Asterisk 22.11.0 on AWS User Guide

Overview

This guide covers launching and using the Asterisk 22.11.0 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg team chat and video listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Asterisk is the most widely deployed open source communications engine: a SIP PBX, VoIP gateway, IVR, conferencing and voicemail toolkit. It runs as a headless service that you manage with the Asterisk command line (asterisk -rx) and the text configuration files in /etc/asterisk. There is no web interface.

The image builds Asterisk 22.11.0, the current release of the Asterisk 22 long term support branch, from the official source tarball on downloads.asterisk.org, verified against its SHA256 checksum, with the bundled pjproject stack behind the chan_pjsip channel driver. Asterisk runs under systemd as the unprivileged asterisk user.

What cloudimg adds:

• No SIP credential in the image. The example demo endpoint does not exist in the AMI. On the first boot of your instance a unique 32 character secret is generated and the endpoint is created with it; the secret is written to /root/asterisk-credentials.txt (root only).
• Fail closed. asterisk.service refuses to start while first boot has not set the secret, and refuses to start whenever any PJSIP authentication section has an empty or missing password, so a passwordless account can never go live by mistake.
• No anonymous SIP and no toll fraud route. There is no anonymous endpoint: unauthenticated REGISTER and INVITE requests are challenged and never served. The dialplan holds only local test extensions (echo test and a playback) with no outbound route, no trunk and no pattern match extension, so even a compromised phone cannot place a call off the server until you add a trunk yourself.
• Management interfaces off. The Asterisk Manager Interface (AMI), the built in HTTP server and the REST interface (ARI) are all disabled. The only network services are SIP on UDP and TCP 5060 and SSH.
• Instance metadata blocked. Asterisk and the first boot unit are denied the EC2 instance metadata address. One small unit reads only this instance's own addresses at boot. The AMI requires IMDSv2.
• NAT handled for you. The SIP and RTP external address is set from the instance's public IPv4 on every start, so calls keep working after a stop and start gives the instance a new public address.
• Dedicated data volume. Voicemail, call recordings, call detail records, the Asterisk database and logs live on their own EBS volume at /var/lib/asterisk.
• No build tools in the image, a built in self test (sudo asterisk-selftest), and a fully patched Ubuntu 24.04 LTS with unattended security upgrades switched on.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large (2 vCPU, 8 GiB). Scale up for heavy call volumes, transcoding or conferencing.

Asterisk is a registered trademark of Sangoma Technologies. This image is produced by cloudimg and is not affiliated with, sponsored by, or endorsed by Sangoma Technologies. It ships the open source Asterisk software unmodified under the GNU GPL version 2, with the bundled pjproject (GPL version 2 or later) and jansson (MIT) libraries. Source: https://downloads.asterisk.org/pub/telephony/asterisk/releases/.

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet.
• A security group that allows exactly these ports:

Nothing else listens on the network, so do not open any other port. Open 5060 and the RTP range only to the networks your phones and SIP trunk provider use, never to the whole internet if you can avoid it: SIP scanners probe every public 5060 within minutes of launch.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Asterisk 22.11.0 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair and a security group as above.

With the AWS CLI (replace the values in angle brackets):

SG=$(aws ec2 create-security-group --group-name asterisk-pbx --description "Asterisk PBX" \
  --vpc-id <your-vpc> --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --ip-permissions \
  'IpProtocol=tcp,FromPort=22,ToPort=22,IpRanges=[{CidrIp=<your-admin-cidr>}]' \
  'IpProtocol=udp,FromPort=5060,ToPort=5060,IpRanges=[{CidrIp=<your-phones-cidr>}]' \
  'IpProtocol=tcp,FromPort=5060,ToPort=5060,IpRanges=[{CidrIp=<your-phones-cidr>}]' \
  'IpProtocol=udp,FromPort=10000,ToPort=10100,IpRanges=[{CidrIp=<your-phones-cidr>}]'

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids "$SG" --subnet-id <your-subnet> --associate-public-ip-address \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=asterisk}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the service

First boot creates the secret and the demo endpoint and starts Asterisk. It takes a few seconds after the instance is reachable:

systemctl is-active asterisk-firstboot asterisk
sudo test -f /var/lib/cloudimg/asterisk-firstboot.done && echo FIRSTBOOT_DONE

active
active
FIRSTBOOT_DONE

The version, and the process running as the unprivileged asterisk user:

sudo asterisk -rx "core show version"
ps -o user=,comm= -C asterisk

Asterisk 22.11.0 built by root @ ip-172-31-82-27 on a x86_64 running Linux on 2026-10-20 01:46:18 UTC
asterisk asterisk

If asterisk is still activating in the first seconds, follow first boot with sudo journalctl -u asterisk-firstboot -f.

Step 4: Get your credentials

The credentials file is readable by root only. Print it with the secret masked (safe to paste into a support request):

sudo sed -E 's/^(sip\.demo\.secret=).*/\1********/' /root/asterisk-credentials.txt | grep -E '^(sip|asterisk)\.'

sip.host=<SIP_HOST>
sip.transport.udp=<SIP_HOST>:5060
sip.transport.tcp=<SIP_HOST>:5060
sip.rtp.range=10000-10100/udp
sip.demo.username=demo
sip.demo.secret=********
asterisk.version=22.11.0
asterisk.datadir=/var/lib/asterisk

When you need the secret itself, for example to configure a softphone, print just that value:

sudo grep '^sip.demo.secret=' /root/asterisk-credentials.txt | cut -d= -f2-

sip.host is the instance's public IPv4 at first boot (its private address if it has none). The secret also lives in /etc/asterisk/pjsip.d/20-demo.conf, readable by root and the asterisk group only.

Step 5: Check the security model

asterisk-selftest proves the defaults end to end from the instance itself. It reads the secret from the credentials file and hands it to the bundled SIP client through a root only file, never on a command line:

sudo asterisk-selftest

round-trip OK: REGISTER demo@127.0.0.1:5060/udp -> 200 OK; REGISTER demo@127.0.0.1:5060/tcp -> 200 OK; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; REGISTER demo@127.0.0.1:5060/udp -> 401 Unauthorized; INVITE 600@127.0.0.1:5060/udp -> 401 Unauthorized; dialplan local-only, AMI/HTTP/ARI disabled

In order: the correct secret registers over UDP and over TCP; a wrong secret, an empty password and an unauthenticated REGISTER are all refused; an anonymous INVITE to the echo test is refused.

The management interfaces are off:

sudo asterisk -rx "manager show settings" | grep 'Manager (AMI)'
sudo asterisk -rx "http show status" | grep -E 'Server (Enabled|Disabled)'
sudo asterisk -rx "ari show status" | grep '^Enabled'

  Manager (AMI):             No
Server Disabled
Enabled: No

The dialplan holds only the local test extensions:

sudo grep -E '^\[demo-internal\]|^exten =>' /etc/asterisk/extensions.conf

[demo-internal]
exten => 600,1,Answer()
exten => *43,1,Answer()
exten => 601,1,Answer()

The network listeners. SSH and SIP are the only services; the two extra UDP sockets on random high ports belong to Asterisk's DNS resolver (client sockets it uses to look up SIP servers) and are not reachable through the security group:

sudo ss -Hlntup | awk '$5 !~ /^(127\.|\[::1\])/ {print $1, $5}' | sort -u

tcp 0.0.0.0:22
tcp 0.0.0.0:5060
tcp [::]:22
udp 0.0.0.0:36247
udp 0.0.0.0:5060
udp 172.31.82.27%ens5:68
udp [::]:53508

Instance metadata is denied to Asterisk and to first boot; only the metadata reader may reach it, and nothing else:

systemctl show -p IPAddressDeny asterisk.service asterisk-firstboot.service
systemctl show -p IPAddressDeny -p IPAddressAllow asterisk-metadata.service

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32
IPAddressAllow=::1/128 127.0.0.0/8 169.254.169.254/32
IPAddressDeny=0.0.0.0/0 ::/0

Fail closed in practice. asterisk.service runs /usr/local/sbin/asterisk-prestart before every start. It refuses to start Asterisk while the demo include is still the image's placeholder, or if any type=auth section in pjsip.conf or pjsip.d/*.conf has an empty or missing password (or auth_type=md5 with no md5_cred). You can run the same check yourself after editing the configuration:

sudo /usr/local/sbin/asterisk-prestart --check-only

asterisk-prestart: PJSIP auth check passed

Step 6: Transports and endpoints

sudo asterisk -rx "pjsip show transports"
sudo asterisk -rx "pjsip show endpoints"

Transport:  transport-tcp             tcp      0      0  0.0.0.0:5060
Transport:  transport-udp             udp      0      0  0.0.0.0:5060

Objects found: 2

 Endpoint:  demo                                                 Unavailable   0 of inf
     InAuth:  demo-auth/demo
        Aor:  demo                                               1

Objects found: 1

The endpoint shows Unavailable until a phone registers.

Step 7: Register a softphone and call the echo test

In any SIP softphone (for example Linphone, Zoiper or MicroSIP) create an account with:

When the account shows as registered, dial 600 for the announced echo test or *43 for the bare echo test: you hear your own voice back, which proves registration, call setup and two way RTP audio through the security group. 601 plays a short greeting. sudo asterisk -rx "pjsip show aor demo" lists the registered phone.

You can also register from the instance with the bundled client. It reads the password from a file or from standard input, so the secret never appears on a command line or in your shell history:

sudo sed -n 's/^sip\.demo\.secret=//p' /root/asterisk-credentials.txt \
  | cloudimg-sip-check register --user demo --password-stdin

Step 8: NAT and Elastic IPs

Phones outside the VPC reach the instance through its public address, so Asterisk must advertise that address in SIP and SDP. The metadata reader records the instance's addresses at every boot and asterisk-prestart writes them into the transport include on every start:

sudo cat /etc/asterisk/pjsip.d/10-transport-extip.conf

; cloudimg: written by asterisk-prestart at 2026-10-20T01:57:57Z from instance metadata.
; Edit /etc/cloudimg/asterisk-external-address to pin a different address (e.g. an Elastic IP).
external_media_address=<SIP_HOST>
external_signaling_address=<SIP_HOST>
local_net=127.0.0.0/8
local_net=172.31.0.0/16

The local_net lines are loopback and your VPC's CIDR blocks, so phones inside the VPC get the private address. To advertise a different address, for example an Elastic IP or a load balancer, write it to /etc/cloudimg/asterisk-external-address and restart Asterisk:

echo "<elastic-ip>" | sudo tee /etc/cloudimg/asterisk-external-address
sudo systemctl restart asterisk

Step 9: Add your own endpoints and trunks safely

Add each phone as its own endpoint in a new file under /etc/asterisk/pjsip.d/, include that file from the end of /etc/asterisk/pjsip.conf, then reload. Use a long random password for every phone; asterisk-prestart refuses to start Asterisk if any password is empty.

sudo tee /etc/asterisk/pjsip.d/30-alice.conf >/dev/null <<'EOF'
[alice-auth]
type=auth
auth_type=userpass
username=alice
password=<a-long-random-password>

[alice]
type=aor
max_contacts=1

[alice]
type=endpoint
context=demo-internal
disallow=all
allow=ulaw,alaw
auth=alice-auth
aors=alice
direct_media=no
rtp_symmetric=yes
force_rport=yes
rewrite_contact=yes
EOF
sudo chown root:asterisk /etc/asterisk/pjsip.d/30-alice.conf && sudo chmod 0640 /etc/asterisk/pjsip.d/30-alice.conf
echo '#include "pjsip.d/30-alice.conf"' | sudo tee -a /etc/asterisk/pjsip.conf
sudo /usr/local/sbin/asterisk-prestart --check-only && sudo asterisk -rx "pjsip reload"

When you add a SIP trunk for outside calls:

• Put outbound dialing in its own context that only your authenticated endpoints use, never in a context an unidentified caller can reach.
• Allow only the number patterns you need (for example your country's national numbers), never a catch all such as _X., and block premium rate and international prefixes you do not use.
• Set call limits with your provider and watch the security log (/var/lib/asterisk/log/messages) for failed registrations.

Remove the demo endpoint once your own phones work: delete its lines from /etc/asterisk/pjsip.d/20-demo.conf (keep the file) and reload.

Step 10: Data volume

Voicemail, recordings, call detail records (/var/lib/asterisk/log/cdr-custom/Master.csv), the Asterisk database, logs and the sound files live on the dedicated EBS volume:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/asterisk
sudo ls /var/lib/asterisk/spool

/dev/nvme1n1 /var/lib/asterisk ext4
monitor
voicemail

The volume is mounted by filesystem UUID, so you can resize it, snapshot it or move it to a new instance independently of the root volume.

Production checklist

• Restrict UDP and TCP 5060 and the RTP range in the security group to your phones and your SIP provider.
• Add a TLS transport on 5061 with a certificate for your own domain and enable SRTP (media_encryption=sdes) on your endpoints so signalling and audio are encrypted; open TCP 5061 when you do.
• Use long random passwords for every endpoint and remove the demo endpoint.
• If you need the AMI or ARI, enable them bound to 127.0.0.1 only (bindaddr in manager.conf, http.conf), with strong credentials and a permit= ACL, and reach them through an SSH tunnel.

Updates

Ubuntu security updates install automatically. Asterisk is built from source and is not managed by apt; new Asterisk releases arrive as new versions of this listing. To move to one, launch the new version and copy /etc/asterisk and the data volume across.

Support

cloudimg supports this image. Contact support@cloudimg.co.uk with your AWS account ID, the Region and the instance ID. For choosing between the versions in this listing, see the team chat and video guide.