Port 5060: SIP — Complete Guide

Port 5060 is reserved for SIP. Session Initiation Protocol (VoIP, IP telephony). Frequent target of SIP flood attacks.

Check port 5060 →

Close the port if the service isn't used. For admin ports, require IP whitelist or VPN. Monitor connection attempts via fail2ban.

The Session Initiation Protocol (SIP) is a signaling protocol used for initiating, maintaining, and terminating real-time sessions that involve video, voice, and messaging applications. Operating primarily over port 5060, SIP allows for the establishment of VoIP (Voice over Internet Protocol) communications, enabling users to make calls over the internet instead of traditional phone lines.

SIP works by sending messages between endpoints, which can be anything from IP phones to softphones and other communication devices. These messages include requests such as INVITE, ACK, BYE, and CANCEL, which help in managing the call lifecycle.

Because SIP is widely used in VoIP services, it has become a frequent target for various types of cyber attacks. Understanding how SIP functions is essential for implementing effective security measures, especially since its open nature can be exploited if not properly secured.

Securing SIP communications is critical to prevent unauthorized access and attacks such as SIP flooding, registration hijacking, and eavesdropping. Here are some best practices to enhance the security of SIP services:

• Use SIP over TLS: Transport Layer Security (TLS) encrypts the signaling messages sent over SIP, making it difficult for attackers to intercept or alter them. Configure your SIP server to use sip:yourdomain.com;transport=tls.
• Implement Authentication: Require strong authentication mechanisms for users and devices connecting to your SIP service. Use digest authentication instead of basic authentication to enhance security.
• Restrict SIP Traffic: Use firewalls to limit SIP traffic to only necessary IP addresses and networks. This minimizes the attack surface and helps prevent unauthorized access.
• Rate Limiting: Implement rate limiting on SIP requests to prevent SIP flooding attacks. Configure your SIP server to accept a limited number of requests from a single IP address within a specified time frame.
• Regular Updates: Keep your SIP software and hardware updated with the latest security patches to mitigate vulnerabilities that can be exploited by attackers.

By following these best practices, organizations can significantly enhance the security of their SIP communications and protect against common threats.

Configuring SIP on various platforms can vary, but here are some practical examples to help you get started. Below are examples for both Asterisk and FreeSWITCH, two popular open-source SIP servers.

Asterisk Configuration:

In your sip.conf file, you can define a basic SIP user as follows:

[1001]
    type=friend
    secret=yourpassword
    host=dynamic
    context=default
    nat=yes

This configuration allows user 1001 to register dynamically. Ensure that the nat option is set to yes if you are behind a NAT.

FreeSWITCH Configuration:

For FreeSWITCH, you can create a user in the directory XML configuration:

<user id="1001">
    <params>
        <param name="password" value="yourpassword"/>
    </params>
    <variables>
        <variable name="toll_allow" value="domestic,international,local"/>
        <variable name="sip-interop" value="false"/>
    </variables>
</user>

In this example, user 1001 is configured with a password and some additional variables for call management. Make sure to restart the service after making changes to apply the configuration.

These examples provide a foundational understanding of how to configure SIP users on popular servers, allowing you to tailor your setup to your specific needs.