| Item | Action | |------|--------| | | Use strong, unique secret values for each SIP endpoint. | | Restrict IP ranges | In sip.conf , add permit=192.168.0.0/24 (or your LAN) and deny=0.0.0.0/0 . | | Enable TLS & SRTP (if possible) | Add transport=tls and generate a self‑signed certificate; configure tlsclientmethod=tlsv1_2 . | | Run as non‑root | The default install already runs under the asterisk user. | | Firewall | Open only 5060/5061 (SIP) and the RTP range (default 10000‑20000) on the LAN. | | Fail2Ban | Install and configure a jail for asterisk to block repeated authentication failures. | | Regular updates | Even though 7.x is in “old‑stable”, apply any security patches released by Sangoma. |