Home » Posts tagged 'asterisk' (Page 43)

Tag Archives: asterisk

The Most Versatile VoIP Provider: FREE PORTING

Incredible PBX on Steroids: The Asterisk-GUI Project Rolls On (Chapter 3)

We’re big fans of the new hybrid vehicles especially the Cadillac ELR. It combines an electric motor with a gas generator to give you the best of both worlds. For in-town driving, you get terrific performance at 1.5¢/mile using pure electric power. But you’re not hamstrung from venturing out to anywhere you choose using a traditional gas engine that can be refueled quickly at any time. In a nutshell, that’s the design philosophy that’s inspired development of Incredible PBX for the Asterisk-GUI.

This is the third installment in our series. You can catch up with the Overview as well as Chapter 1 and Chapter 2 here.

With Incredible PBX for the Asterisk-GUI, you get a terrific GUI to manage Asterisk® while taking advantage of all the neat features that Incredible PBX brings to the table using traditional dialplan design. Stated another way, you’re not being forced to always use a GUI to manage your Asterisk server when command-line utilities are more functional or efficient. Previous approaches to GUI-only management of Asterisk forced you to always jump through the GUI hoops to do much of anything. Unfortunately, what you lost in that scenario was a lot of the native functionality of Asterisk.

That’s not to say there wasn’t a lot to like about our GUI heritage with Asterisk. These open source projects brought a wealth of features to the table for beginners without having to learn much about the way Asterisk actually worked. The downside was you didn’t learn much about the way Asterisk actually worked. On the one hand, it kept folks from making serious programming errors that could result in major phone bills when security issues crept into a dialplan. The drawback was you never learned why. When something came unglued and things do come unglued, you were up the proverbial creek without a paddle. In fact, many never knew they had a paddle much less what it looked like.

I wish I had a nickel for every user that’s complained over the years that Asterisk won’t start. The last time we checked Google was showing 963,000 of them. It turns out that many of these weren’t failures with Asterisk at all but rather shortcomings in the interaction of one particular graphical user interface with MySQL. If you don’t believe it, shut down MySQL on your existing Asterisk server and then try to restart Asterisk. You’ll never see this with Incredible PBX for Asterisk-GUI. Why? Because the reliability of Asterisk isn’t tied to the reliability of MySQL, Apache, Perl, Asterisk-GUI, or any other foreign application.

**** WARNING: ERROR IN CONFIGURATION ****
astrundir in '/etc/asterisk' is set to  but the directory
does not exists. Attempting to create it with: 'mkdir -p '
mkdir: missing operand
Try 'mkdir --help' for more information.
**** ERROR: COULD NOT CREATE  ****
Attempt to execute 'mkdir -p ' failed with an exit code of 1
You must create this directory and the try again.

In the new Incredible PBX design, we haven’t forgotten about security either. In this day and age, it’s the single most important feature of any PBX that is connected to the Internet. We always recommend running your server behind a hardware-based firewall with no Internet port exposure, but we appreciate that’s not always possible particularly with Cloud-based servers. Incredible PBX is delivered with the Linux IPtables firewall preconfigured. It allows access from your server’s IP address, from the IP address used to install Incredible PBX, from private IP addresses on your local area network, and from a very limited set of trusted providers so that you can connect your trunks to make and receive phone calls. The tools to add and delete whitelist entries on your firewall are also included. In addition, we’ve included the PortKnocker utility which lets remote users with the three port knock codes gain access until their IP addresses can be whitelisted by an administrator. In addition to IPtables security, there’s another layer of protection for web-based applications. Asterisk-GUI, of course, has its own security system that’s tied to the Asterisk manager.conf setup. All of the remaining web applications require Apache authentication. For Reminders and AsteriDex, you can create multiple Apache passwords for individual users or groups of users. For administrator applications, you set an admin password that’s only known by administrators.

We couldn’t help chuckling recently when one of the security sites found a vulnerability in one of the Incredible PBX applications but noted that administrator access was required to get to the application to launch the attack. That’s akin to saying your system is vulnerable if you hand out your root user credentials AND whitelist the IP addresses of the bad guys. Literally, what was documented was true, but finding security issues in software that requires root permissions for access is getting a little desperate, wouldn’t you say? Of course, one of our "competitors" wasted little time splashing it all over their web site. The vulnerability was fixed the same day it was disclosed, by the way. And it was automatically pushed out to every Incredible PBX server, all of which run industry-standard Linux operating systems. That’s the approach to system design and support our users have come to expect. Feel free to compare it to the offerings you’ll find elsewhere, commercial or otherwise. That, my friends, is what freedom of choice is all about.

The Lean, Mean (Pure) Asterisk Machine

The roadmap for the future direction of Incredible PBX continues to evolve, but let us take a moment and share our current thinking. We’ve previously mentioned that the target audience for Incredible PBX for Asterisk-GUI is hobbyists. That’s not a dirty word in our book. Nor does it mean the platform won’t be as robust and reliable as previous releases of Incredible PBX. It just has a smaller memory footprint and much faster performance. Yes, we’re using Asterisk-GUI which Digium no longer supports. But that was a marketing decision that had nothing to do with the quality of the product. It was written by some of the best brains in the Asterisk business so we’re comfortable using it as a platform. We’ve found only two bugs in beating on the software relentlessly. Outbound Caller ID on a per extension basis can be quirky. Trunk-based CallerID whether assigned at the provider end or on Incredible PBX works just fine including CallerID spoofing where permitted by the provider. The other wrinkle was Asterisk-GUI’s failure to support the [context](+) feature of Asterisk. We’ve found an easy workaround for that one as well. We just won’t use it.

The plan is to roll this out first on the CentOS 6.5 (now 6.6) platform because we view it as the most stable. Scientific Linux 6.6 works equally well. Once we get any kinks out of the code, we’ll turn our attention to Ubuntu 14 and then on to the small hardware: Raspberry Pi, BeagleBone Black, CuBox, and PogoPlug. There’s also been interest in a more internationally-friendly version, and that’s on the drawing board as well. During the rollout, we hope to complete work on moving a few MySQL-based utilities to SQLite3. We will leave MySQL in the installation mix but will turn it off to further reduce the memory overhead of the install. We also will scale back the number of simultaneous Apache sessions running since the purpose of Apache is primarily to support administrator utilities on the server. Actually, you can run Asterisk-GUI using either the native Asterisk http server or with Apache. Thanks to Bill Simon of Simon Telephonics, you’ll have both options. With simple modifications, we think we can improve the performance on memory-constrained platforms dramatically while providing a robust, high performance platform if you have the hardware to support it. We’ve also initiated discussions with Amazon to roll out a phone service using this platform for the new Amazon Echo product. So 2015 is shaping up to be another banner year in the VoIP world. We hope you’ll come join us.

This week we continue the march. We want to review some of the open source features being incorporated into Incredible PBX from the open source code base minus some of the superfluous GUI modules. For example, you can manage blacklisting of callers using nothing more than your telephone. The same is true for SMS messaging. If you can dictate an SMS message, then why type it? Bash scripts are a well-tested feature of Incredible PBX, and you’ll still find a healthy collection of them in the /root folder of your server after you complete the install. But today’s focus is what can be accomplished with Incredible PBX using nothing more than your telephone.

Blacklisting Callers with Incredible PBX

One of our old PBX favorites dating back to the Asterisk@Home days was blacklisting. This means that old girlfriends and telemarketers get routed to Zapateller with a message that your number is not in service. By default, Incredible PBX for Asterisk-GUI will automatically blacklist incoming calls without a CallerID number. You can modify this behavior if desired:

asterisk -rx "database del blacklist blocked"

If you change your mind and want to turn anonymous call blocking back on, use this command:

asterisk -rx "database put blacklist blocked 1"

We’ve retained the same feature codes to manage blacklisting of specific numbers from any phone on your system:

  • *30 – Add a number to Blacklist
  • *31 – Remove number from Blacklist
  • *32 – Blacklist last number that called

Blacklisting was all smoke and mirrors in the old GUI days. But we want you to understand how this actually works so that you can change it if you’d like. For example, instead of the Zapateller tone, you might prefer to route callers on your blacklist to Lenny (53669 on your phone) so that you waste some of the caller’s time instead of the other way around.

In the extensions_additional.conf file, find the [app-blacklist-check] context. The last four lines in that context look like this:

;exten => s,n,Goto(DLPN_DialPlanMain,53669,1)
exten  => s,n,Zapateller()
exten  => s,n,Playback(ss-noservice)
exten  => s,n,Hangup

To route blacklisted callers to Lenny, just uncomment the top line shown and add semicolons to the next two lines:

exten  => s,n,Goto(DLPN_DialPlanMain,53669,1)
;exten => s,n,Zapateller()
;exten => s,n,Playback(ss-noservice)
exten  => s,n,Hangup

Wasn’t that easy? Now just save your changes and reload your dialplan: asterisk -rx "dialplan reload"

You may prefer to manually add numbers to your blacklist. You can do this from the Linux command prompt like this. Don’t forget the 1.

asterisk -rx "database put blacklist 8005551212 1"

From the Asterisk CLI (asterisk -rvvvvvvvvvv), do it like this:

database put blacklist 8005551212 1

To display all of your blacklist entries, try this:

database show blacklist

To remove an entry from the blacklist, use this syntax:

database del blacklist 8005551212

MP3 Voicemail Messaging for Cellphone Playback

One of the most requested features on our forums has been the ability to forward voicemails in MP3 format so that they play back correctly on cellphones and desktop mail clients. As with many of the Incredible PBX features, we wouldn’t know where to start to thank all of the folks that helped make this happen. You can review the thread on the PIAF Forum for background. This is yet another great example of how the open source community should work. Thanks to everyone that participated in bringing this development to fruition. On the new Incredible PBX for Asterisk-GUI platform it’s automatic. All you have to do is assign an email address to any voice mailbox on your server in the Users setup, and incoming voicemail messages will be delivered by email in the proper format for playback. The message thread explains how for those with an interest.

Accessing Voicemail Messages with Incredible PBX

Speaking of voicemail, we’ve tried to maintain the same feature codes that many have become accustomed to over the years. Here’s a recap of the codes in case you ever forget:

  • *98 – Check Voicemail Messages from Any Phone
  • *extension – Leave a Voicemail for Dialed Extension
  • * after voicemail connect – Access Voicemail Retrieval

Migrating the Google Speech Feature Set to Incredible PBX for Asterisk-GUI

We previously mentioned that Google Voice wasn’t around when Asterisk-GUI was developed. Not to worry. We’ve added it. And that’s just the beginning. All of the Google features that have made Incredible PBX so popular will be included in the Asterisk-GUI edition. That includes text-to-speech and speech recognition thanks to Lefteris Zafiris. It also includes SMS messaging with your same Google Voice credentials. Pick up a phone and dial S-M-S to dictate and send an SMS message to any recipient in the U.S. or Canada. Pick up a phone and dial 949 to listen to a weather forecast for any major city in the world. Just say the name of the city and state or country. Pick up a phone and dial 951 to listen to the latest News Headlines. Or dial T-O-D-A-Y to listen to Today in History. Sign up for a free Wolfram Alpha key, dial 4747, and you’ve got a voice-enabled encyclopedia at your fingertips. Eat your heart out, Siri. Our extra special thanks to Google for still supporting the open source community. Did we mention… It’s all still free.

Google has changed the rules a bit on using their speech recognition engine. So you now need an API Key to use the Speech Recognition AGI script for Asterisk. Assuming you’ll be using the functionality for “personal and development use,” here’s how to obtain your API key:

1. IMPORTANT FIRST STEP: Use an existing Google/Gmail account to join the Chrome-Dev Group.

2. Using the same account, create a new Speech Recognition Project.

3. Click on your newly created project and choose APIs & auth.

4. Turn ON Speech API by clicking on its Status button in the far right margin.

5. Click on Credentials in APIs & auth and choose Create New Key -> Server key. Leave the IP address restriction blank!

6. Write down your new API key or copy it to the clipboard.

7. Once you’ve installed Incredible PBX, log into your server as root and edit speech-recog.agi in /var/lib/asterisk/agi-bin.

8. Go to line 70 of speech-recog.agi: my $key = "". Insert your API key from Step #6 above between the quotation marks and save the file: Ctrl-X, Y, then Enter.

This will activate all of the Speech Recognition applications in Incredible PBX as described above.

Activating Wolfram Alpha with Speech Recognition in Incredible PBX

If you’re not familiar with Wolfram Alpha, it’s an encyclopedia and almanac on steroids. It’s driven by a supercomputer. There’s not much it doesn’t know. We’ve written an exhaustive article on Wolfram Alpha for Asterisk so start there. With Incredible PBX, everything is preconfigured for you. All you need to do is obtain a (free) API key.

To get started, sign up for a free Wolfram Alpha API account. Just provide your email address and set up a password. It takes less than a minute. Log into your account and click on Get An App ID. Make up a name for your application and write down (and keep secret) your APP-ID code. That’s all there is to getting set up with Wolfram Alpha. If you want to explore costs for commercial use, there are links to let you get more information.

Now you’ll need to insert your API key into /var/lib/asterisk/agi-bin/4747. The first line of the file looks like this: APPID="Wolfram-Alpha-API-Key-Goes-Here". Insert your API key between the quotation marks and save the file: Ctrl-X, Y, then Enter.

You’re ready to try out Wolfram Alpha by dialing 4-7-4-7 from any phone connected to your server. Here are some sample queries to get you started:

Weather in Charleston South Carolina
Weather forecast for Washington D.C.
Next solar eclipse
Otis Redding
Define politician
Who won the 1969 Superbowl? (Broadway Joe)
What planes are overhead? (flying over your server’s location)
Ham and cheese sandwich (nutritional information)
Holidays 2015 (summary of all holidays for 2015 with dates and DOW)
Medical University of South Carolina (history of MUSC)
Star Trek (show history, air dates, number of episodes, and more)
Apollo 11 (everything you ever wanted to know)
Cheapest Toaster (brand and price)
Battle of Gettysburg (sad day 🙂 )
Daylight Savings Time 2015 Charleston South Carolina (date ranges and how to set your clocks)
iPads by Apple (pricing, models, and specs from Best Buy)
Doughnut (you don’t wanna know)
Snickers bar (ditto)
Weather (local weather at your server’s location)

Yahoo! Weather by ZIP Code Is Moving to SQLite 3

One of the more popular features of Incredible PBX has always been the ability to retrieve a Yahoo weather forecast by dialing Z-I-P and plugging in a 5-digit ZIP code for the weather report you wished to hear. This always required a MySQL zip code database to translate the zip code into a city and state for presentation to the various weather services. As part of our move to reduce the memory footprint of Incredible PBX, we are gradually removing our dependence on MySQL. In its place we’re deploying SQLite3 databases, and Weather by ZIP Code was our first successful migration. Moving the MySQL zip code database to SQLite was a snap using a terrific open source script that we highly recommend to developers. It lets you convert any MySQL database (with indexes) to SQLite 3 in seconds. Here’s the link if you ever have the need. About 5 lines of PHP code had to be modified to complete the migration from MySQL to SQLite. Not bad. For our purposes, you’ll never know the difference when you dial in for your next weather forecast.

Originally published: Monday, December 15, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

Incredible PBX on Steroids: The Asterisk-GUI Dial Plan Basics (Chapter 2)

We’re making steady progress on the Incredible PBX for Asterisk-GUI project. If you didn’t read last week’s introductory article, start there. This week we’ve had to wrestle with one of the stark realities of taking someone else’s turnkey code and attempting to bolt on enhancements. As previously noted, Asterisk-GUI works all of its magic by manipulating Asterisk® config files directly with no outside storage of settings in either MySQL or the Asterisk DB. This is a good thing… at least until you try to add new features while leaving the basic Asterisk-GUI code intact. That was one of our primary objectives.

This is the second installment in our series. You can catch up with the Overview as well as Chapter 1 and Chapter 3 here.

Simplifying Credentials Management with Incredible PBX

Here’s the problem. We wanted to separate out the credentials for various providers so it would be easy for first-time users to set up a server without having to master Asterisk or the Asterisk-GUI. As we mentioned, this has been the number #1 complaint with the FreePBX® way of doing things. You almost needed to go back to college for another degree before you could make your first phone call. To get a functional VoIP server with one extension and one outbound trunk, it required creation of an extension, registration of a trunk with obscure settings that are different for almost every provider, creation of an inbound and outbound route with settings for how to actually route the calls in and out. And then there was configuration of some less-than-intuitive SIP settings. That’s before you ever start thinking about security and a firewall. Life’s too short!

But we encountered some stumbling blocks with Asterisk-GUI as well. It was rewriting our credentials_sip.conf file whenever Asterisk-GUI was actually used to add a new user (extension) or trunk. Worse yet, it was rewriting the entries incorrectly because the developers forgot about a special syntax in Asterisk that we’ll get to in a minute.

We first thought we could solve the rewriting of our config files by limiting write permissions on our new credentials files to the root user. Asterisk and Asterisk-GUI both run as the asterisk user so this would have been an easy fix. Well, no cigar. Asterisk-GUI outsmarted us by quietly aborting the update when it didn’t have ownership of our .conf files. This meant you never could use the Asterisk-GUI for much of anything, not exactly what we had in mind.

Lucky for us, one of the developers forgot about our favorite Linux utility, chattr. This lets you set the immutable bit to prevent all users (including root) from changing the contents of a file. Since Asterisk-GUI sometimes skips error checking after it’s sure it owns the .conf files, it was perfect. We could "hide" settings in our own credentials_sip.conf file without worrying that they’d be overwritten by Asterisk-GUI. The only trick is remembering to turn the immutable bit off when we want to make updates and, of course, turning it back on once we’re finished so that Asterisk-GUI doesn’t mangle the settings when you use Asterisk-GUI for other things. Of course, it also means you’ll need to log in as root to set up credentials for the "Incredible 9″ trunks, but that’s a walk in the park. In fact, that’s the beauty of using chattr in the first place.

For those that love to wade into the weeds of Asterisk design, there is another feature which permits storage of additional settings for any [context]. You simply create [context](+) in a separate file using the same name as the original context. When you reload Asterisk, it blends all of the entries from the two contexts. That’s exactly what we needed in order to simplify storage of credentials for providers using our own config files. Unfortunately, the Asterisk-GUI developers forgot about this syntax and removed our [context](+) entries presumably thinking they were bad code. This left the credentials themselves sitting in a config file with no context, and that wreaked all sorts of havoc in Asterisk-GUI. So now you know why we needed write protection for our credentials_sip.conf file.

Speaking of credentials, here’s how the default credentials_sip.conf file actually looks. To edit the file, you start by removing the immutable bit: chattr -i credentials_sip.conf. Never comment out the host entries or Asterisk dies! Host names may need to be changed depending upon the server on which your provider sets up your individual account. Everything else is simple enough for anyone to master without a tutorial. Plug in your ACCTNAME and ACCTPASS and uncomment the affected lines by removing the semicolons for any trunk you wish to use. Save your settings. Don’t forget to reprotect the file when you’re finished: chattr +i credentials_sip.conf. Finally, restart Asterisk: service asterisk restart. We plan to add scripts to automatically manage these trunk settings, but we wanted you to know how everything actually worked so you can do it yourself should you ever feel the urge.

[voipms](+)
; VoIP.ms trunk Prefix: Dial 9
;username = ACCTNAME
;secret = ACCTPASS
host = atlanta.voip.ms

[Vitelity](+)
; Vitelity trunk Prefix: Dial 8
;username = ACCTNAME
;secret = ACCTPASS
host = inbound1.vitelity.net

[lesnet_peer](+)
; Les.net trunk Prefix: Dial 7
;username = ACCTNAME
;secret = ACCTPASS
host = did.voip.les.net

[ipcomms](+)
; IPcomms trunk Prefix: Dial 6
;username = ACCTNUM
;fromuser = ACCTNUM
;secret = ACCTPASS
host = 2way.ipcomms.net

[didlogic](+)
; DIDlogic trunk Prefix: Dial 5
;username = ACCTNUM
;secret = ACCTPASS
host = sip.didlogic.net

[CallCentric](+)
; CallCentric trunk Prefix: Dial 4
;username = ACCTNUM
;fromuser = ACCTNUM
;authuser = ACCTNUM
;secret = ACCTPASS
host = callcentric.com

[FutureNine](+)
; FutureNine trunk Prefix: Dial 3
;username = ACCTNUM
;secret = ACCTPASS
host = incoming.future-nine.com

I hear some of you squawking, "Why do you call it ‘Incredible 9’ when there are only 7 providers?" The answer is that Google Voice is managed separately in credentials_googlevoice.conf because it operates differently in Asterisk. Anveo Direct also has a different way of handling outbound SIP calls. A PIN is required as part of the dial string. That PIN is managed separately in credentials_extensions.conf. So… 7 + 2 = 9.

Linux Application Framework for Incredible PBX

We also wanted to simplify the process of adding new Linux utilities to our Incredible PBX setup for Asterisk-GUI. You may know that Asterisk-GUI runs under a lean, mean web server that’s actually part of Asterisk. By default, it operates on port 8088. We wanted to leave it that way to simplify the procedure for compiling Asterisk to run as the asterisk user as opposed to the root user. The Asterisk web server never was intended to compete with Apache, and there is no support for PHP much less MySQL. In order to use the dozens of Incredible PBX utilities and databases as well as all of the text-to-speech and speech recognition tools, we needed Apache, PHP, and MySQL. So our design decision was to run Apache on port 80 with full PHP support and then run MySQL in the same way it has been installed on LAMP servers since Day One.

That design meant we still needed a separate web site to support Incredible PBX utilities. Luckily, our friends at Kennon Software built a beautiful user interface for PBX in a Flash many years ago. With some minor tweaking to account for newer releases of PHP, it was a perfect fit for Incredible PBX as you can see at the top of this article. It has all the things we were looking for including an RSS Feed to provide emergency announcements. It also provides developers unlimited flexibility to add local applications and make other modifications as desired for both end-users and administrators. So our tip of the hat again goes to Kennon Software for their terrific open source contribution to our projects.

Choosing a Linux Platform for Incredible PBX

Speaking of Linux, we’re often asked what’s the best Linux platform on which to run Incredible PBX. Our stock answer is ALL OF THE ABOVE. Incredible PBX has been and is being engineered to run well on almost any Linux platform. We plan to initially release Incredible PBX for Asterisk-GUI on the CentOS/Scientific Linux 6.5 platform, but we’ll add Ubuntu 14.04 and Debian in coming weeks. In this way, we can support all of our favorite low-cost hardware platforms including the Raspberry Pi, BeagleBone Black, CuBox, PogoPlug, and anything else we can get our hands on.

Adding Inbound & Outbound Dialplan Code to Incredible PBX

This week we also tackled some of the other items on the Wish List. We’ve heard from a number of folks that wanted a simple way to add customized dialplan code whenever a call was made or received. That was an easy one. In extensions_custom.conf, you’ll now find the following contexts which can be enhanced in any way you choose. Just plug your additional code into each context between the two default entries.

[incoming-sub]
exten => incoming-sub_1,1,Noop(*** Incoming: ${CALLERID(all)} on ${CHANNEL} ***)
exten => incoming-sub_1,n,Return()

[outgoing-sub]
exten => outgoing-sub_1,1,Noop(*** Calling: ${CALLERID(dnid)} from ${CALLERID(all)} ***)
exten => outgoing-sub_1,n,Return()

Managing Incoming Calls to "Incredible 9″ Trunks

We haven’t (yet) come up with a really simple way to adjust how inbound calls to our preconfigured trunks are processed because of the basic Asterisk-GUI design. In a nutshell, incoming calls come into your PBX on a phone number, aka DID. That DID is associated with a trunk that you’ve registered to a specific provider. Once the call hits Incredible PBX, we need to tell the PBX where to route the call. Typical choices include an extension, a group of extensions (i.e. a ring group), an IVR, or an AutoAttendant. There are others. In extensions.conf, you will find the dialplan code to manage incoming calls to the "Incredible 9″ trunks. The setup for each of the 9 trunks looks like this:

[DID_Vitelity]
include = DID_Vitelity_default
[DID_Vitelity_default]
exten = _.,1,Set(CALLERID(name)=${CALLERID(number)})
exten = _.,n,Set(CALLERID(number)=${CALLERID(number):0:10})
exten = _.,n,Gosub(cidlookup,cidlookup_1,1())
exten = _.,n,ExecIf($[ "${CALLERID(name)}" = "" ] ?Set(CALLERID(name)=${CALLERID(num)}))
exten = _.,n,Gosub(incoming-sub,incoming-sub_1,1())
;exten = _.,n,Goto(default,6001,1)
;exten = _.,n,Goto(ringroups-custom-1,s,1)
;exten = _.,n,Goto(voicemenu-custom-2,s,1)
exten = _.,n,Goto(voicemenu-custom-1,s,1)
[CallingRule_OutVitelity]
exten = _8NXXNXXXXXX,1,Macro(trunkdial-failover-0.4,${Vitelity}/${EXTEN:1},,Vitelity,)
exten = _81NXXNXXXXXX,1,Macro(trunkdial-failover-0.4,${Vitelity}/${EXTEN:2},,Vitelity,)

In the Asterisk-GUI world, a [DID_provider] context manages incoming calls FROM a provider’s DID or trunk. And a [CallingRule_provider] context manages outbound calls TO your provider’s trunk. In the default Vitelity setup, incoming Vitelity calls get routed to voicemenu-custom-1, and outbound calls with an 8 prefix get routed out through your Vitelity trunk. As noted, all of these contexts can be found in extensions.conf.

Toward the end of the default context you will see two voicemenu-custom entries as well as a ringroups-custom-1 entry and a default entry with an extension number. All but one of these is commented out. As you have probably guessed, the uncommented entry determines where the incoming call is routed. When you create IVRs or ring groups in Asterisk-GUI, each new creation gets assigned a sequential number starting with 1. ringroups-custom-1 is a preconfigured Ring Group that currently sends calls to extensions 6001 and 6002, the two extensions created in the Incredible PBX default setup. If you add additional extensions and then add those new numbers to this preconfigured ring group, then those phones will ring as well. It does NOT change the sequential number originally assigned to this ring group. Adding a new ring group does that.

In Asterisk-GUI, IVRs and AutoAttendants are called Voice Menus. Incredible PBX ships with two. Voice Menu #1 is the Nerd Vittles’ Stealth AutoAttendant. It greets the caller with a cheery message from Allison while providing a couple seconds for someone (like you) to press a button to reroute the call to an undisclosed destination. If no key is pressed, the incoming call is routed to Ring Group #1.

Voice Menu #2 is a Demo IVR that showcases many of the Nerd Vittles applications. By default, all "Incredible 9″ trunks are configured to route incoming callers through the Stealth AutoAttendant to Ring Group #1. If you’d prefer to route incoming calls to a ring group or a particular extension or the demo IVR, the commented out entries will let you do that.

But suppose you wanted to route an incoming call to a custom extension defined in extensions_custom.conf? Well, it’s easy. Just change the context to CallingRule_extensions_custom and route the call to line 1 of the extension context desired. For example, to send an incoming call to the AsteriDex Voice Dialer (411) which lets callers say the name of the party they wish to reach, you’d insert a call destination entry that looked like this:

exten = _.,n,Goto(CallingRule_extensions_custom,411,1)

Better yet, you can use the generic dialplan context, DLPN_DialPlanMain, to reach any extension on your server:

exten = _.,n,Goto(DLPN_DialPlanMain,411,1)

As you add new ring groups, extensions, and voice menus with Asterisk-GUI, you can adjust these settings accordingly now that you know how all of this works. After making changes in extensions.conf, be sure you’ve only enabled ONE destination per trunk by commenting out the rest of them. Then reload your dialplan: asterisk -rx "dialplan reload"

Free Worldwide Calling Support with Incredible PBX

We mentioned last week that iNum support will be included through two SIP providers to let you make free phone calls worldwide to anyone with a registered iNum. SIP URIs are equally important for the same reason. You can make a free call to anyone, anywhere in the world if the recipient happens to have a SIP URI, and sip2sip.info will provide a free one to anybody. To support SIP URIs, Incredible PBX for Asterisk-GUI includes a new context that will let you link a SIP URI to an extension on your PBX. We’ve included an entry for L-E-N-N-Y to get you started. You can add as many more as you like:

[CallingRule_SIP_URI]
exten = 53669,1,Dial(SIP/2233435945@sip2sip.info)

CallerID Name Lookups with Incredible PBX

On the CallerID Name front, we’re still exploring alternatives including incorporation of CallerID Superfecta which originally was a Nerd Vittles creation. It now is maintained by the POSSA Development Team. In the interim, we’ve provided code for one of the best CNAM sources in the business, OpenCNAM. It gets you 10 free lookups an hour from cached entries. If you need more, you can sign up for an account. For completed calls, there is a charge of $.004. Just adjust the CURL entry below to plug in your credentials:

[cidlookup]
exten => cidlookup_1,1,Set(CURLOPT(httptimeout)=7)
exten => cidlookup_1,n,Set(CALLERID(name)=${CURL(https://account_sid:auth_token@api.opencnam.com/v2/phone/${CALLERID(num)}?format=pbx&ref=incrediblepbx)})
exten => cidlookup_1,n,Set(current_hour=${STRFTIME(,,%Y-%m-%d %H)})
exten => cidlookup_1,n,Set(last_query_hour=${DB(cidlookup/opencnam_last_query_hour)})
exten => cidlookup_1,n,Set(total_hourly_queries=${DB(cidlookup/opencnam_total_hourly_queries)})
exten => cidlookup_1,n,ExecIf($["${last_query_hour}" != "${current_hour}"]?Set(DB(cidlookup/opencnam_total_hourly_queries)=0))
exten => cidlookup_1,n,ExecIf($["${total_hourly_queries}" = ""]?Set(DB(cidlookup/opencnam_total_hourly_queries)=0))
exten => cidlookup_1,n,Set(DB(cidlookup/opencnam_total_hourly_queries)=${MATH(${DB(cidlookup/opencnam_total_hourly_queries)}+1,i)})
exten => cidlookup_1,n,ExecIf($[${DB(cidlookup/opencnam_total_hourly_queries)} >= 60]?System(${ASTVARLIBDIR}/bin/opencnam-alert.php))
exten => cidlookup_1,n,Set(DB(cidlookup/opencnam_last_query_hour)=${current_hour})
exten => cidlookup_1,n,Return()
exten => cidlookup_return,1,ExecIf($["${DB(cidname/${CALLERID(num)})}" != ""]?Set(CALLERID(name)=${DB(cidname/${CALLERID(num)})}))
exten => cidlookup_return,n,Return()
;--== end of [cidlookup] ==--;;end of Incredible PBX original build file

Managing Outbound CallerID & PINs with Incredible PBX

There appear to be a few leftover CallerID bugs in the original Asterisk-GUI code. As a workaround, we’ve added support for setting CallerID numbers in credentials_extensions.conf. This lets you set outbound CallerID numbers on a per trunk basis for providers that allow spoofing of CallerID numbers.

Here’s what the complete credentials_extension.conf file actually looks like. The AnveoPIN is the code used to authorize outbound calls through Anveo Direct. Anveo handles outbound calling differently than most providers so the setting had to go here instead of in the more traditional credentials_sip.conf file. Sorry. The other entries are self-explanatory. This config file can be edited using your favorite text editor. Then service asterisk restart and you’re done.

AnveoPIN = 024680
; Conference Bridge PINs
CONF_USER_PIN = 1234
CONF_ADMIN_PIN = 4321
; DISA password
DISA_PW = 9876
; CallerID numbers
CID_allroutes = 8005551212
CID_CallCentric = 8005551212
CID_ipcomms = 8005551212
CID_voipms = 8005551212
CID_anveodirect = 8005551212

Outbound Call Processing with Incredible PBX

With apologies to our international friends, we’ve included a template to handle processing of all outbound U.S. calls using the "Incredible 9″ trunks. Basically, you can dial a 10-digit number or 1+ the 10-digit number, and the [outbound-allroutes] context will walk the call through all of the trunks for which you’ve registered including Google Voice. If a trunk isn’t registered, it’s skipped. The arrangement of the trunks can be adjusted to meet your own needs. As delivered, calls are processed in the following order: Google Voice, VoIP.ms, Vitelity, les.net, IPcomms, DIDlogic, CallCentric, FutureNine, and Anveo Direct. You obviously can add as many additional providers as desired or rearrange the ones that already are included. And international calling can be added easily using the existing entries as a model. Cut-and-paste is your friend!

[outbound-allroutes]
exten => _NXXNXXXXXX,1,Set(CALLERID(num)=${CID_allroutes})
exten => _NXXNXXXXXX,n,Dial(Motif/GoogleVoice/1${EXTEN}@voice.google.com)
exten => _NXXNXXXXXX,n,Dial(${voipms}/${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${Vitelity}/${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${lesnet_peer}/1${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${ipcomms}/${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${didlogic}/1${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${CallCentric}/1${EXTEN})
exten => _NXXNXXXXXX,n,Dial(${FutureNine}/1${EXTEN})
exten => _NXXNXXXXXX,n,Dial(SIP/${AnveoPIN}1${EXTEN}@sbc.anveo.com)
exten => _NXXNXXXXXX,n,Hangup
exten => _1NXXNXXXXXX,1,Set(CALLERID(num)=${CID_allroutes})
exten => _1NXXNXXXXXX,n,Dial(Motif/GoogleVoice/${EXTEN}@voice.google.com)
exten => _1NXXNXXXXXX,n,Dial(${voipms}/${EXTEN:1})
exten => _1NXXNXXXXXX,n,Dial(${Vitelity}/${EXTEN:1})
exten => _1NXXNXXXXXX,n,Dial(${lesnet_peer}/${EXTEN})
exten => _1NXXNXXXXXX,n,Dial(${ipcomms}/${EXTEN:1})
exten => _1NXXNXXXXXX,n,Dial(${didlogic}/${EXTEN})
exten => _1NXXNXXXXXX,n,Dial(${CallCentric}/${EXTEN})
exten => _1NXXNXXXXXX,n,Dial(${FutureNine}/${EXTEN})
exten => _1NXXNXXXXXX,n,Dial(SIP/${AnveoPIN}${EXTEN}@sbc.anveo.com)
exten => _1NXXNXXXXXX,n,Hangup

DISA Support for Incredible PBX

Unless we missed it, Asterisk-GUI was missing DISA support, the ability to call your PBX and receive dialtone to make an outbound call through the PBX. Because of costs associated with outbound calls, this can make a real difference in some countries. We’ve added DISA support through the D-I-S-A (3472) extension. The DISA password can be set in credentials_extensions.conf. The DISA extension can be added to an IVR for one or more trunks to provide password-protected DISA call access to incoming callers. The dialplan code can be adjusted to meet your own requirements. As delivered, only 10-digit calls are permitted. Just change the 10 on line 10 if you want to enable international dialing. Calls are limited to 150 minutes by default. Just change the 9000 (seconds) entry as desired.

[custom-disa]
exten => s,1,Answer
exten => s,n,Wait(1)
exten => s,n,Set(TIMEOUT(digit)=7)
exten => s,n,Set(TIMEOUT(response)=10)
exten => s,n,Background(enter-password)
exten => s,n,Read(MYCODE,beep,7)
exten => s,n,Noop(DISA_PW: ${DISA_PW})
exten => s,n,GotoIf($["${MYCODE}" = "${DISA_PW}"]?disago:bad,1)
exten => s,n(disago),Set(TIMEOUT(absolute)=9000)
exten => s,n,Read(NUM2CALL,pls-entr-num-uwish2-call,10)
exten => s,n,Background(calling)
exten => s,n,SayDigits("${NUM2CALL}")
exten => s,n,Goto(outbound-allroutes,${NUM2CALL},1)
exten => s,n,Hangup
exten => t,1,Hangup
exten => i,1,Hangup
exten => h,1,Hangup
exten => bad,1,Hangup

Call Forwarding Support with Incredible PBX

We have restored the call forwarding functionality that originally was missing in Asterisk-GUI. The same feature codes found in FreePBX are supported. By dialing *72, you can set forwarding for any extension to either a local number or any other number supported by your dial plan. By dialing *72NXXNXXXXXX or *726XXX (local extensions typically are in the 6000-6299 range with Asterisk-GUI), you can set call forwarding in a single step. *73 can be used to disable call forwarding for the extension from which you dialed, or *74 can be used to disable call forwarding for any extension on your server. A list of currently forwarded extensions can be retrieved using the Asterisk CLI: asterisk -rx "database show CF"

Conference Bridge Support in Incredible PBX

As previously mentioned, Conference Bridge support wasn’t available when Asterisk-GUI was released so we’ve added it. Just dial C-O-N-F (2663) to join the conference bridge. User and admin PINs are set in the credentials_extensions.conf file. You can create as many of these as you need by cloning the code below with different extension numbers:

[conf_bridge]
exten => 2663,1,Macro(user-callerid,)
exten => 2663,n,Set(MEETME_ROOMNUM=2663)
exten => 2663,n,Set(MAX_PARTICIPANTS=0)
exten => 2663,n,Set(MEETME_MUSIC=default)
exten => 2663,n,GotoIf($["${DIALSTATUS}" = "ANSWER"]?READTHEPIN)
exten => 2663,n,Answer
exten => 2663,n,Wait(1)
exten => 2663,n,Set(PINTRIES=0)
exten => 2663,n,Noop(${CONF_USER_PIN})
exten => 2663,n(READTHEPIN),Read(PIN,enter-conf-pin-number,,,,)
exten => 2663,n,GotoIf($[${PIN} = ${CONF_USER_PIN}]?ENDUSER)
exten => 2663,n,GotoIf($[${PIN} = ${CONF_ADMIN_PIN}]?ADMINISTRATOR)
exten => 2663,n,Set(PINTRIES=$[${PINTRIES}+1])
exten => 2663,n,GotoIf($[${PINTRIES}>3]?h,1)
exten => 2663,n,Playback(conf-invalidpin)
exten => 2663,n,Goto(READTHEPIN)
exten => 2663,n(ADMINISTRATOR),Set(CONFBRIDGE(user,admin)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,marked)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,dsp_drop_silence)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,talk_detection_events)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,announce_user_count)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,announce_join_leave)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,music_on_hold_when_empty)=yes)
exten => 2663,n,Goto(ext-meetme,STARTMEETME,1)
exten => 2663,n(ENDUSER),Noop(User Options:)
exten => 2663,n,Set(CONFBRIDGE(user,dsp_drop_silence)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,talk_detection_events)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,announce_user_count)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,announce_join_leave)=yes)
exten => 2663,n,Set(CONFBRIDGE(user,music_on_hold_when_empty)=yes)
exten => 2663,n,Goto(ext-meetme,STARTMEETME,1)
exten => 2663,hint,confbridge:2663

Google Voice Support in Incredible PBX

Google Voice is another little goodie that wasn’t available when Asterisk-GUI came along. Because we’re now running everything on the Asterisk 11 platform, it seemed silly not to include Google Voice support. And we’ve made it about as easy to set up as tying your shoes. Plug in your Google email address and password using the new web interface, and you’re done. By default, all 10-digit and 11-digit outbound calls are first attempted through your Google Voice trunk. You can’t beat free!

If you’ve used the same account elsewhere, Google may block access from your new IP address. In this case, just follow the steps outlined in this Google Reset Procedure to get things going.

Managing Call Detail Records (CDR) in Incredible PBX

The gorgeous CDR Viewer found under the Options -> Advanced Options -> Enable tab in Asterisk-GUI is incredibly flexible. In addition to being lightening fast, you can reorder the CDR listing by simply clicking on any column heading. Clicking twice will sort the list in the opposite order. You also can expand the detail in two ways. Either click on an individual entry (as shown) to display the complete CDR entry or check the Show All Fields checkbox to get the full picture for every CDR entry. The complete CDR database in CSV format can be retrieved from /var/log/asterisk/cdr-csv/Master.csv.

Getting Up to Speed on Asterisk-GUI Basics

We’ve covered a lot of territory this week. You don’t have to master it all at once. Incredible PBX is being engineered to give you the best of both worlds rather than one size fits all. By setting things up this way, you can add your own features and share them with the community as you move up the learning curve. That’s what open source is all about!

The other goal was to leave Asterisk-GUI intact to the greatest extent possible. This has several advantages. First, for previous users of Asterisk-GUI, they’ll feel right at home. Second, we don’t have to write extensive documentation for Asterisk-GUI because many others have already done the heavy lifting. One obvious word of caution. Don’t delete, rename, or otherwise modify the default trunks, users, calling rules, ring groups, and dialplans that already have been created to support Incredible PBX. If you do, you will break things. But feel free to add as many new pieces to your setup as desired and, of course, the extension passwords can be changed in any way you like. Trunk credentials for the "Incredible 9″ preconfigured trunks should be managed using the credentials files documented above.

Here are a few resources that will guide you through mastering the Asterisk-GUI:

Remember the Objective of Incredible PBX for Asterisk-GUI

We’ll close for today by reiterating why we’re introducing a new VoIP alternative with Incredible PBX for Asterisk-GUI. From the ground up, this project is designed as an open source, hobbyist platform so that you can actually LEARN how Asterisk works and become self-sufficient in designing AND managing your own VoIP communications platform. Is it "Pure GUI"? Nope. Here’s why. One of the major reasons that so many folks have had their VoIP systems hacked over the past few years is because those users never quite understood how their "Pure GUI" stuff was working (or not) under the hood.

Does "hobbyist platform" mean it’s a Crappy Purple Scion? Nope. In fact, the Asterisk-GUI tools and Asterisk code in Incredible PBX were designed and written by some of the best Asterisk experts in the business including Mark Spencer, the creator of Asterisk. When the nay-sayers snicker at your "hobbyist platform," just smile and enjoy your independence. 🙂

Originally published: Monday, December 8, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

Incredible PBX on Steroids: The Asterisk-GUI Pilgrimage Begins (Chapter 1)

As the holiday season gets underway with Thanksgiving, Hanukkah, Christmas, and especially Festivus, we thought it might be interesting to actually provide a running dialog of how a new Asterisk® project is born and what hurdles and solutions are encountered along the way. We mentioned last week that we were dusting off Mark Spencer’s Asterisk-GUI with hopes of transforming it into an updated Asterisk 11 platform for hobbyists and SOHO telephony users with many of the ease-of-use touches that have made Incredible PBX a big hit. So today we officially kick off the adventure with a look back at Week One. Our target, by the way, is a New Year’s Day release to celebrate the arrival of 2015.

This is the first installment in our series. You can catch up with the Overview as well as Chapter 2 and Chapter 3 here.

Project Development Roadmap

You may be asking, "What’s in it for me?" Well, lots! One of the unfortunate side effects of having always relied upon the FreePBX® GUI for Asterisk administration is you never really learned how Asterisk works. Nor did we ever quite appreciate its lightning-fast performance. We’re as guilty as anyone for over-reliance on a design tool without much appreciation for its interaction with the actual communications server. And, like many things in life, you form some bad habits along the way that are hard to break. Don’t get us wrong. There are thousands of things to like about FreePBX and, for production-level servers hosting dozens or hundreds of users, it remains a very comfortable choice and our hands-down favorite.

We resolved early on to approach the Asterisk-GUI remake a little differently. We plan to actually document why we’re going down certain paths and what the benefits will be for the ultimate user. There won’t be any convoluted code to deter your learning how things actually work. And there won’t be any patent, trademark, or copyright gotchas to hinder your forking or repurposing our code to meet your own requirements. And, finally, there won’t be any license fees, hidden or otherwise. Just comply with the GPL2 license as written and be our guest! From our vantage point, that’s what open source is all about.

Defining Project Objectives

We began the week by sketching out some objectives as well as defining some likes and dislikes. As we mentioned last week, the objective is not to replace FreePBX for those that actually need that horsepower. First and foremost we want to design this product for the target audience: hobbyists, home users, and SOHO businesses. Many of the platforms we are targeting have limited memory and only modest computational ability. Many of the people in the target audience have never used a PBX before and know little to nothing about networks and security. We don’t want anyone blindsided by a $100,000 phone bill because they didn’t know how to implement a firewall so we’ll include a preconfigured one as part of the install. And, like all Incredible PBX systems, an automatic update utility will be included to keep your system current AND safe!

Second, we wanted a product that was incredibly simple to put into production. Ease of configuration was a definite must-have. With many GUIs (think: Microsoft Windows), developers get so enamored with the brilliance of their own creation that they lose sight of the fact that typing a short list of usernames and passwords often is much simpler than navigating through dozens of data entry screens with hundreds of mouse clicks to enter the same information.

We also are steering clear of reinventing the proverbial wheel. Mark Spencer and his colleagues are some of the most talented programmers on the planet. To the extent that the original, feature-rich Asterisk-GUI creation can be implemented without major plumbing changes, that is not only desirable but absolutely essential in bringing this new product to market within weeks, not months or years.

Keep in mind that both FreePBX and Asterisk-GUI are code generators for Asterisk. No call is actually processed by FreePBX or Asterisk-GUI. From a system design standpoint, we wanted Asterisk to be self-sufficient on this new Incredible PBX platform. Stated another way, we didn’t want Asterisk to fail just because Apache or MySQL had system failures since neither of them is required for Asterisk to function reliably in the first place. It’s one thing for your GUI or MySQL database to be inoperable. It’s quite another when it also brings down your entire phone system.

In summary, we are lifelong believers in the KISS principle. Keep It Simple, Stupid. As much as we love FreePBX, its system design is anything but simple. Configuration information is embedded in hundreds of HTML files, Linux templates, Asterisk configuration files including AstDB plus 100+ MySQL tables. By contrast, Asterisk-GUI uses a tiny collection of native Asterisk .conf files to configure virtually all its settings. We wanted to preserve that "pure Asterisk" simplicity.

One of the other real advantages of the Asterisk-GUI design is you can create something in the GUI and then review the Asterisk-generated code in /etc/asterisk to see exactly how the original Asterisk developers intended the feature to work. In addition to the learning experience, it makes it easy to debug coding errors and to make adjustments and customizations to meet individual needs without inadvertently bringing down the whole house of cards.

We wanted a product that was easy for an administrator to maintain, to update, AND to back up. After all, this is a phone system not a rocketship. It shouldn’t take a rocket scientist to maintain it. And it won’t.

Project Design 101: Preconfigured Trunks, Extensions & Routes

With these objectives in mind, we’ve made some design choices on the front end that are worth mentioning. Configuration settings for SIP, IAX, and Google Voice trunks give new users more headaches than any other single feature in a new PBX. So we’re taking much of the pain out of that process by providing 9 preconfigured trunks. Meet the Incredible 9: Google Voice, Vitelity, VoIP.ms, Les.net, IPcomms, DIDlogic, CallCentric, FutureNine, and Anveo Direct. Outbound calling is managed by routes that are tied to individual extensions. These can be adjusted quickly in the GUI. We’ve chosen to set up outbound calling for the Incredible 9 using preconfigured dialing prefixes. No prefix or a 1-prefix sends the call out through Google Voice and, if Google Voice isn’t available, then the call is routed through the next working outbound trunk in the order shown above. A prefix of 2-9 sends the call out through one of the preconfigured trunks. We’ve also included support for free worldwide iNum calling using either VoIP.ms or CallCentric. Both vendors will also provide you with a free iNum DID. Just dial your iNum prefix of 0 (CallCentric) or 90 (VoIP.ms) followed by the last 7 digits of any assigned iNum DID to place a free call. As usual, Lenny stands ready to provide 24/7 technical support through his iNum DID: And, of course, all of these settings can be modified or tweaked to your liking using Asterisk-GUI!

A word about the "Incredible 9″ providers. The major prerequisite for inclusion was communications compatibility with Asterisk without any firewall exposure of Asterisk ports. That means the provider had to support outbound and/or inbound calling without any port exposure of Asterisk to the Internet. Vitelity and Google have been major financial supporters of our projects over the years so they made the short list. Both also offer incredible pricing and feature-rich VoIP implementations. The others made the cut based upon great user satisfaction reports, free services of one type or another, or dirt cheap pricing. Can you add additional providers using Asterisk-GUI? Absolutely. But the "Incredible 9″ each can be activated in under 10 seconds after you’ve signed up for an account with your choice of providers. In the VoIP world, there’s little reason not to choose several since you only pay for the services you actually use, and we would encourage you to do so.

Incoming call processing also is preconfigured with some extensions, a ring group, a Stealth AutoAttendant, DISA, and an IVR with an assortment of Incredible PBX applications for Asterisk. All can be modified or embellished to meet your own requirements.

Bottom Line: You get a turnkey PBX that’s ready to go. It’s also easily configurable to meet your most demanding requirements. Incredible PBX delivers The Best of Both Worlds using native Asterisk code.

A Fresh Look at Managing Credentials

One of the more exasperating realities of password management with FreePBX is the number of places you have to look to find or change passwords. Some are stored in various Asterisk .conf files. Voicemail passwords are hidden away in text strings in voicemail.conf. Others are stored in MySQL tables. Some are encrypted, and some aren’t. Asterisk-GUI took a different approach and stores all passwords in the Asterisk .conf files in /etc/asterisk.

As talented as the FreePBX and Asterisk-GUI programmers are, we don’t trust any web-based application to remain secure if it’s directly exposed to the Internet. If you do, you’re either nuts or have plenty of money to burn. GUIs should be reserved for administrator use behind a secure firewall, period. In our new design, you need firewall whitelist privileges plus root or asterisk user privileges plus GUI admin user access to gain access to passwords. If all of these layers are compromised, passwords are the least of your worries.

We’ve taken password management one step further. As best we can given the design choices in Asterisk 11 and Asterisk-GUI, we’ve aggregated as many passwords as possible into new credentials config files: credentials-sip.conf, credentials-googlevoice.conf, and credentials-extensions.conf. There’s one for the "Incredible 9″ SIP providers. There’s one for Google Voice. And there’s a catchall for various passwords, PINs, and predefined CallerID numbers for various trunks. These are straight-forward text files that can be quickly edited using any text editor. Plug in your account names, passwords, and PINs. Optionally, adjust the providers’ server addresses as required. And you’re done. If you can tie your shoes, you can do this. Quick and functional, not fancy!

Redesigned Conferencing Solution for Asterisk 11

MeetMe conferencing as originally implemented in Asterisk-GUI required an external timing source. This timing source was provided by analog boards on some of the commercial hardware platforms on which Asterisk-GUI was deployed. For our target audience, we’re assuming that most people probably want to ditch Ma Bell and costly landlines as part of the migration to a new PBX platform. So, even though Asterisk-GUI still supports analog trunks, we have chosen to offer the Asterisk 11 Conference Bridge option which does not require an external timing source. The new Conference Bridge is preconfigured out of the box. Set up user and admin PINs. And you’re done. Dial C-O-N-F (3663) to join the conference.

The Baker’s Dozen Incredible PBX Apps: Alive and Well

We closed out Week One with some minor tweaking of several of our favorite Incredible PBX applications to accommodate the new Asterisk-GUI platform. We’re pleased to report that everything still works. Because of changes imposed by Google, you’ll need to jump through a few hoops to implement Speech Recognition support on this new Asterisk platform. All of the necessary software has already been put in place so all you need is an API key from Google. Once you obtain it, simply plug it into line 70 of speech-recog.agi. No other configuration is required. The affected applications are marked with an asterisk (*) below. But the good news is, if you’ve used these Nerd Vittles applications in the past, you’ll feel right at home.

Stay tuned for more and… HAPPY THANKSGIVING!

Continue reading Chapter 2

Originally published: Monday, November 24, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

Midnight Madness: Introducing Incredible PBX 12 with Asterisk 12 and FreePBX

[iframe-popup id="4″]
The number "12″ always has held mystical prominence in our culture and so it is with Asterisk®. Just over 12 months ago, Digium first introduced Asterisk 12 at AstriCon in Atlanta and heralded a major change in the direction of the product. It was more than a wholesale revamping of the Asterisk feature set. There was a revolutionary new development methodology thanks to the untiring efforts of Matt Jordan and his incredibly talented development team. Unlike Asterisk releases of old, there were no serious breakages in existing applications and, where there were changes, they were carefully documented for all the world to see. Thank you, Matt & Co.

The release of Asterisk 12 also set in motion the development of FreePBX® 12 by the equally talented FreePBX Dev Team. What began as an effort simply to integrate all of the new components in Asterisk 12 quickly evolved into a major rewrite of the graphical user interface for Asterisk, no small feat given its history of starts and stops spanning nearly a decade of development. Just last week, FreePBX 12 was pronounced stable and production ready. If you thought Asterisk 12 was revolutionary, just wait until you try FreePBX 12. Simply amazing work by the FreePBX Development Team. Thank you.

While PBX in a Flash has offered a preview edition of Asterisk 12 and FreePBX 12 for quite a while, we’ve held off releasing the stand-alone Incredible PBX 12 for a number of reasons. First and foremost, we wanted Incredible PBX 12 to remain pure open source to point the way for others that want to enhance Asterisk 12 and FreePBX 12. Second, there were more than a few rough edges with both products that simply needed some time to evolve. The one year anniversary of Asterisk 12 and the stable release of FreePBX 12 seemed a fitting occasion to add our turnkey implementation of Incredible PBX to the mix.

The real beauty of Incredible PBX: there is no smoke and there are no mirrors. What you see is what you get. You begin with a base install of the Linux operating system. And then the open source Incredible PBX installer adds all of the pieces to integrate air-tight security with Asterisk 12, FreePBX 12, text-to-speech technology and dozens of applications for Asterisk into a seamless platform for either experimentation or production use. You can review the source code and embellish it as you see fit! Protecting your deployment is the IPtables firewall with a WhiteList for authorized user access coupled with Fail2Ban to monitor access attempts. This isn’t merely a security toolkit. Your server is actually locked down from the moment you complete the Incredible PBX install. Authorizing additional users is accomplished using simple administrator scripts. Or end-users can employ PortKnocker and Travelin’ Man 4 to simplify remote access. Automatic updates for security fixes and enhancements are an integral component of Incredible PBX. If the security alerts of the past month haven’t convinced you that updates are critically important, you probably should stop hosting your own PBX. Backups and restores also are simple. And the complete open source feature set of both Asterisk and FreePBX is activated to facilitate your development efforts. In short, you gain nothing by installing the individual components yourself, and you may lose a lot. With Incredible PBX, the heavy lifting has all been done for you with documented, open source code that makes it simple to add your own tweaks as desired. That’s what open source is all about!

We’ve chosen Ubuntu 14.04 as the platform on which to begin the Incredible PBX 12 adventure. More releases will follow in due course. But Ubuntu 14.04 is an extremely stable and well-supported LTS release of Linux that warrants a careful look. After all, the primary objective here is a stable telephony platform. The Ubuntu 14.04 LTS platform offers that in spades.

Building an Ubuntu 14.04 Platform for Incredible PBX 12

As a result of the trademark and copyright morass, we’ve steered away from the bundled operating system in favor of a methodology that relies upon you to put in place the operating system platform on which to run PBX in a Flash or Incredible PBX. The good news is it’s easy! With many cloud-based providers1, you can simply click a button to choose your favorite OS flavor and within minutes, you’re ready to go. With many virtual machine platforms such as VirtualBox, it’s equally simple to find a pre-built Ubuntu 14.04 image or roll your own.

If you’re new to VoIP or to Nerd Vittles, here’s our best piece of advice. Don’t take our word for anything! Try it for yourself in the Cloud! You can build an Ubuntu 14.04 image on Digital Ocean in under one minute and install Incredible PBX 12 for Ubuntu 14.04 in under 30 minutes. Then try it out for two full months. It won’t cost you a dime. Use our referral link to sign up for an account. Enter a valid credit card to verify you’re who you say you are. Create an Ubuntu 14.04 (not 14.10!) 512MB droplet of the cheapest flavor ($5/mo.). Go to the Billing section of the site, and enter the following promo code: UBUNTUDROPLET. That’s all there is to it. A $10 credit will be added to your account, and you can play to your heart’s content. Delete droplets, add droplets, and enjoy the free ride!

For today, we’ll walk you through building your own stand-alone server using the Ubuntu 14.04 mini.iso. If you’re using Digital Ocean in the Cloud, skip down to Installing Incredible PBX 12. If you’re using your own hardware, to get started, download the 32-bit or 64-bit Ubuntu 14.04 "Trusty Tahr" Minimal ISO from here. Then burn it to a CD/DVD or thumb drive and boot your dedicated server from the image. Remember, you’ll be reformatting the drive in your server so pick a machine you don’t need for other purposes.

For those that would prefer to build your Ubuntu 14.04 Wonder Machine using VirtualBox on any Windows, Mac, or existing Linux Desktop, here are the simple steps. Create a new virtual machine specifying either the 32-bit or 64-bit version of Ubuntu. Allocate 1024MB of RAM (512MB also works fine!) and at least 20GB of disk space using the default hard drive setup in all three steps. In Settings, click System and check Enable I/O APIC and uncheck Hardware Clock in UTC Time. Click Audio and Specify then Enable your sound card. Click Network and Enable Network Adapter for Adapter 1 and choose Bridged Adapter. Finally, in Storage, add the Ubuntu 14.04 mini.iso to your VirtualBox Storage Tree as shown below. Then click OK and start up your new virtual machine. Simple!

Here are the steps to get Ubuntu 14.04 humming on your new server or virtual machine once you’ve booted up. If you can bake cookies from a recipe, you can do this:

UBUNTU mini.iso install:
Choose language
Choose timezone
Detect keyboard
Hostname: incrediblepbx < continue >
Choose mirror for downloads
Confirm archive mirror
Leave proxy blank unless you need it
< continue >
** couple minutes of whirring as initial components are loaded **
New user name: incredible
< continue >
Account username: incredible
< continue >
Account password: makeitsecure
< continue >
Encrypt home directory < no >
Confirm time zone < yes >
Partition disks: Guided - use entire disk and set up LVM
Confirm disk to partition
Write changes to disks and configure LVM
Whole volume? < continue>
Write changes to disks < yes> < -- last chance to preserve your disk drive!
** about 15 minutes of whirring during base system install ** < no touchy anything>
** another 5 minutes of whirring during base software install ** < no touchy anything>
Upgrades? Install security updates automatically
** another 5 minutes of whirring during more software installs ** < no touchy anything>
Software selection: *Basic Ubuntu server (only!)
** another couple minutes of whirring during software installs ** < no touchy anything>
Grub boot loader: < yes>
UTC for system clock: < no>
Installation complete: < continue> after removing installation media
** on VirtualBox, PowerOff after reboot and remove [-] mini.iso from Storage Tree & restart VM
login as user: incredible
** enter user incredible's password **
sudo passwd
** enter incredible password again and then create secure root user password **
su root
** enter root password **
apt-get update
apt-get install ssh -y
sed -i 's|without-password|yes|' /etc/ssh/sshd_config
sed -i 's|yes"|without-password"|' /etc/ssh/sshd_config
ifconfig
** write down the IP address of your server from ifconfig results
reboot
** login via SSH to continue **

Installing Incredible PBX 12 on Your Ubuntu 14.04 Server

Adding Incredible PBX 12 to a running Ubuntu 14.04 server is a walk in the park. To restate the obvious, your server needs a reliable Internet connection to proceed. Using SSH (or Putty on a Windows machine), log into your new server as root at the IP address you deciphered in the ifconfig step at the end of the Ubuntu install procedure above.

WARNING: If you’re using a 512MB droplet at Digital Ocean, be advised that their Ubuntu setup does NOT include a swap file. This may cause serious problems when you run out of RAM. Uncomment ./create-swapfile-DO line below to create a 1GB swap file which will be activated whenever you exceed 90% RAM usage on Digital Ocean.

Now let’s begin the Incredible PBX 12 install. Log back in as root and issue the following commands:

cd /root
wget http://incrediblepbx.com/incrediblepbx12.tar.gz
tar zxvf incrediblepbx12.tar.gz
rm incrediblepbx12.tar.gz
#./create-swapfile-DO
./IncrediblePBX12.sh

The installer will first upgrade your Ubuntu 14.04 build to the latest modules. Then it will reboot. Rerun the installer again to kick off the Incredible PBX 12 installation process. Once you have agreed to the license agreement and terms of use, press Enter and go have a 30-minute cup of coffee. The Incredible PBX 12 installer runs unattended so find something to do for a bit unless you just like watching code compile. When you see "Have a nice day", your installation is complete. Write down your your three "knock" ports for PortKnocker. You can retrieve your PortKnocker setup like this: cat /root/knock.FAQ. Next, set your admin password for FreePBX 12 by running /root/admin-pw-change. Set your correct time zone by running /root/timezone-setup. To be sure your FreePBX module signatures are current, issue the following two commands:

amportal a ma refreshsignatures
amportal a r

Log out and back in as root and the automatic update utility will bring your system current with security fixes and enhancements. Then you will be greeted with a status display shown at the top of this article.

You can access the Asterisk 12 CLI by typing: asterisk -rvvvvvvvvvv

You can access the FreePBX 12 GUI using your favorite web browser to configure your server. Just enter the IP address shown in the status display. The default username is admin with the admin password you set up above. If desired, you also can change it in FreePBX Administration by clicking Admin -> Administrators -> admin. Enter a new password and click Submit Changes then Apply Config. Now edit extension 701 so you can figure out (or change) the randomized passwords that were set up for default 701 extension and voicemail: Applications -> Extensions -> 701.

Setting Up a Soft Phone to Use with Incredible PBX

Now you’re ready to set up a telephone so that you can play with Incredible PBX 12. We recommend YateClient which is free. Download it from here. Run YateClient once you’ve installed it and enter the credentials for the 701 extension on Incredible PBX. You’ll need the IP address of your server plus your extension 701 password. Choose Settings -> Accounts and click the New button. Fill in the blanks using the IP address of your server, 701 for your account name, and whatever password you created for the extension. Click OK.

Once you are registered to extension 701, close the Account window. Then click on YATE’s Telephony Tab and place some test calls to the numerous apps that are preconfigured on Incredible PBX. Dial a few of these to get started:

123 - Reminders
222 - ODBC Demo (use acct: 12345)
947 - Weather by ZIP Code
951 - Yahoo News
*61 - Time of Day
*68 - Wakeup Call
TODAY - Today in History

Now you’re ready to connect to the telephones in the rest of the world. If you live in the U.S., the easiest way (at least for now) is to use an existing (free) Google Voice account. Google has threatened to shut this down but as this is written, it still works with previously set up Google Voice accounts. The more desirable long-term solution is to choose several SIP providers and set up redundant trunks for your incoming and outbound calls. The PIAF Forum includes dozens of recommendations to get you started.

Configuring Google Voice

If you want to use Google Voice, you’ll need a dedicated Google Voice account to support Incredible PBX 12. If you want to use the inbound fax capabilities of Incredible Fax, then you’ll need an additional Google Voice line that can be routed to the FAX custom destination using FreePBX. The more obscure the username (with some embedded numbers), the better off you will be. This will keep folks from bombarding you with unsolicited Gtalk chat messages, and who knows what nefarious scheme will be discovered using Google messaging six months from now. So keep this account a secret!

We’ve tested this extensively using an existing Google Voice account, and inbound calling is just not reliable. The reason seems to be that Google always chooses Gmail chat as the inbound call destination if there are multiple registrations from the same IP address. So, be reasonable. Do it our way! Use a previously configured and dedicated Gmail and Google Voice account, and use it exclusively with Incredible PBX 12.

IMPORTANT: Be sure to enable the Google Chat option as one of your phone destinations in Settings, Voice Setting, Phones. That’s the destination we need for The Incredible PBX to work its magic! Otherwise, all inbound and outbound calls will fail. If you don’t see this option, you’re probably out of luck. Google has disabled the option in newly created accounts as well as some old ones that had Google Chat disabled. Now go back to the Google Voice Settings.

While you’re still in Google Voice Settings, click on the Calls tab. Make sure your settings match these:

  • Call ScreeningOFF
  • Call PresentationOFF
  • Caller ID (In)Display Caller’s Number
  • Caller ID (Out)Don’t Change Anything
  • Do Not DisturbOFF
  • Call Options (Enable Recording)OFF
  • Global Spam FilteringON

Click Save Changes once you adjust your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

One final word of caution is in order regardless of your choice of providers: Do NOT use special characters in any provider passwords, or nothing will work!

Now you’re ready to set up your Google Voice trunk in FreePBX 12. After logging into FreePBX with your browser, click the Connectivity tab and choose Google Voice/Motif. To Add a new Google Voice account, just fill out the form. If you want unanswered calls to be routed to Google Voice for transcription, check the box. Be advised that IVR calls typically are not "answered" so check that box as well if you plan to use an IVR to respond to incoming Google Voice calls.

IMPORTANT LAST STEP: Google Voice will not work unless you restart Asterisk from the Linux command line at this juncture. Using SSH, log into your server as root and issue the following command: amportal restart.

If you have trouble getting Google Voice to work (especially if you have previously used your Google Voice account from a different IP address), try this Google Voice Reset Procedure. It usually fixes connectivity problems. If it still doesn’t work, enable Less Secure Apps using this Google tool.

Troubleshooting Audio and DTMF Problems

You can avoid one-way audio on calls and touchtones that don’t work with these simple settings in FreePBX: Settings -> Asterisk SIP Settings. Just plug in your public IP address and your private IP subnet. Then set ULAW as the only Audio Codec.

Adding Speech Recognition to Incredible PBX 12

To support many of our applications, Incredible PBX has included Google’s speech recognition service for years. These applications include Weather Reports by City (949), AsteriDex Voice Dialing by Name (411), and Wolfram Alpha for Asterisk (4747), all of which use Lefteris Zafiris’ terrific speech-recog AGI script. Unfortunately (for some), Google now has tightened up the terms of use for their free speech recognition service. Now you can only use it for "personal and development use." If you meet those criteria, keep reading. Here’s how to activate speech recognition on Incredible PBX. Don’t skip any steps!

1. Using an existing Google/Gmail account to join the Chrome-Dev Group.

2. Using the same account, create a new Speech Recognition Project.

3. Click on your newly created project and choose APIs & auth.

4. Turn ON Speech API by clicking on its Status button in the far right margin.

5. Click on Credentials in APIs & auth and choose Create New Key -> Server key. Leave the IP address restriction blank!

6. Write down your new API key or copy it to the clipboard.

7. Log into your server as root and issue the following commands:

# for Ubuntu and Debian platforms
apt-get clean
apt-get install libjson-perl flac -y
# for RedHat and CentOS platforms
# yum -y install perl-JSON
# for all Linux platforms
cd /var/lib/asterisk/agi-bin
mv speech-recog.agi speech-recog.last.agi
wget --no-check-certificate https://raw.githubusercontent.com/zaf/asterisk-speech-recog/master/speech-recog.agi
chown asterisk:asterisk speech*
chmod 775 speech*
nano -w speech-recog.agi

8. When the nano editor opens, go to line 70 of speech-recog.agi: my $key = "". Insert your API key from Step #6 above between the quotation marks and save the file: Ctrl-X, Y, then Enter.

Now you’re ready to try out the speech recognition apps. Dial 949 and say the name of a city and state/province/country to get a current weather forecast from Yahoo. Dial 411 and say "American Airlines" to be connected to American.

To use Wolfram Alpha by phone, you first must install it. Obtain your free Wolfram Alpha APP-ID here. Then run the one-click installer: /root/wolfram/wolframalpha-oneclick.sh. Insert your APP-ID when prompted. Now dial 4747 to access Wolfram Alpha by phone and enter your query, e.g. "What planes are overhead." Read the Nerd Vittles tutorial for additional examples and tips.

A Few Words about the Incredible PBX 12 Security Model for Ubuntu

Incredible PBX 12 for Ubuntu 14.04 is an extremely secure turnkey PBX implementation. As configured, it is protected by both Fail2Ban and a hardened configuration of the IPtables Linux firewall. As installed, nobody can access your PBX without your credentials AND an IP address that is either on your private network or that matches the IP address of your server or the PC from which you installed Incredible PBX. Incredible PBX 12 is preconfigured to let you connect to many of the leading SIP hosting providers without additional firewall tweaking.

You can whitelist additional IP addresses for remote access in several ways. First, you can use the command-line utilities: /root/add-ip and /root/add-fqdn. You can also remove whitelisted IP addresses by running /root/del-acct. Second, you can dial into extension 864 (or use a DID pointed to extension 864 aka TM4) and enter an IP address to whitelist. Before Travelin’ Man 4 will work, you’ll need to add credentials for each caller using the tools in /root/tm4. You must add at least one account before dial-in whitelisting will be enabled. Third, you can temporarily whitelist an IP address by successfully executing the PortKnocker 3-knock code established for your server. You’ll find the details and the codes in /root/knock.FAQ. Be advised that IP addresses whitelisted with PortKnocker (only!) go away whenever your server is rebooted or the IPtables firewall is restarted. For further information on the PortKnocker technology and available clients for iOS and Android devices, review the Nerd Vittles tutorial.

HINT: The reason that storing your PortKnocker codes in a safe place is essential is because it may be your only available way to gain access to your server if your IP address changes. You obviously can’t use the command-line tools to whitelist a new IP address if you cannot gain access to your server at the new IP address.

We always recommend you also add an extra layer of protection by running your server behind a hardware-based firewall with no Internet port exposure, but that’s your call. If you use a hardware-based firewall, be sure to map the three PortKnocker ports to the internal IP address of your server!

The NeoRouter VPN client also is included for rock-solid, secure connectivity for remote users. Read our previous tutorial for setup instructions.

As one would expect, the IPtables firewall is a complex piece of software. If you need assistance configuring it, visit the PIAF Forum for some friendly assistance.

Incredible Backup and Restore

We’re pleased to introduce our latest backup and restore utilities for Incredible PBX. Running /root/incrediblebackup will create a backup image of your server in /tmp. This backup image then can be copied to any other medium desired for storage. To restore it to another Incredible PBX 12 server, simply copy the image to a server running Asterisk 12 and FreePBX 12 and run /root/incrediblerestore. Doesn’t get much simpler than that.

A Word About FreePBX Module Signatures

FreePBX 12 has implemented a new checksum mechanism to assure that modules are intact. Special thanks to the FreePBX Development Team for their work in extending this feature to modules outside the FreePBX-support modules. If other modules (other than ODBC configuration files) show invalid or missing signatures, you should do some investigating promptly!

Adding Incredible Fax to Your Server

Once you’ve completed the Incredible PBX install, log out and log back in to load the latest automatic updates. Then reboot. Now you’re ready to continue your adventure by installing Incredible Fax for Ubuntu. Special thanks to Josh North for all his hard work on this!

cd /root
rm incrediblefax11_ubuntu14.sh
wget http://incrediblepbx.com/incrediblefax11_ubuntu14.sh
chmod +x incrediblefax11_ubuntu14.sh
./incrediblefax11_ubuntu14.sh

Just plug in your email address for delivery of your incoming faxes in PDF format. Then accept all of the defaults during the installation process. Once you complete the install, reboot your server. Then log in as root again and set your AvantFax admin password: /root/avantfax-pw-change. Now you can access both FreePBX 12 and AvantFax by pointing your browser to the IP address of your server. Please note that we’ve had problems logging into AvantFax with some versions of the Chrome browser. Works great with Firefox!

Next, log into FreePBX and set an Inbound Route for incoming faxes to Custom Destination: Fax (hylafax). Then try sending a fax to the phone number and be sure it arrives in your email.

You also can try enabling fax detection with any Google Voice number. Just edit the inbound route for the DID and make it look like this:

Incredible PBX 12 Automatic Update Utility

Every time you log into your server as root, Incredible PBX 12 will ping the IncrediblePBX.com web site to determine whether one or more updates are available to bring your server up to current specs. We recommend you log in at least once a week just in case some new security vulnerability should come along (again).

Where To Go Next?

Once you get Incredible PBX installed, you’ll want to read up on the dozens of applications for Asterisk which are included in the Incredible PBX feature set. We’ve previously covered this in a separate article for the Raspberry Pi platform, but the applications are the same. Here’s a link to the tutorials.

You can follow updates to Incredible PBX 12 in this thread on the PIAF Forum.

We would also encourage you to sign up for an account on the PIAF Forum and join the discussion. In addition to providing first-class, free support, we think you’ll enjoy the camaraderie. Come join us!

Originally published: Monday, November 3, 2014 Updated: Monday, December 1, 2014


Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! Please have a look and post your support questions there. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of users just like you. You won’t have to wait long for an answer to your question.



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. With some providers including ones linked in this article, Nerd Vittles receives referral fees which assist in keeping the Nerd Vittles lights burning brightly. []

A Night with the Stars: The Future of Asterisk and Open Source Telephony

We recently had an opportunity to spend one of Charleston’s coldest nights with David Duffett and Mark Spencer solving most of the world’s problems. For those of you that don’t know, Mark was the creator of Asterisk® and the founder and current CTO of Digium® while David is the Director of the Worldwide Asterisk Community which means he’s never seen an airplane he didn’t like. As it happens, Mark shares a passion for aviation, and we’ll get to that.

Mark and David flew into Charleston’s "international airport" on one of my favorite airplanes. It speaks volumes about our small aviation hub when there are only a handful of reserved parking places and the names of two car dealers and Darius Rucker appear on three of them. Welcome to Charleston. For those that are airplane buffs, if you haven’t heard of the Very Light Jet revolution in commercial aviation, take a look at this article and then go talk to your boss about ditching commercial aircraft travel. "The variable operating cost per hour of the Eclipse 500 (insurance, maintenance, fuel, and replacement parts) is estimated at $372." That’s less than 25% of the typical operating cost of most private jets. To give you another point of reference, the Eclipse made the trip in one hour and one minute. The 500-mile, 8-hour trip from Huntsville to Charleston in a rented SUV is over $200 a day. One-way, refundable commercial airfare from Huntsville to Charleston is $842.10 per person and takes roughly four hours. Life’s too short! Now where were we?



Our reading of the tea leaves suggests that the days of using copper for communications are coming to a close which means the sales of analog cards for PSTN connectivity will continue to diminish. Since this has been Digium’s bread and butter for many years, we were curious about the future direction of the company. To his credit, Mark was smart enough to appreciate early on that being a great programmer doesn’t necessarily provide the skill set needed to manage a technology business. That responsibility has been turned over to Danny Windham, who has done a terrific job in positioning Digium for future growth with a broad mix of products. In the hardware department, Digium’s new line of high-end "smart" phones and failover appliances are a big hit. Digium’s commercial unified communications system aka Switchvox has perhaps the best graphical user interface of any commercial product on the market at a fraction of the cost. Then there are new cloud offerings including Respoke which brings communications to your web site with zero hardware costs. And finally there is Digium’s new SIP trunking which offers extremely competitive pricing for commercial enterprises. Whew!

On the open source front, Digium continues to lead the Asterisk charge with the release of Asterisk 13 last month. To its credit, Digium was smart enough to appreciate its development limitations even though Matt Jordan and his team have done a masterful job advancing Asterisk to a whole new level. The kludgey SIP days are officially over. Unfortunately, what was left by the wayside was Mark’s open source Asterisk-GUI which was incorporated into AsteriskNOW for many years. The latest releases now include a rebranded version of FreePBX®.

When Mark inquired about what we had been up to lately, we couldn’t help but chuckle in acknowledging that we’d been playing with Asterisk-GUI. While we don’t typically dig up bones in the graveyard, Asterisk-GUI is a little different. It’s a product that was dropped from the Digium lineup not because of its technical shortcomings but because of a lack of resources to properly support and further develop it as a Digium-funded open source product. Other companies have wasted little time incorporating Asterisk-GUI into their commercial PBX offerings. That includes Grandstream as well as Yeastar and ATCOM. And, of course, Digium’s AA50 also uses Asterisk-GUI. We’ve been looking at Asterisk-GUI as a low overhead alternative to FreePBX that could better support hobbyist platforms running Asterisk: the Raspberry Pi, BeagleBone Black, CuBOX, and even old Pogoplug hardware.

What’s different about Asterisk-GUI compared to FreePBX is its memory footprint and performance. Reloading FreePBX after making changes in the GUI is a laborious process on these tiny devices. On the other hand, reloading Asterisk-GUI is virtually instantaneous. Is it as feature-rich as FreePBX? No. Do most hobbyists and SOHO businesses need the product sophistication of FreePBX? Probably not.

Our focus with Asterisk-GUI is to develop a secure hobbyist platform which others then can embellish to keep the product current in the traditional open source manner. We plan to start with Asterisk 11 and see how it goes. We also plan to encourage participation by lots of current Asterisk-GUI development partners including Grandstream. Technical assistance still could be provided through the existing PBX in a Flash Forum for those that want to participate in development or just like to play. We got into open source telephony to experiment as a hobbyist, not to make money. We have been enormously successful… at least with respect to our financial objective.

To make a long story short, we sent Mark and David packing with Pogoplugs in their bags. So who knows what the future holds? Perhaps it will rekindle the development spirit that first led to Asterisk and Asterisk-GUI. And, whether it does or not, suffice it to say the Asterisk-GUI is an impressive software product and one we hope to tame in coming weeks for use with some of our favorite hardware.

In the meantime, Mark is busy bringing his open source enthusiasm to the aviation world. But, as I joked to Mark, there are a lot more telephones in the world than there are airplanes. So we’ll see what we see. One thing is for sure. We all can expect great things in coming years from Mark. He remains one of the most talented and prolific programmers in the country, and we’re looking forward to spending some time with his next creation regardless of the platform.

Continue reading Chapter 1

Originally published: Wednesday, November 19, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

A Firsthand Look at Disaster Recovery: Tethering and IAX with Asterisk

One of the exciting challenges of building a swimming pool is knowing that it’s just a matter of time until your Internet connection dies. As you might imagine, swimming pools are major construction and involve a lot of digging. And digging usually means some oops moments when cables get cut. In our case, we had watched the folks digging the trenches for all of the pool plumbing to be sure they didn’t accidentally whack one of three coax cables coming into our house. And, when it came time to cover up the trenches, we pointed out the orange cables to the Bobcat driver knowing we were finally home free. Not so fast! Two minutes later, Mario had driven the Bobcat right over the primary Internet cable leaving the shredded remains sticking up through the dirt. Oops. Sorry. Shit happens!

Looking on the positive side, we chuckled, "What a perfect opportunity to test our backup Asterisk® system!" Our backup system is pretty clever if we do say so. It relies upon a Verizon WiFi HotSpot running on our Galaxy smartphone and a duplicate of our Asterisk-based PBX in a Flash™ server running as a virtual machine under VirtualBox on an iMac desktop. The entire setup takes less than a minute to activate. Well, that was the plan anyway.

It turns out that Verizon does SIP a little differently with a SIP ALG in the path so Asterisk couldn’t register with all but one of our dozen SIP providers. Congratulations, CallCentric! The workaround is to enable STUN. That is now possible with Asterisk 11. Short of that, you’re left with CallCentric. Unfortunately for us, we don’t do much SIP trunking with CallCentric, and none of our primary DIDs are connected through them. The other option is to add port=5080 to your trunk setup with any SIP trunks you register with VoIP.ms using a username and password. Our attention span was too short to tackle STUN in the middle of this crisis. But there’s good news. Verizon doesn’t mess with IAX network traffic at all. Since a couple of our primary DIDs are registered with VoIP.ms using IAX trunks, restoring these IAX trunks to full functionality took less than a minute. That is step one of a three-step process. You need inbound trunks, phones, and outbound trunks to get your redundant VoIP server back in business.

Getting phones to function on what is now a purely WiFi network (through the Verizon HotSpot) can be problematic unless you’ve done your homework and sprinkled a few WiFi-capable SIP phones around your home or office. In our case, we still have Grandstream’s GXP2200 Android phones scattered everywhere so it was just a matter of plugging in the WiFI adapters and rebooting. The newer GXV3240 would work just as well.1

All that remained was enabling several trunks for outbound calls. Since VoIP.ms IAX trunks support both incoming and outgoing calls, we were home free. And, with Google Voice trunks, it was simply a matter of jumping through Google’s security hoops to reenable the connections on a new IP address.

Lessons Learned. Here’s a quick checklist for those of you that think about disaster recovery for your home or for clients and businesses. Nothing beats some advance planning. If money is no object, then WiFi tethering from a smartphone with one of the major providers whose service works well in your home or office environment is the way to go. 4G is a must!

In our case, money was an object so we had the foresight to acquire a Verizon SIM card from eBay that included an unlimited data plan. With this setup, it costs only $1 a day extra to add WiFi tethering, and you can turn it off and on as often as you like without any additional fees or surcharges. There also are no additional charges for using boatloads of data! We’re actually writing this column with a tethered connection from a hotel in Washington (results above). To give you some idea of why an unlimited data plan is important, our home operation burned through 4 gigs of data in less than 24 hours once we activated WiFi tethering. Of course, there were people doing things other than making phones calls, but tethering enables 5 connections to function just about like the cable modem service you originally had in place. So expect the data usage to be substantial. Everybody likes 24/7 Internet service.

Loss of phone calls through a PBX is more of an annoyance than a crisis these days because almost everyone also has a smartphone. Even so, the SIP gotcha with Verizon Wireless was a surprise because we hadn’t really tested our super-duper emergency system in advance. That wasn’t too smart obviously. The old adage applies. Do as we say, not as we do. Unplug your cable modem or DSL connection and actually test your backup system before D-Day arrives.

On the VoIP provider end, now is the time to set up an account with a provider that offers both SIP and IAX connectivity. Step 2 is to actually configure an IAX trunk (as a subaccount to use VoIP.ms parlance) and test it. IAX trunks actually have fewer headaches with NAT, but there are only a handful of providers that still provide the service. Find one now and make certain that your primary DIDs will roll over to the IAX trunk in case of an outage. I’m always reminded that we have Mark Spencer to thank for IAX. It was his brainchild. Thank you, Mark! With VoIP.ms, you also can spoof your CallerID so that calls will still appear to originate from your primary Asterisk PBX.

Keep in mind that a VirtualBox-based Asterisk virtual machine and a Desktop computer both need an IP address and will have to be started on WLAN0 rather than ETH0. Remember, your wired connection is now dead.

You’re also going to want to acquire at least a couple of WiFi-capable SIP phones that can be connected with your Asterisk server using your WiFi HotSpot. Also make certain that you have a preconfigured IPtables firewall on your backup system. Remember, your hardware-based firewall connected to your cable modem won’t provide any protection once you switch to HotSpot operation. Lucky for you, Incredible PBX™ servers come preconfigured with a locked-down IPtables firewall and a WhiteList. Just add the new IP addresses of your server and phones, and you’re secure on the public Internet.

Finally, let’s do the HotSpot connection math. You’ll need an IP address for your desktop computer running VirtualBox. You’ll need a second IP address for the Asterisk virtual machine. Then you’ll need an IP address for every WiFi-enabled SIP phone. If the maximum number of connections is five on your HotSpot, that means you’ve got the necessary capacity for at most 3 WiFi SIP phones assuming you don’t enable a WiFi printer and if nobody else wants to use a computer during the outage. The other option is to add an inexpensive travel router with bridge mode to your mix of 5 devices. We always keep one handy for extended trips. A properly configured travel router provides an additional WiFi network with some extra WiFi connections. Good luck!


Security Alerts. Serious SSL and FreePBX security vulnerabilities have been discovered AND patched during the past week. If you have not patched your server and Asterisk, FreePBX, Apache, and/or WebMin are exposed to the public Internet, you have a serious problem on your hands. See this thread for details on the FreePBX vulnerability. And see this thread for the steps necessary to patch SSL in Asterisk, Apache, and Webmin. While Incredible PBX servers were automatically patched for the FreePBX vulnerability, the SSL issues require manual patching and an Asterisk upgrade. A script for upgrading Asterisk 11 servers is included in the message thread linked above. ALWAYS run your VoIP server behind a firewall with no Internet port exposure to Asterisk, FreePBX, SSH, or the Apache and Webmin web servers! And, if you think all of this security stuff is just a silly waste of your time, then read about the latest lucky recipient of a $166,000 phone bill.

Originally published: Monday, October 20, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

  1. Some of our links refer users to Amazon or other service providers when we find their prices are competitive for the recommended products. Nerd Vittles receives a small referral fee from these providers to help cover the costs of our blog. We never recommend particular products solely to generate commissions. However, when pricing is comparable or availability is favorable, we support these providers because they support us. []

Zero Day Vulnerability Protection and More: Introducing Cover Your Asterisk

It’s been a difficult couple of weeks for the Linux® and Asterisk® communities with the back-to-back disclosures of the BASH Shellshock bug and then the FreePBX® Asterisk Recording Interface (ARI) bug a few days later. Both of these vulnerabilities have been circulating in the wild for years. We won’t repeat Wikipedia’s Zero Day Attack analysis other than to note that what makes these particular bugs so scary is not only the fact that both went undetected and unpatched for years but also that the attack vectors for both bugs were so simple. Anyone with a web server exposed to the Internet that was running any flavor of Linux or any Asterisk server with the FreePBX GUI was fair game for a seriously compromised server.

For those with shared servers in a hosted environment running under cPanel, your web platform typically runs with the equivalent of root privileges which means that any web intrusion inherits the same server privileges that you as the administrator had. This is similar to the way FreePBX runs with Asterisk. The same user account used for web access controls all of the Asterisk assets on your server. While it’s convenient, it’s also dangerous whenever there’s a web vulnerability because the entire Asterisk platform has exposure.

We always chuckle when one of the anonymous forum trolls launches a tirade claiming that these alerts are nothing more than Monday morning quarterbacking disguised as Chicken Little. What’s more amazing is that anyone would take the comments of an anonymous poster seriously especially on a matter involving server security. It’s one thing to label folks as alarmists for suggesting that the sky is falling when it isn’t. It’s quite another to launch these anonymous personal attacks even when there is documented evidence that the Internet sky was indeed caving in. Kinda reminds us of the global warming naysayers when the polar ice caps are melting beneath their feet.

According to the naysayers, we’re all doomed when it comes to cyberterrorism so why fight it. Here’s why. While reacting to security vulnerabilities has always been a defensive game of cat and mouse, that doesn’t mean you shouldn’t proactively do what you can to patch serious security holes in your servers. The alternative is to give cybercriminals a blank check to launch bots from your server that generate spam or participate in large-scale zombie attacks on our most trusted resources whether they’re DNS root servers, utility infrastructure and our electric grid, banking assets, and even national security resources. So let’s circle back and address what you can do to assure that you’re part of the solution rather than part of the problem.

The Way It Is: Do I Need a Public Web Server with Asterisk?

For purposes of this discussion, our focus today is Asterisk server security. And the number one thing you can do to insulate your server from these vulnerabilities is to make certain that your web server is not exposed to Internet access by the general public. Neither Asterisk nor FreePBX requires public web server access to manage your server. In fact, neither Asterisk nor FreePBX requires any public access to your server to properly perform all required telecommunications functions. And the second paragraph above explains why this is especially dangerous with servers running both Asterisk and FreePBX.

So why do people still publicly expose their web servers and UDP ports 5060 and 10000-20000 to the Internet? As much as we hate to say it, it’s because it’s always been done that way. It’s also because there are a handful of SIP providers that still require UDP 5060 access to make and receive calls. Most do not! And even for those that do require UDP 5060 access, their requirements can be satisfied with a properly configured firewall that supports whitelisting of "safe" IP addresses for limited access. Incredible PBX comes preconfigured with a locked down WhiteList. The same can be added to PBX in a Flash by installing Travelin’ Man 3. We hope the other aggregations will follow suit. It’s long overdue.

Public web server access often is because there are more than a few (lazy) VoIP providers that install systems in a way that makes it easy for them to manage remote sites. Of course, a VPN would provide secure access to the same resources but that’s a little more work on the deployment end. With NeoRouter VPN, it’s a 5-minute job!

There also are companies with remote users or traveling salesmen that claim their servers must be open to the Internet to keep the company running. First, it’s hard to imagine a company whose salespeople don’t have cellphones that require no link to home base. Second, there are numerous solutions for safe connectivity with a home office: VPNs, FQDNs with dynamic DNS support, Port Knocker, and Travelin’ Man 4 to name just a few of the ones we previously have recommended. With the exception of the lazy VoIP installer, you will note that none of the above scenarios ever require web access to a VoIP server. So the rationale for public exposure of an Asterisk web server is all but non-existent.

The bottom line is that, if your server is not and has never been accessible from the Internet by typing its IP address into a public web browser and assuming your root password has not been compromised, then the BASH and ARI vulnerabilities are purely an academic discussion from your vantage point. Should you apply the patches anyway? Absolutely. Will your server be compromised if you don’t? Probably not… at least not from these two vulnerabilities.

Life Is Good: Why Do I Need ‘Cover Your Asterisk’

That brings us to our topic for today. Having said all of the above, how do you really know if your server has been compromised by some zero day attack vector that none of us yet know about? After all, there are tens of thousands of applications installed on a typical Linux server. And a zero day vulnerability could be hiding almost anywhere.

First, a few words about what Cover Your Asterisk is not. This application won’t detect previously compromised servers! Wearing a condom the day after your wild night on the town isn’t all that helpful. If your server has been running as a public web server for the last 5 years, then our best advice is to start with a fresh install to a new, secured server. Then manually copy the settings (not the files!) from your old server to the new platform. Now you’re ready to protect your server.

Second, more than a few words about the VoIP environment in which we find ourselves. If you’re running any of the so-called Asterisk aggregations including PBX in a Flash, Incredible PBX, AsteriskNOW, FreePBX Distro, or Elastix, then your server includes some flavor of the FreePBX GUI, a web-based application to manage and configure Asterisk. As part of the FreePBX GUI setup, you give FreePBX 2.11 and beyond an expansive set of privileges on your server. These include read, write, and delete access to all of your web assets, all of your VoIP-related MySQL database assets, and all of your Asterisk assets. You also grant FreePBX rights to inventory and monitor critical pieces of information about your server so that you can be informed about pertinent FreePBX updates. We don’t see this as a bad thing. But, even with the incredibly talented FreePBX development team, this application design can be dangerous for a number of reasons not the least of which is the events of the past week. Consider for a moment a scenario in which a disgruntled employee or a web vulnerability allows somebody to modify a critical Asterisk configuration file such as manager.conf which controls access to the Asterisk Manager Interface, or to adjust MySQL’s admin.ampusers table which controls web access to the FreePBX GUI, or even to insert a malicious module into FreePBX which "looks and feels" like part of FreePBX. When you don’t know what you’re looking for, detecting subtle changes can be extremely difficult even for the most talented people in the business. For everyone else, it’s next to impossible. This is especially true when the changes aren’t noticeable in the standard day-to-day operation of your server. That was what led us to conclude that an additional detection mechanism was essential to highlight hidden changes made to any of the critical components that make up the Asterisk platform. Thus was born Cover Your Asterisk.

The Elastix folks apparently weren’t comfortable with this arrangement and forked FreePBX years ago and moved to a self-managed environment. The drawback has been their pace of releasing updates and patches, and that apparently applies to the unaddressed ARI bug as well.

The remaining aggregations all function as we’ve described. Before we delve into Cover Your Asterisk, here’s a little known tip. On the output side, FreePBX is basically a code-generator for Asterisk. Once you’ve configured your server using the FreePBX GUI, there is no Asterisk-FreePBX linkage of which we’re aware that requires your web server to remain operational. That turns out to be a good thing. What this means is you can shut down Apache and still have a fully functional Asterisk server with all of the functionality of your FreePBX-designed configuration. Given the times in which we live, that may not be such a bad idea.

An Overview of Cover Your Asterisk

So what does Cover Your Asterisk do? What we’ve sought to do with this GPL2 application is to take a snapshot of your most valuable Asterisk and FreePBX assets and then create checksums of all the individual components. This includes the /etc/asterisk, /var/www/html/admin, and /var/lib/asterisk/agi-bin directories as well as the Asterisk DB and MySQL’s asterisk database. Periodically, you then run another script which compares your current setup to the previous snapshot and identifies the changes for further examination. Once you are satisfied that any reported changes are legitimate, you then take a new snapshot of your server and periodically check it to make certain no unexpected modifications have crept into your system. A duplicate of these production assets is always maintained in a separate directory structure (/etc/asterisk.snapshot) accessible only by root. It can easily be converted into a gzipped tarball: tar -cvzf cya.tar.gz /etc/asterisk.snapshot. Then simply store the tarball off site for a rainy day emergency… when the sky falls once again.

Because this application was designed for production servers, its testing and scope have been limited to the Asterisk 11 and FreePBX 2.11 platform. For our installed base, that translates into PIAF-Green with FreePBX 2.11 and all flavors of Incredible PBX 11 running atop CentOS, Scientific Linux, Ubuntu 14, Debian, and Raspbian platforms on both Intel and ARM hardware including the Raspberry Pi, BeagleBone Black, CuBox, and PogoPlug.

Installation and Operation of Cover Your Asterisk

Log into your Asterisk 11 server as root and issue the following commands to install the Cover Your Asterisk software:

cd /root
wget http://incrediblepbx.com/cover-your-Asterisk.tar.gz
tar zxvf cover-your-Asterisk.tar.gz
rm -f cover-your-Asterisk.tar.gz

To take the original snapshot of your server, run: /root/protect-your-ASSets.sh

To check your current setup against the snapshot, run: /root/check-your-ASSets.sh

To compare a file with its snapshot, run: diff /dirpath/filename /etc/asterisk.snapshot/dirpath/filename

To restore a snapshot file to your current Asterisk configuration, run these commands:

cp -p /etc/asterisk.snapshot/etc/asterisk/filename /etc/asterisk/filename
amportal restart

For Raspberry Pi and BeagleBone Black users, change the MySQL root password in both scripts:

sed -i 's|passw0rd|raspberry|' /root/protect-your-ASSets.sh
sed -i 's|passw0rd|raspberry|' /root/check-your-ASSets.sh

Finally, let us close with several recommendations. First, before making changes to your server with FreePBX, always run check-your-ASSets.sh, correct any detected problems, and then run protect-your-ASSets.sh to create a new snapshot of your server. After making any changes with the FreePBX GUI, run check-your-ASSets.sh again to verify that the changes you sought to make were, in fact, the changes that actually were made to your server. Then finish up by taking a new snapshot. These scripts take less than 30 seconds to run on a typical server so this is not a cumbersome process.

Before you restore any snapshot file or if you are puzzled by any changes you see listed after running check-your-ASSets.sh, we strongly recommend that you first seek advice from the gurus on the PIAF Forum. They can help you identify the severity of the problem, if any, and recommend an appropriate course of action for correction of the problem.

Finally, a cautionary note. Cover Your Asterisk is still a project in development. This means there will be changes/improvements as the coming weeks go by. One wrinkle with updates is your previous snapshots will have to be checked before you update. And then the newest protect-your-ASSets.sh script will need to be run following the update. To keep track of future releases and what’s included, visit this development thread on the PIAF Forum. Enjoy!

Originally published: Monday, October 6, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…

Hold On to Your Wallet: Another Huge VoIP Phone Bill May Be Lurking


We interrupt our regularly scheduled content to bring you an urgent security alert. A couple days ago, a FreePBX® user reported unusual call activity. He traced the calls to a System Admin Dashboard module that was linked back to an IP address in the Netherlands. When the problem was reported, the FreePBX Community Manager quite accurately noted that it wasn’t FreePBX code. When a second user reported the exact same exploit, alarm bells apparently went off.

Further digging by the FreePBX Dev Team found that the legacy ARI module (once again) had been compromised, this time with a Remote Code Execution and Privilege Escalation exploit. Previous security vulnerabilities in this module led the PBX in a Flash developers many years ago to abandon the FreePBX security model in favor of Apache security so that we could totally block ARI access unless the user had administrator privileges. We want to stress that this wasn’t the fault of any of the current FreePBX developers. Instead, our move to Apache security was based upon our realization that this old legacy code was difficult to maintain because none of the original developers were still around. To their credit, the FreePBX developers have introduced a new User Control Panel with the strongest recommendation that the older ARI module be abandoned. Unfortunately, it still exists on all but the very latest FreePBX 12 systems including FreePBX 12 systems which were upgraded from a previous release. In addition, FreePBX 12 now provides checksum protection for all registered modules which will go a long way toward eliminating attacks such as this. So what can you do to protect your servers and your wallet today? For openers, upgrade your FreePBX fw_ari module NOW and clean the malicious module off your server:

rm -rf AMPWEBROOT/admin/modules/admindashboard
amportal a ma upgrade fw_ari

If you encounter an error that FreePBX cannot connect to the Asterisk Manager, do the following from the Linux CLI:

sed -i 's|localhost|127.0.0.1|' /etc/freepbx.conf
amportal restart
amportal a r

Protecting Your Server from Remote VoIP Attacks

Let’s approach the long-term solution on several levels starting with vulnerability exposure. If you can access TCP ports 22 (SSH) and 80 (HTTP) and TCP/UDP port 5060 (SIP) of any of your Asterisk® and FreePBX-based servers anonymously from the Internet, you’re either nuts or rich.

We’ve cautioned against this for nearly a decade and yet even some developers still configure Asterisk and FreePBX-based servers with port 80 Internet exposure. Why? We can only assume it’s because it makes their job of accessing and maintaining these systems easy. Don’t do it! There still are numerous ways to gain access to the FreePBX GUI on any server. Here’s our short list…

Safest. Put your server behind a hardware-based firewall with no Internet port exposure. Then use a VPN to access the FreePBX GUI. In a perfect world, you can run a VPN on all of your VoIP phones so that you have end-to-end protection for your server and all of your users.

Safer. If a hardware-based firewall isn’t possible, use the Linux IPtables firewall and lock down all the ports on your server, especially TCP ports 22 and 80 and TCP/UDP port 5060. Then create a WhiteList of IP addresses that need access privileges. It’s worth stressing that Fail2Ban is completely worthless when it comes to security vulnerabilities such as the ARI RCE flaw because the bad guys walk right in without even being challenged for a password.

Safe. If you need remote access from various remote locations and these sites have dynamic IP addresses, then deploy the Port Knocker technology in addition to locking down your server with the IPtables firewall. This lets you gain temporary access to your server without providing a blank check (literally) to everybody on the Internet. There’s a reason it’s called the World Wide Web and not the Good Guys Web!

Worse. Exposing TCP port 5060 and UDP port 5060 to public Internet access is dangerous. Some providers unfortunately still require direct access to 5060 to make VoIP calls with SIP. TIP: Switch to a provider that allows SIP registrations so that you don’t have to expose port 5060 directly to the Internet EVER!

Worser. Pardon our grammar, but exposing TCP port 22 to public Internet access is a bad idea. At the very least, change the SSH port so that typical port scanners don’t discover your open SSH port. SSH has been compromised in the past. It probably will happen again, or it may have already happened and we just don’t (yet) know about it. Fail2Ban helps with SSH attacks, but it’s not infallible particularly when high performance servers are used in the attacks. Fail2Ban has to scan your logs and, before it can do that, it has to have a sufficient time slice to accomplish the scan, something that may never happen with an attack launched from a platform such as Amazon EC2.

Worst. Never expose TCP port 80 to public Internet access. If you do, then you obviously haven’t had the pleasure of trying to maintain a public web server. TIP: Unless you are a web expert or sleep with one, don’t do it EVER! Earlier this week BASH provided a revolving door to your Internet assets using simple web requests. Earlier this year, OpenSSL was compromised. There will be another vulnerability because it’s the easiest attack target. So it’s just a matter of time until your server is compromised unless you deploy an effective firewall that blocks public access to port 80.

Server Design Still Matters

For our own PBX in a Flash and Incredible PBX users, you can sleep well tonight. Today’s vulnerability is mostly academic for you. PBX in a Flash blocks all access to ARI without the maint password. Incredible PBX blocks all access to ARI through its IPtables WhiteList. It’s still a good idea to apply the FreePBX update just to be double-safe. And Incredible PBX users will have the patch applied the next time they log into their server as root. For everyone else using FreePBX, keep reading.

With our Incredible PBX open source project, we provide state-of-the-art security methodology. While it is not infallible, all of the code is freely available for any and all VoIP developers to review, improve, and deploy. We would encourage our fellow VoIP developers to do so. There were reasons in the past for not deploying Apache security. After all, it lacks the flexibility of the FreePBX security model, and Apache also can be compromised. But we can’t think of any reason today for not deploying a hardened, preconfigured IPtables firewall AND a functional WhiteList as an integral component in every VoIP server install. This is especially important for any product deployed with the FreePBX GUI. Our Travelin’ Man 3 WhiteList implementation has been available for more than 2½ years! While there are downsides to any sort of push technology, we also believe the Incredible PBX (opt-in) update service is worth a careful look. It has been a godsend for us. With every new login, the server checks for important updates and processes them unless the administrator chooses not to use the service.

Keep in mind that FreePBX masquerading as the asterisk user has complete read/write privileges to virtually every Asterisk and web asset on your server. Any compromise is extremely dangerous because the asterisk user on these platforms has such expansive privileges. We recently encountered a trojan authorization lurking inside the permissions list of Asterisk’s manager.conf table. The matter is still under investigation so we can’t reveal much more other than to note that the entry was harmless on the few affected Incredible PBX servers because of the hardened IPtables WhiteList which is a key component of every Incredible PBX server. Had this happened on a server with no firewall protection, the intruder would have had complete access to the Asterisk AMI which pretty much gives the intruder a blank check to Asterisk… using your checkbook. The silver lining was the Incredible PBX update utility which provided a quick way to remove the vulnerability.

The FreePBX Dev Team’s efforts to design and deploy a checksum-based system for FreePBX 12 modules is certainly a step in the right direction. We think more safeguards are warranted. We already are exploring new ways to provide alerts when critical Asterisk or FreePBX resources are modified on PBX in a Flash and Incredible PBX servers. Something akin to the Mac’s admin authorization requirement before critical Asterisk or FreePBX changes are made would be ideal, but we have some other ideas as well. Stay tuned!

Originally published: Wednesday, October 1, 2014



Need help with Asterisk? Visit the PBX in a Flash Forum.


 

Special Thanks to Our Generous Sponsors


FULL DISCLOSURE: ClearlyIP, Skyetel, Vitelity, DigitalOcean, Vultr, VoIP.ms, 3CX, Sangoma, TelecomsXchange and VitalPBX have provided financial support to Nerd Vittles and our open source projects through advertising, referral revenue, and/or merchandise. As an Amazon Associate and Best Buy Affiliate, we also earn from qualifying purchases. We’ve chosen these providers not the other way around. Our decisions are based upon their corporate reputation and the quality of their offerings and pricing. Our recommendations regarding technology are reached without regard to financial compensation except in situations in which comparable products at comparable pricing are available from multiple sources. In this limited case, we support our sponsors because our sponsors support us.

BOGO Bonaza: Enjoy state-of-the-art VoIP service with a $10 credit and half-price SIP service on up to $500 of Skyetel trunking with free number porting when you fund your Skyetel account. No limits on number of simultaneous calls. Quadruple data center redundancy. $25 monthly minimum spend required. Tutorial and sign up details are here.

The lynchpin of Incredible PBX 2020 and beyond is ClearlyIP components which bring management of FreePBX modules and SIP phone integration to a level never before available with any other Asterisk distribution. And now you can configure and reconfigure your new Incredible PBX phones from the convenience of the Incredible PBX GUI.

VitalPBX is perhaps the fastest-growing PBX offering based upon Asterisk with an installed presence in more than 100 countries worldwide. VitalPBX has generously provided a customized White Label version of Incredible PBX tailored for use with all Incredible PBX and VitalPBX custom applications. Follow this link for a free test drive!
 

Special Thanks to Vitelity. Vitelity is now Voyant Communications and has halted new registrations for the time being. Our special thanks to Vitelity for their unwavering financial support over many years and to the many Nerd Vittles readers who continue to enjoy the benefits of their service offerings. We will keep everyone posted on further developments.
 



Some Recent Nerd Vittles Articles of Interest…