🔐 From Default Install to Production-Grade: Hardening a Telecom PBX Monitoring Stack (Asterisk + Prometheus)

 

🚀 How We Secured ARI, AMI, Prometheus & Exporters in a Live PBX Environment

Modern telecom SaaS platforms are not just about call routing and dialplans. They are distributed systems handling:

• SIP signaling
• RTP media
• ARI call control
• AMI management
• Redis state
• Prometheus monitoring
• Node-level infrastructure metrics

By default, many of these services expose ports on 0.0.0.0.

That means:

Anyone on the LAN (or worse — public network) can access your control and monitoring plane.

That is unacceptable in a production PBX environment.

So we hardened the entire monitoring + control stack.

---

🎯 The Initial Exposure (Default State)

Running:

ss -lntp | egrep '9090|9100|8088|5038|6379'

Revealed:

• 🔴 Prometheus (9090) – exposed
• 🔴 Node Exporter (9100) – exposed
• 🔴 ARI (8088) – exposed
• 🔴 AMI (5038) – exposed
• 🟢 Redis (6379) – already localhost-only

This means:

• Anyone could access /classic/alerts
• Anyone could scrape system metrics
• Anyone could attempt ARI/AMI brute-force
• Anyone could query internal topology

For a telecom SaaS platform — this is a serious risk.

---

🔐 What We Secured

1️⃣ Prometheus (9090)

Changed systemd configuration:

--web.listen-address=127.0.0.1:9090

Result:

• No LAN access
• Only backend service can query metrics
• Monitoring plane fully internalized

---

2️⃣ Node Exporter (9100)

Modified service:

--web.listen-address=127.0.0.1:9100

Now:

• CPU, memory, disk metrics no longer publicly accessible
• Prometheus scrapes locally only

---

3️⃣ ARI (8088) – Asterisk REST Interface

Updated /etc/asterisk/http.conf:

bindaddr=127.0.0.1

Now:

• No external call-control API exposure
• Only internal NestJS services can access ARI

This prevents:

• Remote call injection attempts
• ARI brute-force attacks
• Stasis app manipulation

---

4️⃣ AMI (5038) – Asterisk Manager Interface

Updated /etc/asterisk/manager.conf:

bindaddr=127.0.0.1

AMI exposure is one of the biggest PBX attack vectors.

If compromised, an attacker can:

• Originate calls
• Spy on channels
• Modify dialplan behavior
• Execute administrative commands

Binding it to localhost eliminates this risk.

---

🧠 The Final Secure Architecture

Frontend (443)
        ↓
NestJS API
        ↓
Prometheus (localhost)
        ↓
Node Exporter (localhost)
        ↓
ARI / AMI (localhost)

Only public-facing services remain:

• 80 / 443 (Frontend)
• SIP signaling (if required)
• RTP ports (media)

Everything else is internal-only.

---

📊 Why This Matters for Telecom SaaS

Telecom infrastructure is frequently scanned and attacked.

Exposed monitoring + control ports allow attackers to:

• Map your topology
• Identify infrastructure weaknesses
• Attempt credential brute-force
• Trigger expensive PromQL queries
• Potentially manipulate call flows

Production-grade telecom systems must isolate:

• Monitoring plane
• Control plane
• Data plane

---

🏁 Security Score: Before vs After

ComponentBeforeAfterPrometheusExposedLocalhostNode ExporterExposedLocalhostARIExposedLocalhostAMIExposedLocalhostRedisSecureSecure

Result:

✅ Monitoring secured ✅ Control plane secured ✅ Attack surface reduced ✅ Telecom SaaS hardened

---

🛡 Key Takeaway

If you are running:

• Asterisk
• ARI
• AMI
• Prometheus
• Exporters
• Redis

And you haven’t checked:

ss -lntp

You should.

Default installs are rarely production-hardened.

Security in telecom isn’t optional — it’s architectural.

---

💬 If You're Building Telecom SaaS

Secure your:

• Monitoring stack
• Control interfaces
• Exporter ports
• Internal APIs

Before scaling.

Infrastructure maturity is what separates hobby PBX installs from real SaaS platforms.