Skip to main content

Security of the telephony

Network exposure​

Only Kamailio is public: SIP 5060 and 5061 (TLS), WSS 7443 for the softphones. Asterisk accepts SIP only from the Kamailio and LiveKit SIP hosts (sip_networks, PJSIP ACL); AMI, ARI, the JSONRPC of Kamailio, the ng protocol of RTPengine and the metrics ports listen on the administration address and the Manager firewall opens them only to the declared networks (admin_networks). The media ranges (RTP) are the only other openings.

TLS and certificates​

The Manager issues the certificates from its authority. Kamailio serves SIP over TLS, WSS and HTTPS on the JSONRPC and the metrics (tls_enabled, on by default); a public certificate can be provided for the carriers and the browsers (tls_public_cert_file). Asterisk serves, when tls_enabled is on, SIP over TLS, ARI over HTTPS and AMI over TLS. The media of the softphone are DTLS-SRTP.

Secrets​

SIP passwords of the extensions, trunk secrets, voicemail and conference codes, AMI and ARI credentials, the JSONRPC secret and the shared WebRTC secret are in the existing vault. The API never returns them (write only fields, has_secret); a PBX pool only holds openbao:// or env:// references. The service passwords left empty at installation are generated and sealed by the Manager.

WebRTC softphone​

The browser never receives the SIP password of the extension. Navin Enterprise issues ephemeral credentials (auth_ephemeral module of Kamailio, HMAC SHA-256 with the shared secret); Kamailio refuses an expiry beyond ephemeral_max_ttl_s (3600 seconds by default). The WebRTC endpoints of Asterisk accept only the addresses of Kamailio.

SIP protections and fraud​

  • Anti-bruteforce. An external address is banned (ipban) after ban_failures refused authentications (10 by default) for ban_time_s (900 seconds).
  • Anti-flood. pike bans an address beyond pike_density requests per 2 second slot (30 by default); the carriers and the internal nodes are exempt.
  • Scanners. The user agents listed in scanner_user_agents are refused.
  • Quotas. Concurrent calls, calls per second, allowed country prefixes, blocked premium prefixes and maximum duration per tenant; call rights per extension (internal, national, international, premium).
  • Immediate block. An administrator blocks a tenant or an extension on every Kamailio of the pool (see Operations).

Tenant isolation​

Every tenant has a short identifier tid (t followed by the first 12 hexadecimal characters of its UUID) that prefixes its endpoints, contexts, queues and LiveKit objects; accountcode carries the UUID of the tenant and every channel the variable NAVIN_TENANT. The compiler refuses any context that references an object of another tenant. The tables of Navin Enterprise all have a tenant_id and go through the existing isolation of the Control Plane. In the dedicated model, the tenant has its own Asterisk pool and dispatcher set.

Recordings​

Recordings, voicemail messages and IVR prompts are encrypted by Navin Enterprise before they are stored in SeaweedFS, under opaque keys tenants/{uuid}/{category}/{yyyy}/{mm}/{uuid}. Only Navin Enterprise reads them: signed URLs of 300 seconds, rights check, audit; the S3 credentials never leave the server. LiveKit Egress writes into a separate bucket with credentials limited to that bucket.