Asterisk PBX - fail2ban Hardened, CloudWatch & SSM Ready

Asterisk is the world's most widely deployed open source PBX and telephony engine. This CloudSOE image delivers a ready-to-run Asterisk server with brute-force protection, native AWS observability, and security hardening wired in from first boot - so you can operate it like any other AWS workload.

Built for developers, integrators, and VoIP engineers building IVRs, custom call flows, CTI integrations, and communications applications who want the engine without a GUI in the way and without a day of compilation and hardening first.

What You Get Out of the Box

• Asterisk PBX (PJSIP) - Current LTS release installed and running at first boot, with chan_pjsip as the standard channel driver and commented endpoint, auth, and AOR templates that make adding a trunk or endpoint a five-minute edit
• Structured dialplan skeleton - Contexts separated for internal, inbound, and outbound with deny-by-default routing between them, the pattern that prevents most accidental toll fraud
• ARI REST interface and AMI - Enabled and secured for building Stasis apps and CTI integrations
• Security logger channel - Activated so SIP authentication failures are written to /var/log/asterisk/security

Security Hardening

• fail2ban pre-configured and active - An escalating Asterisk jail watches security and messages logs: 5 failures in 10 minutes triggers a 1-hour ban, with escalating bans up to 1 week for repeat offenders (rules in /etc/fail2ban/jail.d/asterisk.local)
• Key-only SSH - Password authentication disabled, root login disabled
• No baked-in secrets - Cloud-init state and shell history scrubbed before the image is captured
• Deny-by-default dialplan routing - Contexts isolated to prevent accidental toll fraud
• Recommended ports - SSH 22/tcp, SIP 5060-5061 (tcp/udp), RTP 10000-20000/udp - open only what you use

Native AWS Integration

• Amazon CloudWatch agent - Pre-configured to ship Asterisk messages, security logs, fail2ban.log, syslog, and auth.log to CloudWatch Logs (log groups under /cloudsoe/asterisk) and publish CPU, memory, disk, and TCP metrics under the CloudSOE/asterisk namespace
• AWS Systems Manager - SSM Agent installed and enabled for Session Manager, Run Command, and Patch Manager
• IAM-based activation - Attach an instance role with CloudWatchAgentServerPolicy and AmazonSSMManagedInstanceCore to activate monitoring. No AWS credentials are stored on the image
• First-boot service - Writes the instance's public IP into the login banner so the SIP endpoint address is visible immediately

Common Use Cases

• Custom IVRs and call flows - Menus, queues, time conditions, and integrations written in dialplan or driven from ARI
• Communications applications - Stasis apps over ARI in Python, Node.js, Go, or anything that speaks REST and WebSocket
• CTI and CRM integration - Originate, monitor, and control calls from business systems via AMI and ARI
• SIP trunk termination and testing - A controlled endpoint for carrier trunk validation and lab work
• Learning and certification preparation - A clean, correct Asterisk to study against without GUI abstractions

Sizing Guidance

Signaling is light; media and recording are not. Development and small deployments: t3.small. Production with transcoding or recording: t3.medium to m7i.large depending on concurrent channels. Conference-heavy workloads scale with cores.

Getting Started

SSH in as 'ubuntu'; configuration lives in /etc/asterisk/ (console: sudo asterisk -rvvv). Whitelist your admin IP in fail2ban first: sudo fail2ban-client set asterisk addignoreip . CloudWatch agent config is at /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/asterisk.json. Full root access is provided. A support-information file at /etc/cloudsoe-support.txt identifies the exact build including product, version, git revision, and cloud.

Trademark Notice

Asterisk is a registered trademark of Sangoma Technologies Corporation. This product is independently packaged and maintained and is not affiliated with, endorsed by, or supported by Sangoma Technologies.