Security management
A softswitch is a target because every call it lets through costs money. Attackers scan for open SIP ports, guess account passwords, and use stolen web logins to change routing or add credit. FlySIP protects the switch in layers: who can reach it, who can log in, which calls are accepted, and how much damage one compromised account can do. No single layer is enough; together they keep a breach small.
How it works
Section titled “How it works”- Network access. The IP Firewall in System Management allows or denies source addresses per service: web, SIP, SSH, the database and TFTP. An external firewall in front of the switch absorbs floods and port scans. See Set up the firewall.
- Web logins. Every staff member gets an own web user with an Access Level that limits what it can open and change. Password policies, multi-factor authentication and Allowed Hosts protect the logins themselves. See below.
- SIP authentication. Devices register with the account’s SIP credentials. Tick Separate VoIP Login and VoIP password on the account to give it SIP credentials that differ from its web login, so that one leaked password does not expose the other. Trunks are identified by authentication rules that combine the source IP with the CLI or CLD.
- Call limits. Max Sessions and Max Calls Per Second on the account, Capacity and Max CPS on the vendor connection, and the balance with its Credit Limit cap what one account can spend before you notice.
- Topology. With media relay the RTP goes through the switch, so customers and vendors see only the switch’s address, never each other’s.
- Audit. Tools & Debugs → Audit Logs records who logged in, from where, and what they changed. See Audit logs.
Web logins
Section titled “Web logins”| Protection | Where | What it does |
|---|---|---|
| Password policies | System Management → Password Policies | Min Length, Password Content (Letters and Digits, Letters, Digits or Any Characters), Expires, days, Block Idle In, days and Change on First Login. The built-in Default policy asks for 7 letters and digits, expires passwords after 90 days, blocks logins idle for 90 days and forces a change on first login. It cannot be edited; add your own policy and mark it Default to use it for new objects. Customers, accounts and vendors have a Password Policy field |
| Multi-factor authentication | MFA in the web interface system parameters, or Security Settings of an environment in Environments | E-Mail Token sends a one-time code by e-mail, Google Authenticator asks for the code from the app. A verified browser is trusted for 90 days. Reset a user’s MFA from Reset MFA Configuration in the user’s Web Access Control tab |
| Allowed Hosts | Web Access Control tab of a web user, or My Preferences | A comma-separated list of IP addresses the user may log in from. Any, the default, allows every address |
| HTTPS | System Management → SSL Management | A trusted certificate for the panel and the API, for example a free Let’s Encrypt certificate. See Install an SSL certificate |
Key terms
Section titled “Key terms”- Firewall rule — an allow/deny rule for source IPs managed from the panel and applied on the switch.
- Web user — an extra login to the panel with its own access level.
- Authentication Rule — a rule that identifies the account for an incoming call by source IP, CLI, called number or other SIP fields instead of a password.
- Capacity — the maximum number of concurrent calls of a connection or account.
- Media relay — the switch passes the RTP of a call through itself instead of letting the endpoints exchange it directly.
Common scenarios
Section titled “Common scenarios”Staff work from changing addresses
Section titled “Staff work from changing addresses”Allowed Hosts and firewall rules need fixed addresses. Run your own VPN server, let staff connect through it, and allow only the VPN’s address for Web, SSH and DB. Turn on MFA for the rest.
An account’s SIP password leaks
Section titled “An account’s SIP password leaks”The attacker can call only as fast and as much as the account allows. Keep Max Sessions and Max Calls Per Second close to what the customer really uses, and keep prepaid balances and credit limits small. Then change the SIP password and check the account’s CDRs.
A trunk is authenticated by CLI only
Section titled “A trunk is authenticated by CLI only”Anyone who sends that CLI from any address is billed to the trunk. Add the trunk’s IP address to the authentication rule. For DIDs from a vendor, accept them only from that vendor’s addresses.
Calling cards and vouchers
Section titled “Calling cards and vouchers”Brute force works against short codes. Use long PINs for calling card accounts and long voucher numbers.