Posts tagged: IncrediblePBX

TweedleD Back From the Dead Using Twitter OAuth

Twitter Direct Messages and SMS Instant Messages are great ways to send yourself important notes that you want to keep track of… privately. Today, we’ll restore TweedleD to the living and let you harness the power of Twitter and SMS to announce every call on your Asterisk server with the name and number of the caller as well as the DID of the incoming call.

If you’re one of the gazillion handful of folks using one of our Twitter applications, then you awakened to an unpleasant surprise earlier this morning. Neither Tweet2Dial nor TweedleD would connect to Twitter! That meant you could no longer use Twitter to place Google Voice calls, to send Google Voice SMS messages, or to manage your Asterisk server. Nor could you send yourself direct messages when new incoming calls hit your Asterisk server. Unfortunately (for us), the Twitter folks have discontinued use of basic authentication to log into and use Twitter’s API. Instead, you now must use the more secure (and more complicated) OAuth authentication mechanism. Actually, this is a good thing in the grand scheme of things because it means you no longer have to give out your actual Twitter account name and password to anyone. So let’s move on to how to put Humpty back together again.

We’ve actually been wrestling with this a good long while. The basic problem is generating the necessary new credentials for use on servers that are tucked safely behind hardware-based firewalls. Without getting too deep in the weeds, here’s the drill. To use OAuth, you basically need two sets of credentials. First, you need your own (not ours!) application-specific credentials known in the Twitterverse as your consumer key and consumer secret. These are generated by Twitter and normally hide inside your application. They are never made public. You also need an access_token and access_secret. But these can only be obtained once Twitter generates a request_token that is passed back to your application. There’s also a request_token_secret that is used by Twitter to verify that you are who you say you are before the access_token and access_secret are provided. If this sounds complicated, you’d be right. Now add the fact that our particular Twitter apps are sitting behind a firewall on your server, and you can begin to appreciate why OAuth complicates things with apps running on private networks.

So here’s the deal. To use the new OAuth-compatible versions of Tweet2Dial and TweedleD, you’ll need four pieces of information for each of these applications: a consumer_key, consumer_secret, access_token, and access_token_secret. Because the two applications typically use two different Twitter accounts, you cannot interchange these four pieces.

The traditional procedure for getting these four pieces of data works like this. First, you go to the Twitter apps web site and register each application while logged into your Twitter account that will host the application. For each app, you must specify the following. In return, Twitter will provide a consumer_key and consumer_secret for the application.

  • Application Name
  • Description
  • Application Web Site
  • Organization
  • Web Site
  • Application Type
  • Callback URL
  • Default Access Type
  • Use Twitter for Login?

Second, you must create an application on the public web to log into Twitter using your new credentials. This log in process will produce the remaining pieces necessary to generate an access_token and access_token_secret specifically for you. Can you do all of this? Obviously, only you can answer that question, and here’s the best guide we’ve found to walk you through the process. Suffice it to say, unless you are a seasoned programmer, it’s a hairy procedure with lots of opportunities for disaster. But be our guest and try your hand at it.

What’s Plan B? The alternative to Step #2 above is to log into a special web site we’ve created to generate the necessary credentials for you. But this means you have to provide (and trust us not to store or use) your consumer key and consumer secret. You also don’t want someone looking over your shoulder while you’re obtaining the remaining credentials. Unfortunately, without your consumer key and consumer secret, we can’t obtain an access_token and access_token_secret for you. And without those, nothing works.

To get started, you’ll need to register your new application with Twitter. For this to work, the Application Web Site address and Application Callback URL in Step #1 need to point to our web site, not yours. Once you get the secret codes, you can change the web links for your application to any fake address you care to make up. Just don’t delete the Twitter app you’ve created.

If it makes you sleep any better, this isn’t your bank account we’re talking about, it’s a specific Twitter application, one that we happened to write for you. So, if you like Plan B and you’re comfortable with our assurance that none of your confidential keys or passwords are being harvested, continue reading. Otherwise, use your own devices for getting the four necessary credentials. Then you can download the new OAuth-compatible version of TweedleD, and you’re off to the races.

Today we’re going to tackle TweedleD and get it back in operation. In coming weeks, we’ll tackle Tweet2Dial as well.

TweedleD Setup. Let’s begin with TweedleD which lets you send Twitter DMs and SMS alerts to announce every incoming call on your Asterisk server. This tutorial assumes you previously have installed the original version of TweedleD. If not, start there. Now let’s proceed. First, you’ll need to register the application with Twitter.

Step #1 is to use a browser to log into the Twitter account that you plan to use to generate the Direct Messages. If you can’t remember which Twitter account you used to originally set this application up, log into your Asterisk server as root and find the $username entry near the top of nv-twitter.php in the /var/lib/asterisk/agi-bin directory. Your password for this Twitter account will be there as well.

Step #2 is to open a new tab with your browser and visit Twitter apps. Choose the Register a New Application option and fill out the form like this:

  • Application Icon: Your choice
  • Application Name: TweedleD
  • Description: Asterisk Incoming Call Announcer
  • Application Web Site: http://pbxinaflash.com/oauth/index.php
  • Organization: Your Name or Company Name
  • Web Site: http://anything-you-like.com
  • Application Type: Browser
  • Callback URL: http://pbxinaflash.com/oauth/callback.php
  • Default Access Type: Read & Write
  • Use Twitter for Login: Leave unchecked

Click the Save button once you’ve entered all the data and completed the Captcha code. Once your app is registered, call it up and write down your Consumer key and Consumer secret. By the way, if these ever get compromised, you can generate new ones. But it means you’ll have to repeat the rest of this exercise since the other credentials will change as well.

Step #3 is to visit our OAuth Credentials Generator web site using your browser. Now plug in your Consumer key and Consumer secret. Then fill out the Captcha code and click the Submit button. If you got the Captcha code right, you’ll see your entries redisplayed with an option to Login with Twitter. Just click on the link, sign in to Twitter if you’re not already signed in, and click the Allow button when prompted whether to Allow TweedleD access to your new web site. If you get some funky error message from Twitter, then you didn’t enter your Consumer key and secret correctly. Try again. Otherwise, you’ll then get a screen that displays some information about your Twitter account as well as your new Access Token and Secret. Write these down, too.

Access Token: 32438037iO5cYUq4h0BJD4Z6Un5phaZHZ2zJ4P4LQ2t6TX8fpU

Access Secret: PQrhUlM9nnJwIrYCNTF07ai3vlXgMD3uf3qmmWJp6o

Step #4 is to download and install the new TweedleD application. Log into your Asterisk server as root and issue the following commands:

cd /
wget http://bestof.nerdvittles.com/applications/TweedleD2.tgz
tar zxvf TweedleD2.tgz
rm TweedleD2.tgz
cd /var/lib/asterisk/agi-bin
nano -w nv-twitter.php

Step #5 is to configure TweedleD for use using your new Twitter credentials and your SMS email address. You’ll also need to choose whether to activate tweets, SMS messages, or both by setting $tweet and $sms to 1 if you want either or both of them activated.

If you’re activating Twitter, set $tweet=1 and fill in the 4 credentials that you wrote down previously: $consumer_key, $consumer_secret, $access_token, and $access_token_secret. In the $user4msg option, enter the Twitter account name to which the direct messages should be sent.

To activate SMS messaging as well, set $sms=1 and enter your SMS email address in the $smsaddress field using one of the examples provided.

Save the file, and you’re ready to try things out. Just make a call to your Asterisk server and the Twitter message announcing the call should arrive shortly thereafter. Enjoy!




Need help with Asterisk? Visit the PBX in a Flash Forum.
Or Try the New, Free PBX in a Flash Conference Bridge.


whos.amung.us If you’re wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what’s happening. It’s a terrific resource both for us and for you.


 
New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you’re seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity’s DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here’s a deal you can’t (and shouldn’t) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won’t get the special pricing! After the free hour of outbound calling, Vitelity’s rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest…

It’s PBX in a Flash 1.7.5.5: The Lean, Mean Asterisk Machine

It’s been 18 months since a new version of PBX in a Flash was officially released. And we’ll explain the reasons why it’s quite unnecessary with our product in a few minutes. But, today, we’re proud to introduce the latest and greatest version 1.7.5.5 of PBX in a Flash featuring your choice of Asterisk 1.4 or 1.6.2 with Zaptel or DAHDI support and FreePBX 2.6. It’s lean, mean, and incredibly flexible.

You don’t get the kitchen sink with the base PBX in a Flash ISO installs. Instead you get a rock-solid CentOS 5.5 operating system with the latest CentOS kernel on which to build an Internet telephony server that meets your specific needs. If we had to sum up this new release in a word, it would be refined. Newer hardware devices now are supported, and Mondo backups and other scripts have been tweaked to work with these new devices including Atom-based machines which are proving to be the ideal telephony platform for SOHO and small business deployments. As usual, documentation was not an afterthought. There’s a new installation tutorial and our award-winning knol has been updated to cover everything you’ll ever want to know about PBX in a Flash. And there’s loads of additional documentation on the PBX in a Flash web site. For the reading impaired, there’s even a 7-minute YouTube video to walk you through the installation process.

The installation procedure has been simplified. For most users, downloading the ISO, burning the ISO to a CD, booting from the CD, and pressing the Enter key is all the complexity you’ll face with a new PBX in a Flash install. For experts and resellers, there are the familiar options to perform network installs or to select different disk architectures including software RAID. Newer device drivers can be loaded as part of the installation process as well. And TM1000’s EndPoint Manager automatically configures almost any telephone on the planet for use with PBX in a Flash. All it takes is a quick download from SourceForge. For those with a physical handicap, you now can install the complete system with no user intervention by typing ksauto at the first prompt.

Overview. For those that prefer quick checklists to long articles, here’s the 30-minute, annotated, Baker’s Dozen PBX in a Flash 1.7.5.5 installation drill:

1. Download PBX in a Flash ISO
2. Burn ISO to a CD-ROM
3. Install system behind secure firewall
4. Boot target machine to be reformatted from CD
5. Press Enter key at first prompt
6. Choose keyboard for your country
7. Choose timezone for your location
8. Create a secure root password
9. Choose GOLD, SILVER, or BRONZE edition
10. Login as root & run update-scripts
11. Run update-fixes
12. Run passwd-master
13. Load FreePBX Modules OR Install Incredible PBX

A Better Mousetrap. Asterisk-based LAMP aggregations thankfully are more plentiful today, but we think we have a better mousetrap. Here are a few reasons why? First, PBX in a Flash is the only distribution that is totally source-based with Asterisk compiled from source as part of the install. What that means is when you purchase add-on hardware and it has a problem for some reason, all of the tools are already in place for you to contact the manufacturer or reseller and have them reconfigure or recompile whatever is necessary on your system to get you back in business quickly. It also means that most of our applications are compiled from source on your specific hardware which assures a more reliable and stable software platform on which to build your telephony system.

Second, we don’t release PBX in a Flash ISOs every other week. We don’t have to. Every time a new security patch is released for Asterisk, the “other guys” have to create a new RPM or ISO to support it. That means your system is vulnerable for weeks or months while that process is underway. In some cases, it means installing a new ISO and starting over. I wish I had a nickel for every time I reinstalled and basically started over with Asterisk@Home or trixbox. With PBX in a Flash, you simply type update-source and then update-fixes at the command prompt, and your system is brought current without missing a beat. The total server downtime is typically under 15 minutes!

Third, PBX in a Flash uses a two-step install process that all but eliminates the ISO obsolescence issues that have plagued other distributions. The PBX in a Flash ISO is used to install either the 32-bit or the 64-bit CentOS 5.5 operating system and kernel. When that process completes and after performing a yum update on CentOS 5.5, the installer then searches multiple sites on the Internet for our “payload files” which contain the latest, greatest versions of Asterisk to meet your specific requirements. The payload script also installs FreePBX and many of the customized features that make PBX in a Flash unique. If you need additional functionality, we have an entire web site, pbxinaflash.org, dedicated to add-on scripts. Most of these add-on scripts are available by typing help-pbx at the command prompt. All of them install without user intervention in a minute or two. Using this design, most bugs are eliminated as well without your having to do much of anything. Translation: More time to enjoy your production-quality VoIP PBX… and less all-nighters! Finally, if you’re new to Asterisk or just want to take advantage of a decade of expertise from the PIAF developers, just load the Incredible PBX over the top of your new PBX in a Flash install. In just 15 minutes, you’ll have an incredibly secure, turnkey PBX with dozens of add-on apps that can make and receive unlimited free calls in the U.S. and Canada thanks to Google Voice.

And, speaking of security, PBX in a Flash is the only distribution that brings you multiple layers of security out of the box. There’s the preconfigured Linux IPtables firewall. And, in addition, there’s the latest and greatest version of Fail2Ban which blocks malicious intruders attempting to guess your passwords and break into your system. We also strongly recommend adding a hardware-based firewall/router to block all access to your system unless you really know what you’re doing. Does all of this matter? Well, it’s your phone bill. Here’s a link to our article about a company that recently received an unexpected $120,000 phone bill in the mail. So you decide. If you read nothing else before embarking on your VoIP adventure, read our Primer on Asterisk Security!

So today we’re proud to introduce the 1.7.5.5 release of PBX in a Flash. It’s still the Lean, Mean Asterisk Machine designed to meet the needs of hobbyists as well as business users. And FreePBX 2.6 provides a rock-solid, graphical user interface to Asterisk that competes with any commercial PBX on the planet.

Getting Started with PBX in a Flash 1.7.5.5. Begin by downloading either the 32-bit or 64-bit ISO image for PBX in a Flash from SourceForge, Google, or from one of our download mirrors. Torrents are also available. And don’t worry. If you try to run the 64-bit install on a system that doesn’t support it, it’ll just sit there so you’ve got nothing to lose by trying the Ferrari first. Once you’ve got the ISO image in hand, use your favorite tool to burn it to a bootable CD. This next step is the most important. Do some reading!! There also are loads of helpful tutorials that are free for the downloading from our support site. Before you begin the install process, be aware that all drives (including USB devices) on your target system will be erased as part of the install process. So be sure to use a dedicated server for PBX in a Flash.

What About Hardware? If you’re new to all of this, let us recommend you try either one of Dell’s entry-level PowerEdge servers or one of the newer Intel Atom-based small-footprint PCs or netbooks such as the Acer Aspire One or Acer Aspire Revo. On sale pricing is typically in the $200-$300 range. You can save an additional 2% plus $5 by using our coupon link in the right margin. Any of these systems is just about perfect for a home or small business server.

Basic Install. Once you have your new system, just insert the CD containing the ISO and then reboot the machine you wish to dedicate to PBX in a Flash. After reading this tutorial and the initial prompts and warnings, choose an option and press the <Enter key> to begin the installation. Choose your default keyboard and then choose your time zone and leave the UTC system clock option unchecked. Next choose a root password for your new system. Make it secure, and write it down (not on your shoe). IMPORTANT: Your server must have its system clock set correctly and be connected to the Internet before the install process begins! In about 15 minutes depending upon the speed of your PC, the machine will reboot when the installation of CentOS 5.5 is complete. Be sure to eject the CD at this point, or your system will boot again from the CD and start over.

After the reboot, the system will boot CentOS 5.5 and then prompt you to choose the version of Asterisk you’d like to install. Here are the three choices:

A - GOLD with Asterisk 1.4.21.2 and Zaptel
B - SILVER with latest Asterisk 1.4 version and DAHDI
C - BRONZE with latest Asterisk 1.6.2 version and DAHDI

If you plan to expose your server to the Internet in any way, we recommend you choose the SILVER version which is the most secure. And just to repeat, if you don’t have Internet connectivity, then the installation cannot complete. When the installation finishes, reboot your system and log in as root. The IP address of your PBX in a Flash system will be displayed once you log in. If it’s blank, type service network restart after assuring that you have Internet connectivity and access to a DHCP server that hands out IP addresses. Typing ifconfig should display your IP address on the eth0 port. Write it down. We’ll need it in a minute.

Now that you’ve logged in as root, you should see the IP address displayed with the following command prompt: root@pbx:~/. If instead you see bash displayed as the command prompt and it’s not green, then the installation has not completed successfully. This is probably due to network problems but also could be caused by the time being set incorrectly on your server. You can’t compile Asterisk if the time on your computer is a date in the past! For this glitch you basically have to start over. If it’s a network issue, fix it and then reboot and watch for the eth0 connection to complete. Assuming it doesn’t fail the second time around, the installation will continue. Likewise, if you do not have DHCP on your network, the installation will fail because the PBX will not be given an IP address.

Three Steps to Complete the Install. There are three important things to do to complete the installation. First, run the following commands after logging into your new server as root with your root password:

update-scripts (gets the latest PIAF scripts)
update-fixes (applies PIAF security patches and bug-fixes)
passwd-master (sets your FreePBX maint password)

Second, from the command prompt, run genzaptelconf or gendahdiconf if you have ZAP/DAHDI hardware. This sets up your hardware as well as a timing source for conferencing. If you’re using additional hardware for your Asterisk system, we recommend removing any modem before you install the cards. This will help avoid interrupt conflicts.

Third, decide how to handle the IP address for your PBX in a Flash server. The default is DHCP, but you don’t want the IP address of your PBX changing. Phones and phone calls need to know how to find your PBX, and if your internal IP address changes because of DHCP, that’s a problem. You have two choices. Either set your router to always hand out the same DHCP address to your PBX in a Flash server by specifying its MAC address in the reserved IP address table of your router, or run netconfig at the command prompt and assign a permanent IP address to your server. Be aware that netconfig no longer is a part of CentOS 5.5. Run install-netconfig to reinstall it. If you experience problems with the process, see this message thread on the forum.

If you’ve used one of the dLink firewall/routers we recommend and you plan to install the Incredible PBX, you can skip the rest of this article. We’ve done all of the work for you!

The Incredible PBX Inventory. For those wondering what’s included with The Incredible PBX, here’s a feature list of components you get in addition to the base install of PBX in a Flash with CentOS 5.5, Asterisk, FreePBX 2.6, and Apache, SendMail, MySQL, PHP, phpMyAdmin, IPtables Linux firewall, Fail2Ban, and WebMin. Please note that A2Billing, Cepstral TTS, Hamachi VPN, and Mondo Backups are optional and may be installed using provided scripts.

If you’ve decided to roll your own and skip The Incredible PBX, then let’s continue…

Getting Rid of One-Way Audio. There are some settings you’ll need to add to /etc/asterisk/sip_custom.conf if you want to have reliable, two-way communications with Asterisk: nano -w /etc/asterisk/sip_custom.conf. The entries depend upon whether your Internet connection has a fixed IP address or a DHCP address issued by your provider. In the latter case, you also need to configure your router to support Dynamic DNS (DDNS) using a service such as dyndns.org. If you have a fixed IP address, then enter settings like the following using your actual public IP address and your private IP subnet:

externip=180.12.12.12
localnet=192.168.1.0/255.255.255.0     

If you have a public address that changes and you’re using DDNS, then the settings would look something like the following:

externhost=myserver.dyndns.org
localnet=192.168.0.0/255.255.255.0     

(NOTE: The first 3 octets in the above localnet entries need to match your private IP addresses!)

Once you’ve made your entries, save the file: Ctrl-X, Y, then Enter. Reload Asterisk: amportal restart. If you assigned a permanent IP address, reboot your server: shutdown -r now.

Be aware that some people experience problems with the externhost approach outlined above. If your provider only gives you a dynamic IP address, you still can use the externip approach above so long as you have a method to frequently verify your IP address. The approach we actually use on our home network is to run a little script every 5 minutes. If it finds that your outside IP address has changed, it will automatically update your sip_custom.conf file with the new address. To use our approach, create a file in /var/lib/asterisk/agi-bin names ip.sh. Here’s the code:2

#!/bin/bash
# File to log the IP Address
IPFILE=’/var/log/asterisk/externip’
# Your local lan ip block
localnet=192.168.1.0
# Nothing else needs to be changed.
if [ ! -f "$IPFILE" ]; then
echo “creating $IPFILE”
echo first_time_usage > $IPFILE
fi
lastip=`cat $IPFILE`
externip=$(curl -s -S –user-agent “PIAF 1.4″↩
http://myip.pbxinaflash.com | awk ‘NR==2′)
if [ $externip != $lastip ]; then
# Writes new IP address (if it has changed) to file.
echo “$externip” > $IPFILE
echo “externip=$externip” > /etc/asterisk/sip_custom.conf
echo “localnet=$localnet/255.255.255.0″ >>↩
/etc/asterisk/sip_custom.conf
echo “srvlookup=yes” >> /etc/asterisk/sip_custom.conf
echo “nat=yes” >> /etc/asterisk/sip_custom.conf
asterisk -rx “dialplan reload” ;
else
exit 0;
fi
exit;

On line 5, enter the internal subnet for your server as the localnet entry. This is usually 192.168.0.0 or 192.168.1.0. YMMV!

Save the file and give it execute permissions: chmod +x /var/lib/asterisk/agi-bin/ip.sh. Then make asterisk the file owner: chown asterisk:asterisk /var/lib/asterisk/agi-bin/ip.sh.

Finally, add the following entry to the bottom of /etc/crontab:

*/5 * * * * asterisk /var/lib/asterisk/agi-bin/ip.sh > /dev/null

Activating Email Delivery of Voicemail Messages. We’ve previously shown how to configure systems to reliably deliver email messages whenever a voicemail arrives unless your ISP happens to block downstream SMTP mail servers. Here’s the link in case you need it. As it happens, you really don’t have to use a real fully-qualified domain name to get this working. So long as the entry (such as pbx.dyndns.org) is inserted in both the /etc/hosts file and /etc/asterisk/vm_general.inc with a matching servermail entry of vm@pbx.dyndns.org (as explained in the link above), your system will reliably send emails to you whenever you get a voicemail if you configure your extensions in FreePBX to support this capability. You can, of course, put in real host entries if you prefer. For 90% of the systems around the world, if you just want your server to reliably e-mail you your voicemail messages, make line 3 of /etc/hosts look like this with a tab after 127.0.0.1 and spaces between the domain names:

127.0.0.1     pbx.dyndns.org pbx.local pbx localhost.localdomain localhost

And then make line 6 of /etc/asterisk/vm_general.inc look like the following:

serveremail=voicemail@pbx.dyndns.org

Now issue the following two commands to make the changes take effect:

service network restart
amportal restart

The command “setup-mail” can be used from the Linux prompt to set the fully-qualified domain name (FQDN) of the mail that is sent out from your server. This may help mail to be delivered from the PBX. One of things mail servers do to reduce spam is to do a reverse lookup on where the mail has come from, checking that there is actually a mailserver at the other end. You can only do this if you have set up dynamic DNS or if you have pointed a hostname at your fixed IP address. Once you have done this, and assuming your ISP is cooperative, then you will receive your voicemails via email if you wish (this is set within FreePBX),and your PBX will email you when FreePBX needs an update. You set this feature in FreePBX General Settings.

If your hosting provider blocks downstream SMTP servers to reduce spam, here’s a simple way to use your Gmail account (free!) as your SMTP Relay Host. Then you never have to worry about this again!

Setting Passwords and Other Stuff. Be aware that major security issues are reported from time to time with FreePBX. We strongly recommend that you not use FreePBX admin security alone to protect your system from a web attack. It may compromise root access to your entire server. For this reason, we recommend that you log in as root and immediately run passwd-master after completing the update-scripts and update-fixes scenario. This establishes Apache htaccess security on your FreePBX web interface. After running this conversion utility, you can only log into the FreePBX admin interface with the username maint (not admin) and the password which you establish when you run the utility.

Other passwords can be set in your system with these commands:

passwd… reset your root user password
passwd-maint… reset your FreePBX maint password
passwd-wwwadmin… for users needing FOP and MeetMe access
passwd-meetme… for users needing only MeetMe access
passwd-webmin… for users needing WebMin access to your server (very dangerous!)

There’s also an Administration password that you can set in the KennonSoft UI that displays when you point your browser to the IP address of your server. Do NOT use the same password here that you use elsewhere as it is not overly secure.

Configuring WebMin. WebMin is the Swiss Army Knife of Linux. It provides TOTAL access to your system through a web interface. Search Nerd Vittles for webmin if you want more information. Be very careful if you decide to enable it on the public Internet. You do this by opening port 9001 on your router and pointing it to the private IP address of your PBX in a Flash server. Before using WebMin, you need to set up a username and password for access. From the Linux prompt while logged in as root, type the following command where admin is the username you wish to set up and foo is the password you’ve chosen for the admininstrator account. HINT: Don’t use admin and foo as your username and password for WebMin unless you want your server trashed!

/usr/libexec/webmin/changepass.pl /etc/webmin root password

To access WebMin on your private network, go to http://192.168.0.123:9001 where 192.168.0.123 is the private IP address of your PBX in a Flash server. Then type the username and password you assigned above to gain entry. To stop WebMin: /etc/webmin/stop. To start WebMin: /etc/webmin/start. For complete documentation, go here.

Updating and Configuring FreePBX. FreePBX 2.6 is installed as part of the PBX in a Flash 1.7.5.5 implementation. This incredible, web-based tool provides a complete menu-driven user interface to Asterisk. The entire FreePBX project is a model of how open source development projects ought to work. And having Philippe Lindheimer’s as the Captain of the Ship is just icing on the cake. All it takes to get started with FreePBX is a few minutes of configuration, and you’ll have a functioning Asterisk PBX complete with voicemail, music on hold, call forwarding, and a powerful interactive voice response (IVR) system. There is excellent documentation for FreePBX which you should read at your earliest convenience. It will answer 99% of your questions about how to use and configure FreePBX. For the one percent that is not covered in the Guide, visit the FreePBX Forums which are frequented regularly by the FreePBX developers. Kindly post FreePBX questions on their forum rather than the PBX in a Flash Forum. This helps everybody. Now let’s get started.

Now move to a PC or Mac and, using your favorite web browser, go to the IP address you deciphered above for your new server. Be aware that FreePBX has a difficult time displaying properly with IE6 and IE7 and regularly blows up with older versions of Safari. Be safe. Use Firefox. From the PBX in a Flash Main Menu in your web browser, click on the Administration link and then click the FreePBX button. Once FreePBX loads, click the Module Administration option in the left frame. Now click Check for Updates online in the upper right panel. Next, click Download All which will select all but two modules for download and install. Scroll to the bottom of the page and click Process, then Confirm, then Return. Now repeat the process once more, then Process, Confirm, Return, Apply Config Changes, and Continue with Reload. Finally, scroll down the Modules listing until you get to the Maintenance section. Click on each of the following and choose Install: ConfigEdit, Sys Info, and phpMyAdmin. Then click Process, then Confirm, then Return once the apps are downloaded and installed, then Apply, then Continue with Reload. All three of these tools now are installed in the Maintenance section of the Tools tab of FreePBX. You now have an up-to-date version of FreePBX. You’ll need to repeat the drill every few weeks as new updates are released. This will assure that you have all of the latest and greatest software. To change your Admin password, click on the Setup tab in the left frame, then click Administrators, then Admin in the far right column, enter a new password, and click Submit Changes, Apply Configuration Changes, and Continue with reload. We’re going to be repeating this process a number of times in the next section so… when instructed to Save Your Changes, that means “click Submit Changes, Apply Configuration Changes, and Continue with reload.” Finally, don’t worry about the warnings alerting you that you’re using default passwords. Your system is behind a secure firewall, and these passwords are only accessible to someone that has access to your system and has your root password.

Choosing Internet Telephony Hosting Providers for Your System. Before you can place calls to users outside your system or to receive incoming calls, you’ll need at least one provider (each) for your incoming phone number (DID) and incoming calls as well as a provider for your outbound calls (terminations). We have a list of some of our favorites here, and there are many, many others. You basically have two choices with most providers. You can either pay as you go or sign up for an all-you-can-eat plan. Most of the latter plans also have caps on minutes so it’s more akin to all-they-care-for-you-to-eat, and there are none of the latter plans for business service. In the U.S. market, the going rate for pay as you go service is about 1.5¢ per minute rounded to the tenth of a minute. The best deal on DIDs is from Vitelity. They charge $3.99 a month for a DID with unlimited, free incoming calls. There’s a link to the Nerd Vittles discount on this service for PBX in a Flash users below.

Before you sign up for any all-you-can-eat plan, do some reading about the service providers. Some of them are real scam artists with backbilling and all sorts of unconscionable restrictions. You need to be careful. Our cardinal rule in the VoIP Wild West is never, ever entrust your entire PBX to a single hosting provider. As Forrest Gump would say, "Stuff happens!" And life’s too short to have dead telephones, even if it’s a rarity.

Setting Up FreePBX to Make Your First Call. There are four components in FreePBX that need to be configured before you can place a call or receive one from outside your PBX in a Flash system. So here’s FreePBX for Dummies in less than 50 words. You need to configure Trunks, Extensions, Outbound Routes, and Inbound Routes. Trunks are hosting provider specifications that get calls delivered to and transported from your PBX to the rest of the world. Extensions are internal numbers on your PBX that connect your PBX to telephone hardware or softphones. Inbound Routes specify what should be done with calls coming in on a Trunk. Outbound Routes specify what should be done with calls going out to a Trunk. Everything else is bells and whistles.

Trunks. When you sign up with most of the better ITHP’s that support Asterisk, they will provide documentation on how to connect their service with your Asterisk system. If they have a trixbox tutorial, use that since it also uses FreePBX as the web front end to Asterisk. Here’s an example from les.net. And here’s the Vitelity support page although you will need to set up an account before you can access it. We also have covered the setups for a number of providers in previous articles. Just search the Nerd Vittles site for the name of the provider you wish to use. You’ll also find many Trunk setups in the trixbox Trunk Forum. Once you find the setup for your provider, add it in FreePBX by going to Setup, Trunks, Add SIP Trunk. Our AxVoice setup (which is all entered in the Outgoing section with a label of axvoice) looks like this with a Registration String of yourusername:yourpassword@sip.axvoice.com:

allow=ulaw
authname=yourusername
canreinvite=no
context=all-incoming
defaultip=sip.axvoice.com
disallow=all
dtmfmode=inband
fromdomain=sip.axvoice.com
fromuser=yourusername
host=sip.axvoice.com
insecure=very
nat=yes
secret=yourpassword
type=friend
user=phone
username=yourusername

And our Vitelity Outbound Trunk looks like the following (labeled vitel-outbound) with no registration string:

allow=ulaw&gsm
canreinvite=no
context=from-pstn
disallow=all
fromuser=yourusername
host=outbound1.vitelity.net
secret=yourpassword
sendrpid=yes
trustrpid=yes
type=friend
username=yourusername

Extensions. Now let’s set up a couple of Extensions to get you started. A good rule of thumb for systems with less than 50 extensions is to reserve the IP addresses from 192.x.x.201 to 192.x.x.250 for your phones. Then you can create extension numbers in FreePBX to match those IP addresses. This makes it easy to identify which phone on your system goes with which IP address and makes it easy for end-users to access the phone’s GUI to add bells and whistles. To create extension 201 (don’t start with 200), click Setup, Extensions, Generic SIP Device, Submit. Then fill in the following blanks USING VERY SECURE PASSWORDS and leaving the defaults in the other fields for the time being.

User Extension … 201
Display Name … Home
Outbound CID … [your 10-digit phone number if you have one; otherwise, leave blank]
Emergency CID … [your 10-digit phone number for 911 ID if you have one; otherwise, leave blank]
Device Options
secret … 1299864 < -- make this unique AND secure!
dtmfmode … rfc2833
Voicemail & Directory … Enabled
voicemail password … 1299864 <-- make this unique AND secure!
email address … yourname@yourdomain.com [if you want voicemail messages emailed to you]
pager email address … yourname@yourdomain.com [if you want to be paged when voicemail messages arrive]
email attachment … yes [if you want the voicemail message included in the email message]
play CID … yes [if you want the CallerID played when you retrieve a message]
play envelope … yes [if you want the date/time of the message played before the message is read to you]
delete Vmail … yes [if you want the voicemail message deleted after it's emailed to you]
vm options … callback=from-internal [to enable automatic callbacks by pressing 3,2 after playing a voicemail message]
vm context … default

Now create several more extensions using the template above: 202, 203, 204, and 205 would be a good start. Keep the passwords simple. You’ll need them whenever you configure your phone instruments.

Extension Security. We cannot overstress the need to make your extension passwords secure. All the firewalls in the world won’t protect you from malicious phone calls on your nickel if you use your extension number or something like 1234 for your extension password because the SIP and IAX ports typically are exposed to allow connections to your providers. In addition to making up secure passwords, the latest version of FreePBX also lets you define the IP address or subnet that can access each of your extensions. Use it!!! Once the extensions are created, edit each one and modify the permit field to specify the actual IP address or subnet of each phone on your system. A specific IP address entry should look like this: 192.168.1.142/255.255.255.255. If most of your phones are on a private LAN, you may prefer to use a subnet entry like this: 192.168.1.0/255.255.255.0 using your actual subnet, of course.

Outbound Routes. The idea behind multiple outbound routes is to save money. Some providers are cheaper to some places than others. We’re going to skip that tutorial today. You can search the site for lots of information on choosing providers. Assuming you have only one or two for starters, let’s just set up a default outbound route for all your calls. Using your web browser, access FreePBX on your server and click Setup, Outbound Routes. Enter a route name of Everything. Enter the dial patterns for your outbound calls. In the U.S., you’d enter something like the following:

1NXXNXXXXXX
NXXNXXXXXX

Click on the Trunk Sequence pull-down and choose your providers in the order you’d like them to be used for outbound calls.Click Submit Changes and then save your changes. Note that a second choice in trunk sequence only gets used if the calls fail to go through using your first choice. You’ll notice there’s already a 9_outside route which we don’t need. Click on it and then choose Delete Route 9_outside. Save your changes.

Inbound Routes. We’re also going to abbreviate the inbound routes tutorial just to get you going quickly today. The idea here is that you can have multiple DIDs (phone numbers) that get routed to different extensions or ring groups or departments. For today, we recommend you first build a Ring Group with all of the extension numbers you have created. Once you’ve done that, choose Inbound Routes, leave all of the settings at their default values and move to the Set Destination section and choose your Ring Group as the destination. Now click Submit and save your changes. That will set up a default incoming route for your calls. As you add bells and whistles to your system, you can move the Default Route down the list of priorities so that it only catches calls that aren’t processed with other inbound routing rules.

General Settings. Last, but not least, we need to enter an email address for you so that you are notified when new FreePBX updates are released. Scroll to the bottom of the General Settings screen after selecting it from the left panel. Plug in your email address, click Submit, and save your changes. Done!

Adding Plain Old Phones. Before your new PBX will be of much use, you’re going to need something to make and receive calls, i.e. a telephone. For today, you’ve got several choices: a POTS phone, a softphone, or a SIP phone. Option #1 and the best home solution is to use a Plain Old Telephone or your favorite cordless phone set (with 8-10 extensions) if you purchase a little device known as a Sipura SPA-3102. It’s under $70. Be sure you specify that you want an unlocked device, meaning it doesn’t force you to use a particular service provider. This device also supports connection of your PBX to a standard office or home phone line as well as a telephone.

Downloading a Free Softphone. Unless you already have an IP phone, the easiest way to get started and make sure everything is working is to install an IP softphone. You can download a softphone for Windows, Mac, or Linux from CounterPath. Or download the pulver.Communicator or the snom 360 Softphone which is a replica of perhaps the best IP phone on the planet. Here’s another great SIP/IAX softphone for all platforms that’s great, too, and it requires no installation: Zoiper 2.0 (formerly IDEfisk). All are free! Just install and then configure with the IP address of your PBX in a Flash server. For username and password, use one of the extension numbers and passwords which you set up with freePBX. Once you make a few test calls, don’t waste any more time. Buy a decent SIP telephone. Visit the PBX in a Flash Forum for lots of suggestions on telephones. Our personal favorite and the phone that PBX in a Flash officially supports is the Aastra 57i or 57iCT which also includes cordless DECT phone. Do some reading before you buy.

Where To Go From Here. The PBX in a Flash script repository at pbxinaflash.org also has gotten a facelift. That should be your next stop because it is the home of all the goodies that make PBX in a Flash shine. Tom King, the ultimate scripting guru, manages that site. So check it often. You’ll also find all of our Nerd Vittles Goodies work with this new release. Most of our original collection work flawlessly with Asterisk 1.4 including AsteriDex, Yahoo News Headlines, Weather by Airport Code, Weather by Zip Code, Worldwide Weather Forecasts, Telephone Reminders, MailCall for Asterisk, and TeleYapper. We have not yet completed testing with Asterisk 1.6, but most should work. Complete documentation for each application also is provided at the link above. And, if you still have a DBT-120 Bluetooth adapter, you’ll be happy to learn that it works out-of-the-box with PBX in a Flash. Dust off our recent article on Proximity Detection, and you should be in business in under 10 minutes. Enjoy!


New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you’re seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity’s DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here’s a deal you can’t (and shouldn’t) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won’t get the special pricing! After the free hour of outbound calling, Vitelity’s rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest…

  1. For Asterisk 1.6 or for 64-bit systems with Asterisk 1.4 or 1.6, use the Cepstral install procedures outlined in this Nerd Vittles article. []
  2. Join the following line to the original line of code whenever you encounter the ↩ character. []

The Incredible PBX: Remote Phone Meets the Travelin’ Man

Ever wrestled with one of those thorny problems for weeks only to wake up in the middle of the night with the answer? Thus was born Travelin’ Man, a web- based, one-click Asterisk application that automatically reconfigures your Asterisk PBX to enable remote SIP phone access from your cellphone, iPad, remote PC, NetBook, or desktop telephone.

If you’ve read the Incredible PBX series of articles on Nerd Vittles, you already know what a thorny problem remote phone access is if you want to preserve the overall security of your server. Indeed, our recommendation has been to leave SIP access closed on your hardware-based firewall because of the dangers inherent in activating remote SIP access. Now we have a better idea!

Today’s new approach works like this. First, we’ll run a little script that secures all of your extensions with permit entries locking down all these connections to the IP address range within your private network. Then we’ll open the SIP and RTP ports on your hardware and software firewalls and map these ports to your Asterisk server’s private IP address. With this setup, no one can attempt remote SIP logins to your server because Asterisk blocks all SIP extension connection attempts except those originating inside your LAN. To manage external phone connections to your server, the install script creates a new virtual Apache web server on your Incredible PBX using port 83. We’ll enable and map TCP port 83 on your hardware and software firewalls to your server as well. Web access with port 83 is limited to running the Travelin’ Man app to activate external phones.

Now we’re ready to set up access to your server for remote devices. For each extension you wish to enable for remote access, we’ll create a special web directory using an obscure, random file name which will serve as the web link for the Travelin’ Man web app. For example, in the diagram above, directory 184778 manages extension 501, directory 2389957h manages extension 701, and directory 6993h5j manages extension 702. This is accomplished by simply changing the extension number in the index.php script stored in each directory.

When one of these web links is accessed remotely, the PHP script will automatically reconfigure Asterisk to enable access to the designated SIP extension on your server using the remote IP address from which the web page was accessed. And, of course, there’s an additional layer of SIP security as well. You still need your extension credentials to actually log in to your server with a softphone to place and receive calls. The Travelin’ Man installation process takes only a couple minutes, and the remote SIP activation procedure takes just a couple seconds each time you want remote access from a different location. Here’s a quick example of how it actually works.

Let’s assume we want to use the new $3.95 Bria SIP softphone on an iPad to connect as extension 501 on our Incredible PBX back at home. The problem is that the dynamic IP address of your iPad changes at each new site on your itinerary. Some locations have WiFi while others only have 3G connections.

First, we’ll generate an icon to run Travelin’ Man from your iPad desktop. Use the same procedure with an iPhone or iPod Touch, and there’s a similar procedure for Android devices.1 You only have to do this once. Start up Safari on the iPad to access the new port 83 web server at the random web address the installer created to support extension 501. That web address is something like this using your own FQDN2: http://myserver.dyndns.org:83/184778. After establishing the link once, we’ll hit the + button in Safari and choose Add to Home Screen. This creates the TravelMan icon on the iPad. See the screenshot below of our demo iPad setup which used extension 221 instead of 501.

Once configured, it’s just two clicks to enable your remote phone anywhere: click once on the TravelMan icon. When your IP address is confirmed, return to your Home Screen and click the Bria softphone icon to establish a SIP connection back to your server. Behind the scenes, the Travelin’ Man application will generate the required permit entry for your remote IP address mapping it to the designated extension on your server, and then it will reload your SIP settings to make your Asterisk server accessible to the Bria softphone in your hotel room. The entire process takes only a couple seconds.

If your company happens to have a dozen traveling salesmen, then you’d simply assign a dedicated extension to each employee and create secure directory names for each person (e.g. 2389957h and 6993h5j in diagram above) with a copy of the Travelin’ Man app configured for that employee’s extension number. Now your entire mobile workforce has connectivity back to the home office from any location on the globe. And, when an employee leaves the company and another arrives, just create a new name for the old employee’s web directory to preserve the security of your system (e.g. 184778 in our example becomes 78hd773). Keep in mind that each time the Travelin’ Man app is run for any extension, it wipes out any previously authorized IP address entry for that extension. Thus, the security of your Incredible PBX is always preserved.

Prerequisites. Before proceeding with today’s install, you must be running a stock install of Incredible PBX with PBX in a Flash behind a properly-secured, hardware-based firewall3. We recommend the latest version of Asterisk 1.4 because it addresses a SIP vulnerability that might cause you problems if malformed SIP packets are targeted at your server. The current release of PBX in a Flash (1.7.5.5 Silver) is ideal, but any version of PBX in a Flash can be brought current with Asterisk using the update-source and update-fixes tools. Travelin’ Man assumes that you have the Incredible PBX base install of extensions: 501 plus 701-715. You can obviously add more or remove some, but you’ll need to manually adjust sip_custom_post.conf to reflect your actual extension list after the install completes.

The installer has been encrypted for your/our own protection. In source form, the script would allow anyone to defeat the Incredible PBX requirement. Doing so would mean the required IPtables security component would not be in place and properly configured to protect the underlying system from attack. So we’ve opted to play Big Brother to avoid potential security problems for all of us down the road. This article clearly explains all the necessary components if some folks want to roll their own version. We just don’t want the responsibility if something goes horribly wrong. As Forrest Gump would say, “Shit Happens.” :-) If you don’t believe it, check out the latest security scramble in the trixbox forums.

Installation. Now we’re ready to get started. So log into your Incredible PBX as root and issue the following commands:

cd /root
wget http://incrediblepbx.com/travelinman.tar.gz
tar zxvf travelinman.tar.gz
./travelinman.x

The first step in the install procedure is to lock down access to all of your extensions to your private LAN subnet. In case you ever want to do this on another server not running the Incredible PBX, here’s a link to our privip.sh shell script that shows how to do it. This should work on most FreePBX-based Asterisk systems.

Once the extensions are locked down, the script will modify your IPtables and Apache configurations to permit web access on port 83. Next, it will adjust your Asterisk setup to support the Travelin’ Man permit scheme. This involves reworking of sip_custom_post.conf so that permit settings for individual extensions can be stored in files named 501.inc, 701.inc, etc. Finally, the installation procedure will set up a single web site to support extension 501 with a randomized directory name for remote access.4 This setup will be stored in /var/www/travelman. To activate support for additional extensions, you would simply copy the subdirectory giving it a new random name: cp -r dir1 dir2. Then edit config.php in the new subdirectory and change the $extension entry.

To complete the install, you must reconfigure your hardware-based firewall and map the following ports to the private IP address of your server:

TCP 83
UDP 5060
UDP 10000-20000

When the installation is completed, it will show you how to access the new web site for extension 501 using either a fully-qualified domain name or a public or private IP address. Now just follow the steps at the beginning of this article to set up your Android or iDevice, and test things out. Enjoy!

Reminders: Be sure to review the comments to this article and the related support forum thread for a week or two for late-breaking enhancements and issues. Also, Incredible PBX comes preconfigured with call forwarding activated for extension 501. Don’t forget to either disable it or set up a real call forwarding number for extension 501 if you want your cellphone to ring. From any extension on your server, just dial *72501 to set up call forwarding. To cancel call forwarding and pass calls directly to the registered 501 softphone, dial *74 and enter 501. Also be aware that the default RingAll ring group (700) configuration on Incredible PBX systems does not include extension 501. So add 501 if you want your remote extension to ring for incoming calls.


The Incredible PBX: Basic Installation Guide

Adding Skype to The Incredible PBX

Adding Incredible Backup… and Restore to The Incredible PBX

Adding Multiple Google Voice Trunks to The Incredible PBX

Adding Remotes, Preserving Security with Incredible PBX

Continue reading Basic Installation Guide, Part II.

Continue reading Basic Installation Guide, Part III.

Continue reading Basic Installation Guide, Part IV.

Support Issues. With any application as sophisticated as this one, you’re bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It’s the best Asterisk tech support site in the business, and it’s all free! We maintain a thread with the latest Patches and Bug Fixes for Incredible PBX. Please have a look. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of ordinary users just like you. So you won’t have to wait long for an answer to your questions.




Need help with Asterisk? Visit the PBX in a Flash Forum.
Or Try the New, Free PBX in a Flash Conference Bridge.


whos.amung.us If you’re wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what’s happening. It’s a terrific resource both for us and for you.


 
New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you’re seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity’s DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here’s a deal you can’t (and shouldn’t) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won’t get the special pricing! After the free hour of outbound calling, Vitelity’s rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest…

  1. To create a desktop icon for Travelin’ Man on Android devices, navigate to the link with your browser. Then save the link as a Bookmark by clicking the Star icon in your browser then click Add. Return to the Home Screen and, from the screen on which you wish to add the icon, touch and hold your finger on the screen. When the Add to Home Screen menu appears, choose Shortcuts then Bookmarks and select the link you previously saved. As with iDevices, you only have to do this once. []
  2. FQDN = Fully-qualified domain name []
  3. We recommend the dLink Router/Firewall. Low Cost: $35 WBR-2310  Best: DGL-4500 []
  4. If you’d like to download the web site code independently from the Travelin’ Man install procedure, here’s the link. []

The Incredible PBX: Adding Remotes, Preserving Security

Unlike most Asterisk-based PBXs which are insecure as installed and leave it to you to implement sufficient safeguards to preserve the integrity of your system, the Incredible PBX is delivered with rock-solid, air-tight security already in place. Because it is designed to operate behind a hardware- based firewall, what you'll be doing when you want to add functionality with the Incredible PBX is loosening security rather than tightening it. The trick, of course, is to do it in a way that doesn't compromise the overall integrity of your system. As delivered, the Incredible PBX relies upon four layers of network security: a hardware-based firewall of your choice1, a preconfigured IPtables software-based Linux firewall, preconfigured Fail2Ban to monitor your logs for suspicious activity and to block specific IP addresses when abuse is detected, and random passwords for all extensions and DISA connections.

If you installed the Incredible PBX using SIPgate as the intermediate provider with Google Voice, then your hardware-based firewall should have no ports opened and forwarded to your server. If you used IPkall, then only UDP 4569 has been opened and forwarded to your server. And the Incredible PBX IPtables setup for IAX restricts access to just a few IP addresses to support IPkall.

There are obviously situations in which you will want or need additional connectivity. The most likely one involves activation of SIP telephones at remote locations, such as a branch office, or Grandma's house or a relative in college. The other obvious use is with cellphones and PDAs that support SIP clients such as Android phones, iPhones, and iPads.2

What we'd recommend you not do is open the SIP floodgate to your PBX by providing unrestricted inbound SIP access, but we'll show you how if you really want or need this functionality. As desirable as this can be, it is accompanied by an array of security issues that really are not worth the risks unless you know what you're doing and you're willing to stay on top of security updates and keep your system patched.

Let's first tackle how to provide limited inbound SIP functionality without selling the farm. If the remote site has a fixed IP address, the procedure to allow remote access to your server is fairly straight-forward: just map the SIP ports on the hardware-based firewall to your server (UDP 5000:5082 and UDP 10000:20000) and then restrict SIP access using IPtables to the remote IP address as well as the subnet of your private LAN. You can decipher your private subnet by running status. If your server's IP address is 192.168.0.123, then your private subnet would be 192.168.0.0. The IPtables firewall settings are stored in /etc/sysconfig/iptables. Edit that file and find the line that looks like this:

-A INPUT -p udp -m udp --dport 5000:5082 -j ACCEPT

Delete or comment out this entry with a leading # and insert new entries that look like the following using the public IP address(es) you wish to add plus the private subnet:

-A INPUT -p udp -m udp -s 141.146.20.10 --dport 5000:5082 -j ACCEPT
-A INPUT -p udp -m udp -s 141.146.20.11 --dport 5000:5082 -j ACCEPT
-A INPUT -p udp -m udp -s 192.168.0.0/255.255.0.0 --dport 5000:5082 -j ACCEPT


After making the changes, save the file: Ctrl-X, Y, then Enter. Then restart IPtables: service iptables restart.

Unfortunately, in many situations, the remote phone or cellphone uses an Internet connection with a dynamic IP address. So we don't know the actual IP address that will be assigned. There are a number of solutions to this problem, and we'll rank them in our order of preference. First, spend the $200 and install another Incredible PBX at the remote site. Then the two servers can be linked with IAX connections between the servers making connectivity between the systems totally transparent. Second, install VPN routers at both sites and use a private IP address to establish connectivity with the host system. In this situation, you will have the equivalent of a fixed IP address for the remote device which makes it the equivalent of the fixed IP address solution above. Third, install OpenVPN on your host system and purchase a SIP phone or cellphone that supports VPN connectivity. Most of the high-end SNOM SIP phones have this functionality as do Android phones, iPhones, and iPads. With this setup you also have the equivalent of a fixed IP address, even though it's on a virtual private network. Fourth, talk to the Internet service provider at your remote site and obtain the range of IP addresses that DHCP hands out to those using their services... or just make an educated guess.3

BEFORE Activating Full SIP Connectivity. OK. We hear you. You travel for a living, and the IP address of your cellphone changes hourly, all day, every day of the year. Then, yes, you are a candidate for a full-fledged Asterisk server with unlimited SIP access. Before covering how, let's review what responsibilities go with running such a server. Bear in mind that one compromised SIP password or otherwise vulnerable application on your server (including Asterisk, FreePBX, SSH, and hundreds of others), and you may very well be the proud owner of a whopping phone bill. And we're not talking hundreds of dollars. It could very well be tens of thousands of dollars. And it doesn't take weeks or months. It could be a few hours.

Baker's Dozen SIP Security Checklist

1. Keep Asterisk Current & Patched
2. Keep FreePBX Current & Patched
3. Make Frequent Backups
4. Visit PBX in a Flash Forums Regularly
5. Subscribe to PBX in a Flash RSS Feed
6. Secure Alphanumeric Extension Passwords
7. Secure DISA, VMail, Root, FreePBX Passwords
8. Lock Down Extensions with Deny/Permit
9. Turn Off Recurring Payments with Providers
10. Restrict Trunks to 1-2 Simultaneous Calls
11. Tighten Dialplan by Removing Wildcards
12. Eliminate Intl & Toll Calls With Providers
13. Check FreePBX Call Logs Daily for Abuse

Baker's Dozen SIP Security Checklist. Before opening the floodgates, let's review what you need to do. First, you'll need to run the very latest version of Asterisk... all the time. This means you need to monitor asterisk.org, and keep your system up to date by running update-scripts, update-source, and update-fixes regularly. The default version of Asterisk on current PBX in a Flash and Incredible PBX builds is extremely reliable, but it contains SIP and IAX vulnerabilities which should not be exposed directly to the Internet! Second, you need to run the latest version of FreePBX and apply all patches as they are released. Third, you need to make frequent backups appreciating that sometimes the Asterisk and FreePBX developers get things horribly wrong, and stuff that used to work no longer does. Believe it or not, they're human! Fourth, you need to visit the PBX in a Flash Forums daily and keep abreast of security alerts and bug reports on CentOS, Asterisk, and FreePBX. Fifth, you need to subscribe to the PBX in a Flash RSS Feed which provides regular security alerts when there are reported problems. Sixth, you need to really secure your extension passwords with very long, complex alphanumeric passwords. Ditto for your root and FreePBX passwords! Seventh, for DISA and voicemail, these passwords need to be numeric, complex, and extra long. Eighth, you need to lock down as many of your extensions as possible with deny/permit settings to restrict the IP addresses of those extensions. If you only have one or two remote SIP extensions with dynamic IP addresses, then all of the rest should have deny/permit entries! Ninth, turn off recurring payments with all of your telephony providers and keep minimal funds available in all of your accounts. This means you'll have to monitor these accounts to make sure they are not deactivated for lack of funds. Tenth, restrict all of your trunks to one or at most two simultaneous calls to reduce your call exposure in the event someone breaks into your system. Eleventh, tighten up your Trunk Dial Rules and eliminate any entries that would permit calls to anywhere in the world! If you don't regularly make international calls, there's absolutely no reason to have such entries in your dialplan. If you still have Ma Bell PSTN lines, this is even more important. In fact, consider eliminating long distance access to all of these trunks. Twelfth, where possible, configure your provider accounts to eliminate international and toll calls of all varieties. Finally, check your FreePBX call log every day to make certain no one is making calls on your nickel.

If you are unwilling or unable to perform these Baker's Dozen steps while continuing to monitor the sites provided and recheck your setup regularly (at least every week), don't activate unrestricted SIP access to your server.

Other Options. Consider using an intermediate provider such as voip.ms to provide SIP URI access to your server. Keep in mind that having a registered connection between your server and a VoIP provider alleviates the need to punch a hole in your firewall. So the idea here is to sign up for an inexpensive voip.ms account and set up the trunk connection with your server as either an IAX or SIP account with an always-on connection. Then voip.ms gives you the option of activating a SIP URI as part of a subaccount setup. Just create an internal extension on their server, and this will generate a SIP URI, e.g. 123456666@sip.us4.voip.ms where 12345 is your voip.ms account number and 6666 is the internal extension you created. This lets you connect directly with your server through the SIP URI from anywhere once you map this subaccount to an extension or IVR on your server. The charge for SIP URI calls is only $.001 per minute. The last step is to use this SIP URI in your remote SIP phone to connect back to your server. You can take advantage of the full range of Asterisk functions once these calls reach your server including IVRs and DISA. The approach is not only simple to implement, but it's also safe and economical.

There are some other alternatives as well. Use something like Google Voice or Ooma to redirect calls to your cellphone when you're traveling. Or buy an Ooma for Grandma or a MagicJack for Joe College. These options also are safe, secure, and quite inexpensive.

Just Released: Remote Phone Meets Travelin' Man

Activating Inbound SIP on Your Server. If you still are hell-bent on opening SIP access to your server, the Incredible PBX already is preconfigured to support it. Just map the SIP ports on your hardware- based firewall to your server (UDP 5000:5082 and UDP 10000:20000). Once activated, anyone can reach you through the following SIP URI using the actual public IP address of your server: mothership@12.34.56.78. You also can adjust the e164 trunk in FreePBX to route inbound calls to any destination desired. Then register your phone number on e164.org and others can call you at no cost using your traditional phone number. Enjoy!


The Incredible PBX: Basic Installation Guide

Adding Skype to The Incredible PBX

Adding Incredible Backup... and Restore to The Incredible PBX

Adding Multiple Google Voice Trunks to The Incredible PBX

Remote Phone Meets Travelin' Man with The Incredible PBX

Continue reading Basic Installation Guide, Part II.

Continue reading Basic Installation Guide, Part III.

Continue reading Basic Installation Guide, Part IV.

Support Issues. With any application as sophisticated as this one, you're bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It's the best Asterisk tech support site in the business, and it's all free! We maintain a thread with the latest Patches and Bug Fixes for Incredible PBX. Please have a look. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of ordinary users just like you. So you won't have to wait long for an answer to your questions.




Need help with Asterisk? Visit the PBX in a Flash Forum.
Or Try the New, Free PBX in a Flash Conference Bridge.


whos.amung.us If you're wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what's happening. It's a terrific resource both for us and for you.


 
New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you're seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity's DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here's a deal you can't (and shouldn't) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won't get the special pricing! After the free hour of outbound calling, Vitelity's rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest...

  1. We, of course, continue to recommend a dLink Router/Firewall. Low Cost: $35 WBR-2310  Better: DIR-825  Best: DGL-4500 []
  2. We recommend the free SipAgent client for Android devices and the commercial Acrobits Softphone for iPods and iPads. []
  3. Adding an entry like the following would dramatically reduce the likelihood of a SIP attack: -A INPUT -p udp -m udp -s 141.146.0.0/255.255.0.0 --dport 5000:5082 -j ACCEPT []

The Incredible PBX: Adding Multiple Google Voice Trunks

About the only drawback to Google Voice's free U.S. and Canada calling with the Incredible PBX has been the fact that you could only make one outbound call at a time... at least on Google's nickel. So today we'll fix that, and you can enjoy simultaneous outbound calls using as many Google Voice trunks as you have signed up for. If you're in the U.S., you're eligible and no invitation is required. Just head over to the Google Voice site to register.

Today's Incredible PBX enhancement also will permit you to set up multiple inbound DIDs for different area codes across the country which may save your out-of-town friends and relatives a little change when they want to contact you. And to think we had $200 a month phone bills in our college days just to call the hometown honey. The wonders of modern technology!

Prerequisites. Here's what you'll need to get started today. First, you need a functioning Incredible PBX. So start by installing Incredible PBX. Second, you'll need a second Google Voice account. And finally, you'll need an additional SIPgate One number.

Installation Assumptions. We'll walk you through the steps to get a second account activated with the Incredible PBX. If you need more than two, just repeat the steps below and substitute a new number for 2 in every step. As with baking cookies, if you skip a step, the cookies taste like crap. :-) For security reasons, we're using an additional SIPgate One account for the second setup. This avoids having to open up SIP access in your firewall which would require additional locking down of IPtables to specific SIP IP addresses.

Setting Up New SIPgate and Google Voice Accounts. As was true with the initial Incredible PBX setup, the first steps in activating a second line are to create and configure your SIPgate account and then tie that number into your new Google Voice account. For ease of reference, we've repeated below the pertinent portions of the original Nerd Vittles article.

Configuring SIPgate. If you live in the U.S. and have a cellphone, we'd recommend the SIPgate option since no adjustment of your hardware-based firewall is required. Otherwise, skip to the IPkall setup below. Step #1 is to request a SIPgate invite at this link. You'll need to enter your U.S. cellphone number to receive the SMS message with your invitation code. Don't worry. You can erase your cellphone number from your account once it is set up and working properly. Once you receive the invite code, enter it and choose the option to set up a residential account. Next, choose a phone number and write it down. The area code really doesn't matter because Google Voice is the only one that will be calling this number after we get things set up. For now, leave your cellphone number in place so that you can receive your confirmation call from Google Voice in the next step. After that, you'll want to revisit SIPgate and remove all parallel calling numbers. Finally, click on the Settings link and write down your SIP ID and SIP Password. You'll need these in a few minutes to complete the configuration of The Incredible PBX. Now place a call to your new SIPgate number and make certain that your cellphone rings before proceeding.

Configuring Google Voice. Once you've signed up for a new Google Voice account, choose a telephone number and plug in your new SIPgate number as the destination for your Google Voice calls and choose Office as the Phone Type.

Google Voice will place a test call to your number which SIPgate will forward to your cellphone. Enter the two-digit code that's displayed when you're prompted to do so.

While you're still in Google Voice Settings, click on the Calls tab. Make sure your settings match these:

  • Call Screening - OFF
  • Call Presentation - OFF
  • Caller ID (In) - Display Caller's Number
  • Caller ID (Out) - Don't Change Anything
  • Do Not Disturb - OFF

Click Save Changes once you adjust your settings. Under the Voicemail tab, plug in your email address so you get notified of new voicemails. Down the road, receipt of a Google Voice voicemail will be a big hint that something has come unglued on your PBX.

Once you've confirmed your Google Voice number, revisit SIPgate and remove all parallel calling numbers including your cell number. Be sure you've written down your SIPid and SIPpassword while you're there!

FreePBX Overview. Don't be intimidated by the FreePBX setup instructions which follow. All we're really doing is cloning the original pieces of information that made Google Voice work in the initial Incredible PBX setup. For most of the items, we'll just tack a 2 onto the names previously used. Nothing prevents your adding 3, 4, and 5 accounts down the road if you have additional Google Voice and SIPgate accounts to support each iteration.

To begin, use a web browser to open FreePBX on your Incredible PBX. Using the actual private IP address of your server, go to the following link: http://192.168.0.33/admin.

Adding Parking Lot Slots. As originally configured, the Incredible PBX provides 5 parking lot slots for use on your PBX. These are numbers that let you temporarily "park" calls so that they can be picked up on another extension. One of those slots (75) is used by the Incredible PBX to place outbound Google Voice calls. If you want the ability to place simultaneous outbound Google Voice calls using multiple trunks, then we need additional parking lot slots for each simultaneous call. We recommend bumping up the number of parking lot slots from 5 to 9. Then you can use 75-79 for up to 5 simultaneous outbound calls with Google Voice. Here's how. In FreePBX, choose Setup, Parking Lot, Number of Slots: 9. Your entries should look like this screen shot:

When you've made the change, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Creating Additional Custom Destinations. You'll recall that Google Voice actually places two calls when you make an outbound call. First, Google Voice calls you back. Then Google Voice places a call to your desired destination. The callback to you is handled transparently in Incredible PBX using pygooglevoice and Asterisk's parking lot feature. To handle multiple simultaneous calls, you'll need additional custom destinations. Here's how. In FreePBX, choose Tools, Custom Destinations, Add Custom Destination. Then make your new entries for custom-park2 look like this:

When you've made the entries and carefully checked them, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Creating Additional Inbound Routes. Now we need an additional Inbound Route to handle the second incoming call generated by Google Voice. Here's how. In FreePBX, choose Setup, Inbound Routes, Add Incoming Route, gv-ringback2. Make the entries shown in the screenshot below substituting your 10-digit SIPgate/IPkall and Google Voice numbers in the appropriate fields. Be sure to choose Custom GV-Park2 as the Custom Destination for this Inbound Route. Check your entries carefully, a typo here will kill completion of the calls!

When you've made the entries and carefully checked them, click Submit, Apply Configuration Changes, Continue with Reload.

Creating Additional Custom Trunks. With every telephony provider, Asterisk needs a Trunk. In the case of Google Voice, we need a Custom Trunk for each Google Voice number to be used on your Incredible PBX. Think of a trunk as the bucket where Asterisk dumps an outbound call for processing. Two calls require two buckets. Three calls, three buckets. And so on. Well, that's almost true. Some providers can handle multiple calls, but Google Voice doesn't. So we need to make two changes in your trunk setup. First, we'll adjust the original Custom Trunk for Google Voice and limit it to one simultaneous call at a time. Then, we'll add a new Custom Trunk to support the second Google Voice account. Here's how.

In FreePBX, choose Setup, Trunks. In the right column, you'll see a list of all your existing trunks. Click on the second entry that looks like this: local/$OUTNUM$@ (custom). Be sure the Custom Dial String looks like what is shown below. If not, choose another trunk until you find the right one. Then make an entry of 1 in the Maximum Channels field:

When you've made the entry and carefully checked it, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Now we're ready to Add the additional Custom Trunk. In FreePBX, choose Setup, Trunks, Add Custom Trunk. Make your entries look like what's shown below:

When you've made the Maximum Channels and Custom Dial String entries shown above and carefully checked them, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Creating Additional Outbound Routes. FreePBX uses Outbound Routes to do just what the name implies: to route outbound calls to their destination. Outbound Routes are processed in the order in which they appear in the FreePBX Outbound Routes listing. We need to make three changes in the Outbound Routes processing to support a second Google Voice call path. First, we want to modify the existing Default Outbound Route to accommodate the second Google Voice account. Second, we want to add a new Outbound Route for the second Google Voice account so that calls can be placed directly with this route using a different dialing prefix. You'll recall that Google Voice calls in the Incredible PBX can optionally be dialed using the 48 prefix followed by a 10-digit number. The 48 spells GV on the phone key pad. So we'll add a new Outbound Route with a 482 (GV2) prefix which will tell Asterisk to route these calls out using the second Google Voice account. These prefixes can be anything you desire incidentally. Third, we'll need to move this new route UP the routes list so that it appears above and gets processed before the Default route. Here's how.

In FreePBX, choose Setup, Outbound Routes, Default. In the blank Trunk Sequence pulldown, choose the following entry: local/$OUTNUM#@custom-gv2. Now click the Add button. This should leave you with 3 outbound routes numbered 0, 1, and 2. Be sure your entries match the following:

When you've made the entry and carefully checked it, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Now we're ready to add a new Outbound Route to support a custom dialing prefix for the second Google Voice account. In FreePBX, choose Setup, Outbound Routes. In the Add Route form, make the following entries:

When you've made the entries, click Submit Changes, Apply Configuration Changes, Continue with Reload.

Finally, look at the listing of Routes in the Right Margin. Using the arrow beside GoogleVoice2, move it up until it is just beneath the GoogleVoice entry. Then click Apply Config Changes, Continue with Reload.

Adding Additional SIPgate Trunks. If you set up your Incredible PBX originally using IPkall, then there already will be a sipgate trunk that can be used for this second line. Otherwise, you'll need to create a new sipgate2 trunk and clone the setup from the original sipgate trunk. Within FreePBX, goto Setup, Trunks and either Add a new SIP trunk or edit the existing sipgate trunk if it isn't already in use. If this is a newly added trunk, enter sipgate2 as the Trunk Name. The PEER Details under Outgoing Settings should be added so they look like this (substituting your actual SIPid and SIPpassword that were obtained from the SIPgate registration page:

type=peer
username=SIPid
fromuser=SIPid
secret=SIPpassword
context=from-trunk
host=sipgate.com
fromdomain=sipgate.com
insecure=very
caninvite=no
canreinvite=no
nat=yes
disallow=all
allow=ulaw&alaw

Blank out any data that's entered in the Incoming Settings section of the form. Then enter a Registration String with your actual SIPid, SIPpassword, and 10-digit SIPgate phone number:

SIPid:SIPpassword@sipgate.com/SIPphonenumber

Check your entries carefully for typos. Then click Submit Changes, Apply Configuration Changes, Continue with Reload.

Now is a good time to check and be sure the new SIPgate trunk registered with SIPgate. In FreePBX, choose Tools, Asterisk Info, SIP Info. Your newly created SIPgate trunk should display as Registered. If it says Request Sent, then you've got a typo in your credentials.

That takes care of all the FreePBX settings needed to support a second Google Voice number. Now we just need to add a chunk of dialplan code to Asterisk and restart Asterisk. Then you'll be ready to go. All of this is handled by a simple Nerd Vittles script so... not to worry! It's easy.

Adding Dialplan Code for Additional Trunks. Log into your server as root, and issue the following commands to download and run the dialplan configuration script. For future reference, be advised that there are configuration scripts for gv2, gv3, gv4, and gv5 with corresponding names.

cd /root
wget http://incrediblepbx.com/configure-gv2
chmod +x configure-gv2
./configure-gv2

When prompted, enter your 10-digit Google Voice phone number, your Google Voice email address, your Google Voice password, and your 10-digit SIPgate RingBack number. Check your work and then press the Enter key to adjust your dialplan and reload Asterisk. You now have a 2-line Incredible PBX. Enjoy!

The Incredible PBX: Basic Installation Guide

Adding Skype to The Incredible PBX

Adding Incredible Backup... and Restore to The Incredible PBX

Adding Remotes, Preserving Security with The Incredible PBX

Remote Phone Meets Travelin' Man with The Incredible PBX

Continue reading Basic Installation Guide, Part II.

Continue reading Basic Installation Guide, Part III.

Continue reading Basic Installation Guide, Part IV.

Support Issues. With any application as sophisticated as this one, you're bound to have questions. Blog comments are a terrible place to handle support issues although we welcome general comments about our articles and software. If you have particular support issues, we encourage you to get actively involved in the PBX in a Flash Forums. It's the best Asterisk tech support site in the business, and it's all free! We maintain a thread with the latest Patches and Bug Fixes for Incredible PBX. Please have a look. Unlike some forums, ours is extremely friendly and is supported by literally hundreds of Asterisk gurus and thousands of ordinary users just like you. So you won't have to wait long for an answer to your questions.




Need help with Asterisk? Visit the PBX in a Flash Forum.
Or Try the New, Free PBX in a Flash Conference Bridge.


whos.amung.us If you're wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what's happening. It's a terrific resource both for us and for you.


 
New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you're seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity's DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here's a deal you can't (and shouldn't) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won't get the special pricing! After the free hour of outbound calling, Vitelity's rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest...

Incredible PBX Now Does Incredible Backups… and Restores

Along with many of you, we have wrestled with getting reliable backups of our Asterisk-based PBXs since the Asterisk@Home days. Flawless backups, of course, are worthless unless there's an accompanying flawless restore to get you back in business. Therein lies the rub. The number of minefields we've discovered along Restoration Way is legendary. A quick list includes incompatible hardware, changing device drivers, incompatible file storage systems, and on and on.

What's really disturbing about all of this is that lack of adequate backups is the single component, in our opinion, that has kept open source PBXs from being a true match for commercial systems. People can't live without their phone systems... even if they're old and out of date. So, regardless of age, there has to be a way to bring your system back from the dead, or it's of little use in a production environment.

When we set out to create The Incredible PBX, one of our primary design goals was to come up with a system architecture that would let you use this new system for a decade. Yes, a decade! Not six months, not next year, but ten years from now your Incredible PBX would still be humming along. One way was to totally insulate the system from the Internet. Another key ingredient was rock-solid dependability. Remember that black phone in your grandma's house. It wasn't designed for replacement every six months. Nor was its underlying phone system. As the old adage goes: "If it ain't broke, don't fix it!"

In order to reach these design goals, we not only needed a backup system but also a way to separate your critical data from the underlying hardware. Why? Because the hardware continues to change every six months. What this backup solution is not is a full disk backup. Every full system backup solution we've tried simply isn't reliable unless the hardware on the new system is virtually identical to the hardware on the old one, a most unlikely scenario two or more years down the road.

How It Works. The Incredible Backup and Restore works like this. You built a working Incredible PBX from a base PBX in a Flash install so we start there. To restore a system, you'll first reinstall PBX in a Flash on your new server. The actual version doesn't really matter so long as it works. And newer versions with the latest CentOS releases support newer hardware. This avoids most of the hardware pitfalls that usually accompany a failed restore process.

The next slippery slope was incompatible versions of FreePBX between your original system and your current server. We can always update Asterisk from source after the restore, but FreePBX was problematic because the structure of the MySQL database tables associated with different versions of FreePBX changes frequently. And your backup MySQL data might very well be in MySQL tables that don't match your original PBX in a Flash build. So Incredible Restore provides the option of first restoring the version of FreePBX that existed at the time you made your last backup.

Then there's the problem of incompatible network and email implementations. Incredible Restore provides options to let you choose whether to restore your old network and email settings. If your newly built PBX in a Flash server has functioning network and email connectivity, don't restore the old settings. Simple as that.

What we really care about is getting your data back including a functioning PBX. There's got to be a catch, right? For a pure VoIP PBX, everything should be fine. The gotcha is that there are hundreds of add-on cards to support all sorts of proprietary hardware as well as to access Ma Bell's PSTN network. You're on your own there. Just be sure you have copies of the software pieces needed to make your special hardware function again once we've completed the restore to your new server. The same goes for custom software such as Cepstral TTS and Amazon S3. The components necessary to reinstall these add-ons should still be in your /root directory after the restore so it's not really a big deal to put Humpty back together again. Our tutorial links are just above.

Before we get to the installation, we want to put in a plug for PogoPlug. Not only is this the best thing since sliced bread, but it doesn't cost much more. You add this $99 (if you hurry) device to your LAN at home, at your office, or at a friend's house. Then connect one to four USB hard drives, and you have your own Cloud Computing Solution that also happens to be absolutely perfect for Incredible Backups and Restores. In fact, the setup software can be installed as part of the restore process. And the software already is included with every Incredible PBX. Just insert your login credentials, and the PogoPlug disk drives (regardless of location) are transparently added in the /mnt/pogoplug directory tree.

It's GPL2! Last but not least, we've released both Incredible Backup and Incredible Restore as GPL2 open source modules. That means you not only can learn some bash scripting in your spare time but you also can embellish the scripts in any way you like to support your favorite add-ons. All we'd ask is that you upload a copy with your enhancements so that we can share your good deeds with the rest of the Asterisk community and incorporate your good ideas into the next release. Keep an eye on the comments to this article and the PIAF Forum for the most recent additions. Better yet, subscribe to the RSS Feed for Comments at the top of this page, and they'll be delivered to your door as they occur.

Overview. Here's the quick step-by-step to get things working:

1. Download the software onto Incredible PBX
2. Install your PogoPlug (optional)
3. Create a directory for backups
4. Enter directory location in IncredibleBackup script
5. Run IncredibleBackup to make backup
6. Purchase Machine #2 OR create new Proxmox KVM
7. Install latest PBX in a Flash
8. Run update-scripts and update-fixes
9. Download the software onto Machine #2
10. Create a directory to house backups AND
11. Copy backup tarballs to directory OR
12. Use PogoPlug and skip #10 and #11
13. Enter directory location in IncredibleRestore script
14. Run IncredibleRestore to restore backup

Using Incredible Backup. Installation couldn't be easier. On your Incredible PBX server, log in as root and issue the following commands:

cd /root
wget http://incrediblepbx.com/incredible.tar.gz
tar zxvf incredible.tar.gz

Once you decompress the tarball, you'll be left with two files: incrediblebackup and incrediblerestore. With both scripts, you'll need to edit them and insert the location of your backup directory. Before doing that, you need a dedicated backup directory which is not in the /root or /var/www directory trees. We don't need to tell you what a dumb idea it is to store your backups on the same machine you're backing up... so we won't. As noted, our recommendation is to use a PogoPlug and preferably at a location different from the site of your server. Whatever directory you choose, it needs to be accessible from your server. SAMBA also is available on PBX in a Flash systems to access other drives in your LAN, but it needs to be activated. Incredible PBX systems are totally insulated from the Internet by a hardware-based firewall so you're safe using SAMBA provided you trust other users on your LAN. Once the directory exists, edit the scripts and insert the location in backuploc: nano -w incrediblebackup. Save your change: Ctrl-X, Y, then Enter. Repeat process for incrediblerestore. To create an Incredible Backup, execute this command: /root/incrediblebackup. All of the backups are stored in compressed tarballs with a current time stamp, e.g. 1273067177.tgz. You can decipher the actual time of the backup with a command like this: date -d "@1273067177" --> Wed May 5 09:46:17 EDT 2010

REMINDERS: If you're using a PogoPlug, don't forget to run pogo-start.sh before running incrediblebackup.

If you wish to run incrediblebackup as a cron job, remember to comment out the following line in the script with a leading #:

read -p "To proceed at your own risk and agree to license, press Enter. Otherwise Ctrl-C."

Don't forget to also activate your PogoPlug as a cron job before the time that incrediblebackup is scheduled to run!

What To Back Up? As we mentioned previously, backups are the easy part. It's the restore process that causes premature aging. The best time to plan your restore strategy is before you need it! Always assume the worst case, i.e. that nothing is recoverable from your primary server. Then ask yourself whether the backup is capturing and saving in a safe location everything you'll need to put Humpty back together again. Currently, Incredible Backup captures the following files and directory trees:

/var/www/html /var/lib/asterisk /var/lib/mysql /root /etc/asterisk /tftpboot
/etc/pbx /etc/wanpipe /etc/sudoers /etc/odbc.ini /etc/odbcinst.ini
/var/lib/asterisk/sounds/tts /var/lib/asterisk/sounds/custom
/var/spool/asterisk /etc/amportal.conf /etc/wanpipe
/etc/hosts /etc/resolv.conf /etc/sysconfig/network-scripts/ifcfg* /etc/sysconfig/iptables /etc/sysconfig/network /etc/mail
/usr/local/bin /usr/local/sbin /usr/src and portions of /usr/sbin

Keep in mind that an Incredible Restore always begins with a functioning PBX in a Flash server. And you will have the option of restoring all Incredible PBX applications. With the exception of these applications, ask yourself whether the backup list above captures everything you've added to your server and is sufficient to meet your needs. With most Incredible PBX implementations, it should adequately restore an existing Incredible PBX together with your FreePBX customizations. But the beauty of open source software is that you can and should customize it to meet your specific needs. You can add any additional directories... so long as you do it and save the backup to some off-site location before your server dies. :wink:

The other important question to ask yourself is what is your Incredible PBX as presently configured worth to you. If the answer is more than $200, perhaps the time is ripe to purchase a second system for emergencies and test your restore strategy in advance.

Using Incredible Restore. Let's get the cautionary notes out of the way up front. First, by using this software, you have agreed to assume all risks including the risk of losing all your data. Second, don't experiment with restores to your primary system. Third, in the most emphatic way we can, we encourage you to test a restore before D-Day arrives... but not on your live system! If it means borrowing a friend's old clunker for the afternoon, then by all means do so. If you can afford a second system, that's even better. If you have a virtual platform at the office, borrow a little space for the weekend and try a restore. Proxmox works and so does VMware and most other virtual platforms. We don't mean to be all doom and gloom about this, but unfortunately backups are all about doom and gloom. Now's the time to find out something didn't work quite right, not when you really, really need it.

The first step in using Incredible Restore is to install PBX in a Flash on the new server. We recommend you also run update-scripts and update-fixes once the PIAF install is complete. As with Incredible Backup, the next step in using Incredible Restore is to log into your new server and download the application:

cd /root
wget http://incrediblepbx.com/incredible.tar.gz
tar zxvf incredible.tar.gz

Unless you're using a backup tarball from external location supported by SAMBA or PogoPlug, Step #3 is to create a directory on your new server and copy the backup tarball to that directory. Step #4 is to configure the incrediblerestore script with the directory location of the backup tarball to be restored. Once you've saved the location, run the script: /root/incrediblerestore. You'll be given the following options to tailor how the restoration process should proceed:

1. Whether to enable PogoPlug functionality on the server
2. Whether to restore FreePBX application from the backup
3. Whether to restore Incredible PBX apps to new server
4. Whether to restore Network Settings from the backup
5. Whether to restore SendMail Setup from the backup
6. Whether to restore Asterisk binaries and source code
7. Whether to disable outbound SIP/IAX connectivity

1. Enabling PogoPlug. If you're using a PogoPlug for your backups, you'll be prompted whether to install the PogoPlug software as first option when you run the IncredibleRestore script. Choosing Y will load the necessary software. Then it's a simple matter of entering your login credentials in pogo-start.sh and running pogo-start.sh to activate the PogoPlug. Then just rerun the IncredibleRestore script to continue.

2. Restoring FreePBX Application. Unless you are absolutely certain that the version of FreePBX in your backup matches the version on your new server, choosing Y for this option is highly recommended. Otherwise, the structure of the FreePBX MySQL tables may differ and cause all sorts of difficult to diagnose problems.

3. Restoring Incredible PBX Applications. If your backup was made on an Incredible PBX server, then the Incredible PBX apps should be restored to your new server. We've made this optional only to accommodate those who may wish to tailor the scripts to support other Asterisk distributions.

4. Restoring Network Configuration. If you're recovering from a catastrophic failure and want to make certain that a static IP address is preserved when you restore your backup, then you obviously would want to restore your network configuration. If you're building a duplicate system to be kept off line or if you're moving your server to a virtual machine platform, then you probably do NOT want to restore the network configuration from your primary machine. A good rule of thumb probably goes like this. If network connectivity already is working on your new server, don't restore the network setup from your backup.

5. Restoring SendMail Setup. The only situation in which you would want to restore the SendMail setup from your primary server is if you have specially tailored SendMail on the primary server in order to send email. This typically would happen where an Internet service provider blocks outbound SMTP traffic, e.g. Comcast residential Internet service.

6. Restoring Asterisk Binaries and Source. This functionality is EXPERIMENTAL AND BARELY TESTED!! It only works (at all) with Asterisk implementations still using Zaptel, not DAHDI. Unless your primary server was running a version of Asterisk that differs from the default PBX in a Flash build, the correct answer to this prompt is N. Never use this option if you are restoring from a catastrophic failure. Instead, run update-source and update-fixes on the newly restored server. It's safer! We'll keep you posted on future developments.

7. Disabling Outbound SIP/IAX Connectivity. This option allows you to disable outbound SIP and IAX traffic on the new server. Typically, you would use this if the server on which the backup was made is still on line. The reason is to avoid having two identical servers compete for connections to SIP and IAX providers. If this option is chosen and you subsequently take your primary server off line, then you will need to enable SIP and IAX connectivity on the newly restored server before it can take over primary duties. To do this, log into your new server as root and issue the following commands:

cd /etc/sysconfig
cp iptables.sip iptables
service iptables restart

To again disable SIP and IAX outbound traffic, issue the following commands:

cd /etc/sysconfig
cp iptables.nosip iptables
service iptables restart

Feedback and Suggestions Encouraged. Incredible Backup and Incredible Restore are still very much works in progress. A number of folks on the PBX in a Flash Forums have assisted us in getting version 1.0 out the door today, but don't bet the farm on this software until you have carefully tested it using a redundant server! We will continue to improve/enhance the functionality for weeks and perhaps months to come. And, until the kinks are all worked out, we would strongly encourage you to download the latest and greatest version each time you make a backup or undertake to restore a backup to a new system. During this development period, we also would encourage you to make suggestions and to offer enhancements. After all, that's what open source is all about. Enjoy!




Need help with Asterisk? Visit the PBX in a Flash Forum.
Or Try the New, Free PBX in a Flash Conference Bridge.


whos.amung.us If you're wondering what your fellow man is reading on Nerd Vittles these days, wonder no more. Visit our new whos.amung.us statistical web site and check out what's happening. It's a terrific resource both for us and for you.


 
New Vitelity Special. Vitelity has generously offered a new discount for PBX in a Flash users. You now can get an almost half-price DID and 60 free minutes from our special Vitelity sign-up link. If you're seeking the best flexibility in choosing an area code and phone number plus the lowest entry level pricing plus high quality calls, then Vitelity is the hands-down winner. Vitelity provides Tier A DID inbound service in over 3,000 rate centers throughout the US and Canada. And, when you use our special link to sign up, the Nerd Vittles and PBX in a Flash projects get a few shekels down the road while you get an incredible signup deal as well. The going rate for Vitelity's DID service is $7.95 a month which includes up to 4,000 incoming minutes on two simultaneous channels with terminations priced at 1.45¢ per minute. Not any more! For PBX in a Flash users, here's a deal you can't (and shouldn't) refuse! Sign up now, and you can purchase a Tier A DID with unlimited incoming calls for just $3.99 a month and you get a free hour of outbound calling to test out their call quality. To check availability of local numbers and tiers of service from Vitelity, click here. Do not use this link to order your DIDs, or you won't get the special pricing! After the free hour of outbound calling, Vitelity's rate is just 1.44¢ per minute for outbound calls in the U.S. There is a $35 prepay when you sign up. This covers future usage and any balance is fully refundable if you decide to discontinue service with Vitelity.
 


Some Recent Nerd Vittles Articles of Interest...

WordPress Themes