

Grandstream Networks

Grandstream Networks GXV3504 Bedienungsanleitung

Beliebte Netzwerk-Hardware Handbücher anderer Marken

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Bedienungsanleitung

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Bedienungsanleitung

Yudor

Yudor YDS-16 Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-320L Bedienungsanleitung

Samsung

Samsung ES1642dc Gebrauchsanweisung

Honeywell Home

Honeywell Home LTEM-PV Montageanleitung

evertz

evertz 7700 Series Bedienungsanleitung

D-Link

D-Link ShareCenter DNS-343 Bedienungsanleitung

Asante

Asante AsanteBridge 1012 Bedienungsanleitung

FireBrick

FireBrick FB2700 Bedienungsanleitung

Audiovox Electronics

Audiovox Electronics ARWH2T Bedienungsanleitung

ADC

ADC DSX-1 Handbuch

NetComm

NetComm NF2 Bedienungsanleitung

Alcatel-Lucent

Alcatel-Lucent 5620 Bedienungsanleitung

Dell EMC

Dell EMC XC6420 Series Bedienungsanleitung

Lanner

Lanner NCA-1020A Bedienungsanleitung

Allied Telesis

Allied Telesis AT-TN121-A Bedienungsanleitung

Arista

Arista CCA-ETM-Q12 Bedienungsanleitung