Recent Asterisk SIP security events, newest first. Errors/warnings are real auth failures; informational lines are normal registration traffic.
-| Time | -Event | -Account | -Remote | -Severity | -
|---|
Recent Asterisk SIP security events, newest first. Errors/warnings are real auth failures; informational lines are normal registration traffic.
+| Time | +Event | +Account | +Remote | +Severity | +
|---|
Active bans
-| IP/Range | -Scenario | -Network / Carrier | -Country | -Duration | -Origin | -- |
|---|
Active bans
| IP/Range | +Scenario | +Network / Carrier | +Country | +Duration | +Origin | ++ |
|---|
Asterisk brute-force ASN exemptions
-Carrier ASNs exempted from the Asterisk brute-force scenarios only — SSH/web/geo protection is unaffected. See CLAUDE.md / services/crowdsec.sh for background.
-Asterisk brute-force ASN exemptions
Carrier ASNs exempted from the Asterisk brute-force scenarios only — SSH/web/geo protection is unaffected. See CLAUDE.md / services/crowdsec.sh for background.
+| ASN | Carrier |
|---|
| ASN | Carrier |
|---|
- Edits here are written to disk immediately, but Asterisk doesn't always pick them up without a restart — confirmed on personal-DID group reassignment specifically. Existing calls are never affected. -
- - ++ Edits are written to disk immediately, but Asterisk doesn't always pick them up without a restart — confirmed on personal-DID group reassignment specifically. Existing calls are never affected. +
+ + +Extensions
-- Every SIP extension on this box, one row each. Adding one generates a random password and reloads PJSIP + rebuilds the dialplan automatically — the password is shown once below the table, save it before it scrolls away. -
-- Tier — internal: no PSTN, can still call/receive other extensions and internal ring groups. restricted: internal, plus only the pre-approved US numbers in the next column. full: internal, plus any US number. Changes are usually live on the next call; if one doesn't seem to be taking effect, use "Commit Changes" above. -
-
- Messaging — Asterisk's native SIP texting between extensions: no carrier SMS, no PSTN, no cost, and no dependency on a PSTN trunk at all (which is why this column is here even with no trunk installed). Independent of the calling tier. Enforced live by a dedicated dialplan context — see services/asterisk.sh's README for how, and its caveat on the sender-extraction logic still needing real-traffic confirmation. If this box predates that wiring, rerun sudo ./setup.sh asterisk to pick it up.
-
Extensions
+| Ext | -Name | -Category | -Status | -Transport | -Tier | -Approved numbers (restricted only) | -Messaging | -- |
|---|
Categories
-Device profiles — an auto-answer default and a description, assignable to any extension above.
-What these columns mean
+Name and Category are editable in place — click, type, then Save. Adding an extension generates a random password and reloads PJSIP + rebuilds the dialplan automatically; the password is shown once, at the top of this card.
+Tier — internal: no PSTN, can still call/receive other extensions and internal ring groups. restricted: internal, plus only the pre-approved US numbers in the next column. full: internal, plus any US number. Usually live on the next call; if one doesn't seem to take effect, use "Commit changes" above.
+Messaging — Asterisk's native SIP texting between extensions: no carrier SMS, no PSTN, no cost, and no dependency on a PSTN trunk at all (which is why this column is here even with no trunk installed). Independent of the calling tier. Enforced live by a dedicated dialplan context — see services/asterisk.sh's README, including its caveat that the sender-extraction logic still needs real-traffic confirmation. If this box predates that wiring, rerun sudo ./setup.sh asterisk.
| Ext | +Name | +Category | +Status | +Transport | +Tier | +Approved numbers | +Messaging | ++ |
|---|
| ID | -Name | -Auto-answer | -Description | -- |
|---|
Rooms (ring groups)
-A shared extension that rings (or pages) every member device at once.
-Categories
+Device profiles — an auto-answer default and a description, assignable to any extension above.
+| ID | +Name | +Auto-answer | +Description | ++ |
|---|
| Ext | -Name | -Members | -Timeout | -Type | -- |
|---|
Groups
-- Named sets of extensions for bulk actions — e.g. enable messaging for everyone in "Sales" at once. A management convenience only: applying an action writes the same per-extension setting each member's own Messaging checkbox above would, one time — it isn't a runtime concept the dialplan knows about, and membership changes never retroactively affect anything already applied. A group can also own a personal number below, which is evaluated live against current membership on every call. -
-Rooms (ring groups)
+A shared extension that rings (or pages) every member device at once.
+| Ext | +Name | +Members | +Timeout | +Type | ++ |
|---|
| Group | -Members | -- |
|---|
Concurrent-call caps
-A call over either cap gets a busy signal (and an ntfy alert, if enabled) — existing calls are never affected. Changes are usually live on the next call; if a call doesn't reflect a recent change, use "Commit Changes" at the top.
-Groups
+What groups do
+Named sets of extensions for bulk actions — e.g. enable messaging for everyone in "Sales" at once. A management convenience only: applying an action writes the same per-extension setting each member's own Messaging checkbox above would, one time. It isn't a runtime concept the dialplan knows about, and membership changes never retroactively affect anything already applied. A group can also own a personal number below, which is evaluated live against current membership on every call.
+| Group | +Members | ++ |
|---|
Personal numbers
-- Multiple DIDs can share this one trunk. Assigning a DID to an extension routes inbound calls to that DID straight to its owner (still gated by the owner's own tier/approved-numbers above — no ring-group fallback), and makes that extension's outbound calls show this DID as Caller-ID instead of the shared trunk DID. You can also assign a DID to a group instead of a single extension — every current member whose own tier/approved-numbers authorize the caller rings, checked fresh against the group's current membership on every call; a group has no single extension to hang the outbound Caller-ID override on, so that part only applies to single-extension assignments. The shared DID/ring-group keeps working regardless. Reassigning a DID's owner has been confirmed to sometimes need "Commit Changes" (at the top) before Asterisk actually uses the new owner. -
-Concurrent-call caps
+A call over either cap gets a busy signal (and an ntfy alert, if enabled) — existing calls are never affected. Usually live on the next call; if a call doesn't reflect a recent change, use "Commit changes" at the top.
+| DID | -Owner | -- |
|---|
Personal numbers
+How personal numbers route
+Multiple DIDs can share this one trunk. Assigning a DID to an extension routes inbound calls to that DID straight to its owner (still gated by the owner's own tier/approved-numbers above — no ring-group fallback), and makes that extension's outbound calls show this DID as Caller-ID instead of the shared trunk DID.
+You can also assign a DID to a group instead of a single extension — every current member whose own tier/approved-numbers authorize the caller rings, checked fresh against the group's current membership on every call. A group has no single extension to hang the outbound Caller-ID override on, so that part only applies to single-extension assignments. The shared DID/ring-group keeps working regardless.
+Reassigning a DID's owner has been confirmed to sometimes need "Commit changes" (at the top) before Asterisk actually uses the new owner.
+| DID | +Owner | ++ |
|---|