SecureAnyCloud
Deployment guide

Asterisk

Overview

Asterisk is the world's most widely deployed open source communications engine: a SIP PBX, VoIP gateway, IVR, conferencing and voicemail toolkit. It runs as a headless daemon that you control through the Asterisk command line and the text configuration files in /etc/asterisk. This guide covers deploying and configuring the SecureAnyCloud Asterisk image on Ubuntu 24.04 on Azure.

The image is built from the pinned official Asterisk 22.10.1 LTS source release, downloaded from downloads.asterisk.org and verified against its SHA256 checksum. It includes the bundled pjproject stack that powers the modern chan_pjsip channel driver. Asterisk 22 is the current Long Term Support branch, security supported into 2029. The service runs under systemd as the unprivileged asterisk user.

Secure by design: no default SIP credential. An Asterisk install that ships with its sample configuration files carries well-known default SIP passwords and an open dialplan context. That combination attracts toll fraud, where attackers register and place premium-rate calls at the owner's expense. This image ships no sample configuration and uses a minimal hardened setup instead.

The one example endpoint, demo, has a SIP password set to a per-instance secret generated on the first boot of every VM (openssl rand -base64 24). The secret is written to /root/asterisk-credentials.txt (mode 0600, root only). The captured image holds only a temporary value, and the SIP stack never runs with it, because the service stays disabled until first boot replaces it with the per-instance secret.

Secure by design: no anonymous SIP and no toll fraud route. The legacy chan_sip driver, the historic source of the allowguest open registrar, was removed in Asterisk 21 and later, so it is not present here. The modern PJSIP stack rejects unidentified requests: there is no anonymous endpoint, and an unauthenticated REGISTER or INVITE is refused.

The shipped dialplan contains only local test extensions (an echo test), with no Dial application, no trunk and no PSTN route. Even a compromised endpoint cannot dial out and run up a bill until you deliberately add a trunk and an outbound context yourself.

What you get:

  • Asterisk 22.10.1 LTS, built from the pinned official source release (SHA256 verified) and run under systemd as the unprivileged asterisk user (asterisk.service)
  • A minimal hardened /etc/asterisk: no sample files, one example demo PJSIP endpoint, a UDP and TCP transport on port 5060, and a dialplan with local test extensions only
  • A per-instance SIP secret for the demo endpoint, generated on first boot and documented in /root/asterisk-credentials.txt (0600), so no image ever ships a usable or default credential
  • No anonymous SIP and no PSTN or Dial catch-all in the shipped dialplan, so there is no toll fraud exposure out of the box
  • Voicemail, call recordings, CDRs and the writable spool on a dedicated 20 GiB Azure data disk mounted at /var/lib/asterisk, so call state survives independently of the OS disk
  • external_media_address and external_signaling_address set from the VM public IP on first boot, so SIP and RTP traverse NAT correctly
  • A bundled SIP self-test client (sipexer) that lets you prove registration and place the echo test call from the VM itself
  • A minimal nginx on port :80 that serves only an unauthenticated /healthz endpoint (HTTP 200) for Azure Load Balancer health probes. It is not a PBX management interface
  • An Ubuntu 24.04 LTS base with the latest security patches applied at build time and unattended security upgrades kept enabled
  • The Azure Linux Agent for cloud integration and SSH key injection
  • 24/7 SecureAnyCloud support with a guaranteed 24 hour response SLA

Prerequisites

You need an active Azure subscription, an SSH public key, a VNet and a subnet in the target region. You also need a subscription to the Asterisk listing on Azure Marketplace.

Configure the network security group (NSG) to allow TCP 22 (administration), UDP and TCP 5060 (SIP), the RTP media range UDP 10000 to 10100 (call audio) and TCP 80 (health probe).

Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable starting point for a small PBX with a handful of concurrent calls. Choose a larger size for heavier call volumes, transcoding or conferencing.

1

Deploy from the Azure Portal

Search the Azure Marketplace for Asterisk, select the SecureAnyCloud publisher, and select Create.

Configure the NSG to allow TCP 22 for administration, UDP and TCP 5060 for SIP signalling, UDP 10000 to 10100 for RTP media, and TCP 80 for the health probe. Assign a public IP so that remote softphones can register.

2

Deploy from the Azure CLI

RG="pbx-prod"; LOCATION="eastus"; VM_NAME="asterisk1" IMAGE_URN="sac1647283583153:asterisk-ubuntu-24-04:default:latest" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:asterisk-ubuntu-24-04:default:latest
az vm create --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" --size Standard_B2s \
  --admin-username azureuser --generate-ssh-keys --public-ip-sku Standard
# SIP signalling (UDP + TCP 5060), RTP media (UDP 10000-10100), health probe (TCP 80)
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 5060 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 10000-10100 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1003

The Azure Marketplace recommended NSG declares a narrowed RTP range (UDP 10000 to 10019) to stay within the platform's per-rule port limit. The image and this guide use the full UDP 10000 to 10100 range. Widen your NSG rule to cover the range that your expected concurrent call volume needs.

3

Review the first boot

On the first boot of every VM, asterisk-firstboot.service runs once. It resolves the VM public IP from Azure IMDS and writes it as the SIP and RTP external address. It generates the per-instance SIP secret for the demo endpoint and asserts that no sample configuration, anonymous endpoint or dial-out route is present. It then starts Asterisk and nginx.

Allow about 30 seconds after the VM first becomes reachable.

4

Confirm the service is running

Connect over SSH. Confirm that Asterisk and nginx are active and that Asterisk runs as the unprivileged asterisk user.

sudo systemctl is-active asterisk nginx
sudo asterisk -rx "core show version" curl -s -o /dev/null -w "healthz: %{http_code}\n" http://127.0.0.1/healthz
5

Inspect the PJSIP transports and endpoints

Asterisk listens for SIP on UDP and TCP port 5060 and includes one example endpoint, demo.

sudo asterisk -rx "pjsip show transports"
sudo asterisk -rx "pjsip show endpoints"
6

Register a softphone as the demo endpoint

Read the per-instance SIP secret, which is unique to this VM, from the root-only credentials file. Then register. The bundled sipexer client proves registration from the VM itself. A desktop or mobile softphone (for example Zoiper, Linphone or MicroSIP) registers the same way from your network.

sudo cat /root/asterisk-credentials.txt
# register as demo using the per instance secret (substitute the value from the file above) /usr/local/bin/sipexer -register -fuser demo -au demo -ap '<SIP_SECRET>' -ex 300 udp:127.0.0.1:5060
sudo asterisk -rx "pjsip show aor demo"

To register a softphone from your own device, point it at the VM public IP on port 5060. Use the username demo and the secret from the file above. A wrong secret is rejected, and an unauthenticated registration is refused, because there is no anonymous SIP.

7

Place the echo test call

With the softphone registered, dial 600 for the announced echo test, or *43 for the bare echo test. You hear your own audio played back, which proves that registration, call setup and two-way RTP media all work.

# authenticated self call to the echo test extension (from the VM, using the bundled client) /usr/local/bin/sipexer --register-first --invite -fuser demo -au demo -ap '<SIP_SECRET>' -tuser 600 udp:127.0.0.1:5060 2>&1 \
  | grep -aE 'SIP/2.0 (100|180|200)' || true
8

Review the hardened configuration

The shipped configuration is deliberately minimal. The demo endpoint requires authentication with the per-instance secret, and the secret itself lives in a root-only include outside the main file. The dialplan has only local test extensions, with no Dial application and no PSTN route.

sudo sed -n '/^\[demo\]/,/^direct_media/p' /etc/asterisk/pjsip.conf
sudo grep -E '^\[demo-internal\]|^exten =>' /etc/asterisk/extensions.conf
9

Add your own endpoints, trunks and outbound dialing

To build a working PBX, add your own PJSIP endpoints for each phone. When you are ready to make external calls, add a SIP trunk and an outbound context. Keep outbound dialing in its own context that only trusted, authenticated endpoints can reach, and always restrict the patterns that a trunk can dial.

# example: add a new endpoint (edit as root, then reload)
sudo tee -a /etc/asterisk/pjsip.conf >/dev/null <<'EOF' [alice] type=aor max_contacts=1 [alice] type=auth auth_type=userpass username=alice password=<new-password> [alice] type=endpoint context=demo-internal disallow=all allow=ulaw auth=alice aors=alice EOF
sudo asterisk -rx "pjsip reload"

Introduce a Dial() to a SIP trunk only from a context that your trusted endpoints use. Never expose an outbound trunk to an unauthenticated or guest context.

10

Voicemail, recordings and the data disk

Voicemail, call recordings and CDRs are written under /var/lib/asterisk, a dedicated 20 GiB Azure data disk. They persist independently of the OS disk, and you can resize the volume independently.

findmnt /var/lib/asterisk
sudo ls -la /var/lib/asterisk/spool
11

Configure NAT, TLS and SRTP for production

First boot sets the SIP and RTP external addresses to the VM public IP so that calls traverse NAT. For production, add a TLS transport on port 5061 and enable SRTP so that signalling and media are encrypted. Terminate TLS with a certificate for your own domain.

  • Keep UDP and TCP 5060 and the RTP range open only to the networks that need them, and prefer TLS on 5061 for remote phones.
  • Use strong, unique secrets for every endpoint, and never reuse the demo credential in production.
  • Restrict outbound dialing patterns on every trunk to limit the impact of any compromised endpoint.
12

Support and Licensing

Asterisk is licensed under the GPL 2.0 license. This image bundles the official Asterisk release, a minimal hardened configuration and the open source sipexer self-test client (MIT). SecureAnyCloud provides the packaging, hardening and Azure integration, with 24/7 support and a guaranteed 24 hour response SLA.

Trademark notice: Asterisk is a registered trademark of Sangoma Technologies. SecureAnyCloud is not affiliated with or endorsed by Sangoma Technologies. This image packages the open source Asterisk software for convenient deployment on Azure.

Deploy on Azure

Find Asterisk on Ubuntu 24.04 LTS by SecureAnyCloud on the Azure Marketplace and select Create, or deploy from the Azure CLI as shown above.

Need Help?

Contact SecureAnyCloud support at sales@secureanycloud.com for deployment assistance, configuration guidance or licensing questions.

Deploy on Azure

Launch Asterisk 22 LTS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure