Voice networks are targets
An always-on voice network connected to hundreds of SIP phones is a prime target for toll fraud, unauthorized access, and abuse. Security can't be bolted on later. It has to be the foundation.
How It Works
- SIP digest authentication. Every phone must authenticate with FreeSWITCH using SIP digest auth before joining a room. Unauthorized User-Agents get silently rejected.
- JWT token auth. The web client uses JWT access tokens (15-minute expiry) with refresh tokens (7-day expiry). Tokens rotate automatically.
- Rate limiting & lockout. Login attempts are capped at 5 per 15 minutes per IP. After 5 failures, the account locks for 15 minutes.
- Encrypted transport. All web traffic runs over HTTPS/TLS. SIP signaling uses WSS (WebSocket Secure). Nothing goes over plaintext.
Key Benefits
- UA allowlist. Only Yealink phones and the Hotline HQ web client can register. Everything else gets rejected. Persistent offenders go on the blocklist.
- Role-based admin access. Three admin roles: Admin (full), Editor (users/rooms/notifications), Analytics (read-only). Principle of least privilege.
- Listener session isolation. Public listen-in sessions use ephemeral SIP credentials with 60-second auth TTL, single-use tokens, and a 20 concurrent session cap.
- Security headers. X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers on every response. Server fingerprint is suppressed.
Real-world: blocking a toll fraud attempt
An unknown SIP User-Agent tries to register with the FreeSWITCH server. The directory endpoint checks the UA string, finds it's not a Yealink or web client, and returns a 403. The admin sees the blocked attempt in the SIP logs and adds the UA to the blocklist. The attacker never reaches the conference.