Asterisk 22.11.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Asterisk 22.11.0 on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and the security group described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

SG=$(aws ec2 create-security-group --group-name asterisk-pbx --description "Asterisk PBX" \
  --vpc-id <your-vpc> --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --ip-permissions \
  'IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges=[{CidrIp=<your-admin-cidr>}]' \
  'IpProtocol=udp,FromPort=5060,ToPort=5060,IpRanges=[{CidrIp=<your-phones-cidr>}]' \
  'IpProtocol=tcp,FromPort=5060,ToPort=5060,IpRanges=[{CidrIp=<your-phones-cidr>}]' \
  'IpProtocol=udp,FromPort=10000,ToPort=10100,IpRanges=[{CidrIp=<your-phones-cidr>}]'
aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids "$SG" --subnet-id <your-subnet> --associate-public-ip-address \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=asterisk}]'

Connect over SSH as the ubuntu user, the default user for Asterisk 22.11.0 on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the secret and the demo endpoint, then starts Asterisk. This takes a few seconds after the instance becomes reachable. Confirm that both services are active:

systemctl is-active asterisk-firstboot asterisk
sudo test -f /var/lib/sac/data/asterisk-firstboot.done && echo FIRSTBOOT_DONE

active active FIRSTBOOT_DONE

Check the version and confirm that the process runs as the unprivileged asterisk user:

sudo asterisk -rx "core show version" ps -o user=,comm= -C asterisk

Asterisk 22.11.0 built by root @ sac-build on a x86_64 running Linux on 2026-10-20 18:24:21 UTC asterisk asterisk

If asterisk still shows activating in the first seconds, follow first boot with sudo journalctl -u asterisk-firstboot -f.

The credentials file is readable by root only. Print it with the secret masked, which makes the output safe to paste into a support request:

sudo sed -E 's/^(sip\.demo\.secret=).*/\1********/' /root/asterisk-credentials.txt | grep -E '^(sip|asterisk)\.'

sip.host=<SIP_HOST> sip.transport.udp=<SIP_HOST>:5060 sip.transport.tcp=<SIP_HOST>:5060 sip.rtp.range=10000-10100/udp sip.demo.username=demo sip.demo.secret=******** asterisk.version=22.11.0 asterisk.datadir=/var/lib/asterisk

To configure a softphone you need the secret itself. Print just that value:

sudo grep '^sip.demo.secret=' /root/asterisk-credentials.txt | cut -d= -f2-

sip.host is the instance's public IPv4 address at first boot, or its private address if it has no public one. The secret is also stored in /etc/asterisk/pjsip.d/20-demo.conf, readable only by root and the asterisk group.

Run asterisk-selftest to prove the security defaults end to end from the instance itself. It reads the secret from the credentials file and hands it to the bundled SIP client through a root-only file, never on a command line:

sudo asterisk-selftest

round-trip OK: REGISTER demo@127.0.0.1:5060/udp -> 200 OK; REGISTER demo@127.0.0.1:5060/tcp -> 200 OK; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; INVITE 600@127.0.0.1:5060/udp -> 401 Unauthorized; dialplan local-only, AMI/HTTP/ARI disabled

The output reads in order. The correct secret registers over UDP and over TCP. A wrong secret, an empty password and an unauthenticated REGISTER are all refused. An anonymous INVITE to the echo test is also refused.

Confirm that the management interfaces are off:

sudo asterisk -rx "manager show settings" | grep 'Manager (AMI)'
sudo asterisk -rx "http show status" | grep -E 'Server (Enabled|Disabled)'
sudo asterisk -rx "ari show status" | grep '^Enabled'

Manager (AMI): No Server Disabled Enabled: No

Confirm that the dialplan holds only the local test extensions:

sudo grep -E '^\[demo-internal\]|^exten =>' /etc/asterisk/extensions.conf

[demo-internal] exten => 600,1,Answer() exten => *43,1,Answer() exten => 601,1,Answer()

List the network listeners. SSH and SIP are the only services. The two extra UDP sockets on random high ports belong to Asterisk's DNS resolver, which uses them as client sockets to look up SIP servers. They are not reachable through the security group:

sudo ss -Hlntup | awk '$5 !~ /^(127\.|\[::1\])/ {print $1, $5}' | sort -u

tcp 0.0.0.0:22 tcp 0.0.0.0:5060 tcp [::]:22 udp 0.0.0.0:36247 udp 0.0.0.0:5060 udp 172.31.82.27%ens5:68 udp [::]:53508

Confirm that instance metadata is denied to Asterisk and to first boot. Only the metadata reader may reach it:

systemctl show -p IPAddressDeny asterisk.service asterisk-firstboot.service
systemctl show -p IPAddressDeny -p IPAddressAllow asterisk-metadata.service

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressAllow=::1/128 127.0.0.0/8 169.254.169.254/32 IPAddressDeny=0.0.0.0/0 ::/0

Fail closed in practice. asterisk.service runs /usr/local/sbin/asterisk-prestart before every start. It refuses to start Asterisk while the demo include still holds the image's stub contents. It also refuses to start if any type=auth section in pjsip.conf or pjsip.d/*.conf has an empty or missing password, or uses auth_type=md5 with no md5_cred.

Run the same check yourself after editing the configuration:

sudo /usr/local/sbin/asterisk-prestart --check-only

asterisk-prestart: PJSIP auth check passed

List the SIP transports and endpoints:

sudo asterisk -rx "pjsip show transports"
sudo asterisk -rx "pjsip show endpoints"

Transport: transport-tcp tcp 0 0 0.0.0.0:5060 Transport: transport-udp udp 0 0 0.0.0.0:5060 Objects found: 2 Endpoint: demo Unavailable 0 of inf InAuth: demo-auth/demo Aor: demo 1 Objects found: 1

The demo endpoint shows Unavailable until a phone registers.

In any SIP softphone (for example Linphone, Zoiper or MicroSIP), create an account with these settings:

• SIP server / domain: the instance's public IP (sip.host)
• Port and transport: 5060, UDP or TCP
• Username and auth username: demo
• Password: the sip.demo.secret value from Step 4

When the account shows as registered, dial 600 for the announced echo test or *43 for the bare echo test. You hear your own voice back, which proves registration, call setup and two-way RTP audio through the security group. Dial 601 to hear a short greeting.

Run sudo asterisk -rx "pjsip show aor demo" to list the registered phone.

You can also register from the instance with the bundled client. It reads the password from a file or from standard input, so the secret never appears on a command line or in your shell history:

sudo sed -n 's/^sip\.demo\.secret=//p' /root/asterisk-credentials.txt \
  | sac-sip-check register --user demo --password-stdin

Phones outside the VPC reach the instance through its public address, so Asterisk must advertise that address in SIP and SDP. The metadata reader records the instance's addresses at every boot. asterisk-prestart writes them into the transport include on every start:

sudo cat /etc/asterisk/pjsip.d/10-transport-extip.conf

; sac: written by asterisk-prestart at 2026-10-20T01:57:57Z from instance metadata. ; Edit /etc/sac/asterisk-external-address to pin a different address (e.g. an Elastic IP). external_media_address=<SIP_HOST> external_signaling_address=<SIP_HOST> local_net=127.0.0.0/8 local_net=172.31.0.0/16

The local_net lines are loopback and your VPC's CIDR blocks, so phones inside the VPC get the private address.

To advertise a different address, for example an Elastic IP or a load balancer, write it to /etc/sac/asterisk-external-address and restart Asterisk:

echo "<elastic-ip>" | sudo tee /etc/sac/asterisk-external-address
sudo systemctl restart asterisk

Add each phone as its own endpoint in a new file under /etc/asterisk/pjsip.d/. Include that file from the end of /etc/asterisk/pjsip.conf, then reload.

Use a long random password for every phone. asterisk-prestart refuses to start Asterisk if any password is empty.

sudo tee /etc/asterisk/pjsip.d/30-alice.conf >/dev/null <<'EOF' [alice-auth] type=auth auth_type=userpass username=alice password=<a-long-random-password> [alice] type=aor max_contacts=1 [alice] type=endpoint context=demo-internal disallow=all allow=ulaw,alaw auth=alice-auth aors=alice direct_media=no rtp_symmetric=yes force_rport=yes rewrite_contact=yes EOF
sudo chown root:asterisk /etc/asterisk/pjsip.d/30-alice.conf && sudo chmod 0640 /etc/asterisk/pjsip.d/30-alice.conf echo '#include "pjsip.d/30-alice.conf"' | sudo tee -a /etc/asterisk/pjsip.conf
sudo /usr/local/sbin/asterisk-prestart --check-only && sudo asterisk -rx "pjsip reload"

When you add a SIP trunk for outside calls:

• Put outbound dialing in its own context that only your authenticated endpoints use, never in a context an unidentified caller can reach.
• Allow only the number patterns you need (for example your country's national numbers), never a catch-all such as _X.. Block premium-rate and international prefixes you do not use.
• Set call limits with your provider, and watch the security log (/var/lib/asterisk/log/messages) for failed registrations.

Remove the demo endpoint once your own phones work. Delete its lines from /etc/asterisk/pjsip.d/20-demo.conf, keep the file, and reload.

Voicemail, recordings, call detail records (/var/lib/asterisk/log/cdr-custom/Master.csv), the Asterisk database, logs and sound files live on the dedicated EBS volume. Confirm the mount:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/asterisk
sudo ls /var/lib/asterisk/spool

/dev/nvme1n1 /var/lib/asterisk ext4 monitor voicemail

The volume is mounted by filesystem UUID. You can resize it, snapshot it or move it to a new instance independently of the root volume.