DISA with Security Warnings

DISA gives a caller dialtone inside your PBX after they authenticate. It is powerful and dangerous. If an attacker guesses the access number or PIN, they can place outbound calls through your system.

Use DISA only when you have a clear operational need. For most users, a VPN softphone, authenticated SIP endpoint, or callback workflow is safer.

Safer DISA pattern

[from-trunk]
; Route only a private DID to DISA. Do not publish this number.
exten => 15551234567,1,NoOp(Restricted DISA access from ${CALLERID(all)})
 same => n,GotoIf($["${CALLERID(num)}" = "15557654321"]?allowed)
 same => n,Playback(ss-noservice)
 same => n,Hangup()
 same => n(allowed),Answer()
 ; Caller ID is only a secondary filter, not strong authentication.
 same => n,Authenticate(/etc/asterisk/disa.pin,,32)
 same => n,Set(CDR(userfield)=disa-access:${UNIQUEID})
 same => n,Set(CALLERID(num)=15551230000)
 same => n,DISA(no-password,disa-outbound)
 same => n,Hangup()

[disa-outbound]
; Emergency calls should use a normal endpoint with registered location.
; Do not route emergency calls through anonymous DISA dialtone.
exten => 911,1,Playback(ss-noservice)
 same => n,Hangup()

; North America example, restrict to domestic calls only.
exten => _NXXNXXXXXX,1,Dial(PJSIP/1${EXTEN}@trunk,60)
 same => n,Hangup()

exten => _1NXXNXXXXXX,1,Dial(PJSIP/${EXTEN}@trunk,60)
 same => n,Hangup()

; Explicitly reject international and operator prefixes.
exten => _011.,1,Hangup(21)
exten => _00.,1,Hangup(21)
exten => _0.,1,Hangup(21)

PIN file

Authenticate() can read the PIN from a file. Keep it owned by root or the Asterisk user and readable only by Asterisk.

install -o asterisk -g asterisk -m 0640 /dev/null /etc/asterisk/disa.pin
printf '%s\n' 'change-this-long-pin' > /etc/asterisk/disa.pin

Use a long PIN. Do not use a four-digit extension-style password for DISA.

Required controls

• Put DISA behind a private DID or trusted source match.
• Require a strong PIN and rotate it when staff leave.
• Restrict outbound patterns to the smallest dial plan that meets the need.
• Block international, premium, operator, and emergency patterns unless you have a specific, tested reason.
• Force a known caller ID instead of passing arbitrary inbound caller ID to the trunk.
• Log every DISA call with CDR fields or CEL events.
• Rate-limit failed attempts at the trunk, firewall, or dialplan edge.

Better alternatives

• Remote users register a PJSIP endpoint over VPN.
• Use a callback application that calls the authorized user first, then bridges the outbound leg.
• Use AMI or ARI for controlled origination from a web portal with per-user authorization.

See Also

• DISA()
• Authenticate()
• Dial()
• CALLERID()
• CDR()