Inventory every reachable service
List Sofia UDP, TCP, TLS, WS and WSS listeners, Event Socket, HTTP or application interfaces, databases, provisioning systems and administrator paths. Record the actual bind address, port, process owner, network exposure and business consumer for each. A closed web interface does not secure an exposed Event Socket or SIP listener.
Remove or restrict unused modules and demonstration identities through change control, then verify the runtime sockets and modules again.
Separate network admission from call authority
Sofia profiles can apply named ACLs, but an accepted source address is only one trust input. Authentication, directory variables, receiving context and dialplan destinations still determine what a call may do. Treat IP authorization and digest authentication as different models and preserve the carrier or endpoint contract for the chosen one.
A broad allowlist or public context can expose paid or sensitive destinations even when signaling itself is reachable as intended.
Verify TLS policy rather than the TLS label
SIP TLS and secure WebSocket can use distinct certificate files and profile settings. Current profile documentation exposes verification policy, date checks, certificate directories, versions and cipher controls. A bound TLS port or encrypted packet does not prove peer identity, hostname validation, trust-chain acceptance or policy fit.
Record certificate identity, chain, expiry, private-key handling, negotiated protocol and verification result for the exact connection direction.
Constrain Event Socket control
The Event Socket can execute API commands, subscribe to events, originate calls and manipulate active channels. Bind it only where required, replace example credentials, apply inbound ACLs, restrict network reachability and scope the external application. fs_cli uses this same inbound control surface.
A successful login is not proof that the controller is authorized safely, handles reconnects or preserves active-call behavior when it fails.
Use bounded diagnostics without creating a second incident
Prefer read-only status, gateway inspection, UUID filtering and a short SIP-trace window before changing authentication or exposure. Global debug and SIP tracing can produce sensitive data and heavy logs, so define the capture interval, storage, redaction and restoration step.
Keep credentials, authorization headers, private keys and unnecessary caller data out of exported evidence.
Exercise update and recovery boundaries
Preserve configuration, certificates, application state and the information needed to reproduce the exact module set. Test restoration in an isolated environment without production registrations or external calling, then verify administrative access, internal routing, required features and explicit restrictions.
A package update, process restart or extracted backup does not prove the service is secure or recoverable. No security control or restore was tested for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- FreeSWITCH SIP profiles with Sofia ↗
- FreeSWITCH WebRTC over SIP and TLS parameters ↗
- FreeSWITCH Event Socket ↗
- FreeSWITCH CLI and API command reference ↗
- FreeSWITCH diagnostic toolbox ↗
- FreeSWITCH registration troubleshooting ↗
- FreeSWITCH SIP trace and CDR reading ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.