Re: TLS/SRTP

--===============1260601876==
Content-Type: multipart/alternative; boundary="000000000000536b93065589ab8e"

--000000000000536b93065589ab8e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Thank you for your clear answer.

Could you elaborate on the concrete risks and constraints of NOT
implementing TLS on a public-facing Kamailio SBC, even with strict IP ACLs
already in place?

Specifically:
1. What can an attacker realistically do if SIP runs in clear text?
2. Are there compliance or regulatory constraints we should be aware of?
3. What incidents have you seen in real deployments without TLS?

Thanks,

Le mar. 30 juin 2026 =C3=A0 18:03, alexis via sr-users <
[email protected]> a =C3=A9crit :

> maybe not for a local network, absolutely yes for a public one no matter
> the acl/rule/firewall
>
>
> El El mar, 30 jun 2026 a la(s) 12:57, asma.bouddyach--- via sr-users <
> [email protected]> escribi=C3=B3:
>
>> Hi all,
>>
>> My Kamailio SBC (in front of 3CX,)  currently runs SIP in clear text, no
>> SRTP. Security is mainly IP-based ACLs:
>>
>> if ($si =3D=3D PBX_IP) {
>>     route(FROM_PBX);
>> if ($si =3D=3D ITSP_IP_IN || $si =3D=3D ITSP_IP_OUT) {
>>     route(FROM_ITSP);
>>
>> What are the concrete risks of staying without TLS/SRTP in this setup,
>> and would you still recommend encryption given these ACLs already in pla=
ce?
>>
>> Thanks,
>> Asmaa  BOUDDYACH
>> __________________________________________________________
>> Kamailio - Users Mailing List - Non Commercial Discussions --
>> [email protected]
>> To unsubscribe send an email to [email protected]
>> Important: keep the mailing list in the recipients, do not reply only to
>> the sender!
>>
> __________________________________________________________
> Kamailio - Users Mailing List - Non Commercial Discussions --
> [email protected]
> To unsubscribe send an email to [email protected]
> Important: keep the mailing list in the recipients, do not reply only to
> the sender!
>

--=20





















This message and any of its attachments is intended
solely for the addresses and is confidential. If you receive this message=
=20
in
error, please delete it and immediately notify the sender. Any use not=20
in
accord with its purpose, any dissemination or disclosure, either whole=20
or
partial, is prohibited except formal approval. The internet cannot=20
guarantee
the integrity of this message. The INTELCIA Group shall (will)=20
not therefore be
liable for the message if modified.



=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=
=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94



Ce
message et toutes les pi=C3=A8ces jointes sont =C3=A9tablis =C3=A0 l'intent=
ion=20
exclusive de
ses destinataires et sont confidentiels. Si vous recevez ce=20
message par erreur,
merci de le d=C3=A9truire et d=E2=80=99en avertir imm=C3=A9diatement=20
l=E2=80=99exp=C3=A9diteur. Toute
utilisation de ce message non conforme =C3=A0 sa=20
destination, toute diffusion ou
toute publication, m=C3=AAme partielle, est=20
interdite, sauf autorisation expresse.
L=E2=80=99internet ne permettant pas=20
d=E2=80=99assurer l=E2=80=99int=C3=A9grit=C3=A9 de ce message, le groupe
INTELCIA d=C3=A9cline toute=20
responsabilit=C3=A9 au titre de ce message, dans l=E2=80=99hypoth=C3=A8se
o=C3=B9 il aurait =C3=A9t=C3=A9=20
modifi=C3=A9.






--000000000000536b93065589ab8e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<br><br>Thank you for your clear answer.<br><br>Could y=
ou elaborate on the concrete risks and constraints of NOT implementing TLS =
on a public-facing Kamailio SBC, even with strict IP ACLs already in place?=
<br><br>Specifically:<br>1. What can an attacker realistically do if SIP ru=
ns in clear text?<br>2. Are there compliance or regulatory constraints we s=
hould be aware of?<br>3. What incidents have you seen in real deployments w=
ithout TLS?<br><br>Thanks,</div><br><div class=3D"gmail_quote gmail_quote_c=
ontainer"><div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0mar. 30 juin 2026 =
=C3=A0=C2=A018:03, alexis via sr-users &lt;<a href=3D"mailto:sr-users@lists=
.kamailio.org">[email protected]</a>&gt; a =C3=A9crit=C2=A0:<br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto">ma=
ybe not for a local network, absolutely yes for a public one no matter the =
acl/rule/firewall=C2=A0</div><div dir=3D"auto"><br></div><div><br><div clas=
s=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">El El mar, 30 jun 2=
026 a la(s) 12:57, asma.bouddyach--- via sr-users &lt;<a href=3D"mailto:sr-=
[email protected]" target=3D"_blank">[email protected]</a>=
&gt; escribi=C3=B3:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex">Hi all,<br>
<br>
My Kamailio SBC (in front of 3CX,)=C2=A0 currently runs SIP in clear text, =
no SRTP. Security is mainly IP-based ACLs:<br>
<br>
if ($si =3D=3D PBX_IP) {<br>
=C2=A0 =C2=A0 route(FROM_PBX);<br>
if ($si =3D=3D ITSP_IP_IN || $si =3D=3D ITSP_IP_OUT) {<br>
=C2=A0 =C2=A0 route(FROM_ITSP);<br>
<br>
What are the concrete risks of staying without TLS/SRTP in this setup, and =
would you still recommend encryption given these ACLs already in place?<br>
<br>
Thanks,<br>
Asmaa=C2=A0 BOUDDYACH<br>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions -- <a href=3D"ma=
ilto:[email protected]" target=3D"_blank">[email protected]=
.org</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
ilio.org" target=3D"_blank">[email protected]</a><br>
Important: keep the mailing list in the recipients, do not reply only to th=
e sender!<br>
</blockquote></div></div>
__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions -- <a href=3D"ma=
ilto:[email protected]" target=3D"_blank">[email protected]=
.org</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
ilio.org" target=3D"_blank">[email protected]</a><br>
Important: keep the mailing list in the recipients, do not reply only to th=
e sender!<br>
</blockquote></div>

<br>



















<p><span style=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(3=
1,73,125)" lang=3D"EN-US">This message and any of its attachments is intend=
ed
solely for the addresses and is confidential. If you receive this message i=
n
error, please delete it and immediately notify the sender. Any use not in
accord with its purpose, any dissemination or disclosure, either whole or
partial, is prohibited except formal approval. The internet cannot guarante=
e
the integrity of this message. The INTELCIA Group shall (will) not therefor=
e be
liable for the message if modified.</span><span></span></p>

<p><span style=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(3=
1,73,125)">=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=
=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94=E2=80=94</s=
pan><span></span></p>

<p><span style=3D"font-size:11pt;font-family:Calibri,sans-serif;color:rgb(3=
1,73,125)">Ce
message et toutes les pi=C3=A8ces jointes sont =C3=A9tablis =C3=A0 l&#39;in=
tention exclusive de
ses destinataires et sont confidentiels. Si vous recevez ce message par err=
eur,
merci de le d=C3=A9truire et d=E2=80=99en avertir imm=C3=A9diatement l=E2=
=80=99exp=C3=A9diteur. Toute
utilisation de ce message non conforme =C3=A0 sa destination, toute diffusi=
on ou
toute publication, m=C3=AAme partielle, est interdite, sauf autorisation ex=
presse.
L=E2=80=99internet ne permettant pas d=E2=80=99assurer l=E2=80=99int=C3=A9g=
rit=C3=A9 de ce message, le groupe
INTELCIA d=C3=A9cline toute responsabilit=C3=A9 au titre de ce message, dan=
s l=E2=80=99hypoth=C3=A8se
o=C3=B9 il aurait =C3=A9t=C3=A9 modifi=C3=A9.</span><span></span></p>






--000000000000536b93065589ab8e--

--===============1260601876==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the sender!

--===============1260601876==--