DISA with Security Warnings

Security -- Last reviewed 2026-08-22 disa security toll-fraud dialplan pin

DISA with Security Warnings

DISA gives a caller dialtone inside your PBXPrivate Branch Exchange, a private telephone switch. Asterisk is a software PBX that routes calls between internal extensions and the outside world. after they authenticate. It is powerful and dangerous. If an attacker guesses the access number or PIN, they can place outbound calls through your system.

Use DISA only when you have a clear operational need. For most users, a VPN softphone, authenticated SIPSession Initiation Protocol, the standard signaling protocol used to set up, manage, and tear down VoIP calls between Asterisk and phones or carriers. endpointIn PJSIP configuration, the SIP entity Asterisk communicates with: a phone, trunk, or other user agent. Defined by an endpoint section in pjsip.conf., or callback workflow is safer.

Safer DISA pattern

[from-trunk]
; Route only a private DID to DISA. Do not publish this number.
exten => 15551234567,1,NoOp(Restricted DISA access from ${CALLERID(all)})
 same => n,GotoIf($["${CALLERID(num)}" = "15557654321"]?allowed)
 same => n,Playback(ss-noservice)
 same => n,Hangup()
 same => n(allowed),Answer()
 ; Caller ID is only a secondary filter, not strong authentication.
 same => n,Authenticate(/etc/asterisk/disa.pin,,32)
 same => n,Set(CDR(userfield)=disa-access:${UNIQUEID})
 same => n,Set(CALLERID(num)=15551230000)
 same => n,DISA(no-password,disa-outbound)
 same => n,Hangup()

[disa-outbound]
; Emergency calls should use a normal endpoint with registered location.
; Do not route emergency calls through anonymous DISA dialtone.
exten => 911,1,Playback(ss-noservice)
 same => n,Hangup()

; North America example, restrict to domestic calls only.
exten => _NXXNXXXXXX,1,Dial(PJSIP/1${EXTEN}@trunk,60)
 same => n,Hangup()

exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@trunk,60)
 same => n,Hangup()

; Explicitly reject international and operator prefixes.
exten => _011.,1,Hangup(21)
exten => _00.,1,Hangup(21)
exten => _0.,1,Hangup(21)

PIN file

Authenticate() can read the PIN from a file. Keep it owned by root or the Asterisk user and readable only by Asterisk.

install -o asterisk -g asterisk -m 0640 /dev/null /etc/asterisk/disa.pin
printf '%s\n' 'change-this-long-pin' > /etc/asterisk/disa.pin

Use a long PIN. Do not use a four-digit extensionA dialplan entry that matches a dialed number or pattern within a context and triggers a sequence of prioritized steps.-style password for DISA.

Required controls

Put DISA behind a private DID or trusted source match.
Require a strong PIN and rotate it when staff leave.
Restrict outbound patterns to the smallest dial plan that meets the need.
Block international, premium, operator, and emergency patterns unless you have a specific, tested reason.
Force a known caller IDThe calling party number (and optionally name) presented on an outbound call, set from the endpoint or manipulated in the dialplan. instead of passing arbitrary inbound caller ID to the trunkA connection between Asterisk and another PBX or an ITSP/carrier, used to send and receive external calls..
Log every DISA call with CDRCall Detail Record. The per-call accounting data Asterisk writes (start, answer, and end times, duration, disposition) to files or databases. fields or CEL events.
Rate-limit failed attempts at the trunk, firewall, or dialplanThe core call-routing configuration of Asterisk, written mostly in extensions.conf as contexts, extensions, and priorities that decide how every call is handled. Full definition → edge.

Better alternatives

Remote users register a PJSIPThe modern SIP channel driver in Asterisk (chan_pjsip), replacing the older chan_sip. Configured in pjsip.conf using endpoints, AORs, auths, and transports. endpoint over VPN.
Use a callback application that calls the authorized user first, then bridges the outbound leg.
Use AMIAsterisk Manager Interface. A TCP socket API for monitoring events and issuing actions in Asterisk, commonly used by click-to-dial integrations and dashboards. or ARIAsterisk REST Interface. A modern asynchronous API exposing channels, bridges, and endpoints over HTTP and WebSocket for building custom call applications. for controlled origination from a web portal with per-user authorization.