Installing FreePBX 13 on Ubuntu Server 14.04.2 LTS

Skip to end of metadata

• Created by Andrew Nagy, last modified by tomcastleman on Sep 15, 2015

Go to start of metadata

Initial System Setup

When installing the machine, at package selection make sure you pick - at least - 'OpenSSH Server', and 'LAMP Packages'.  This installs the base packages required.

MySQL Password

After selecting 'Continue' you will be prompted (several times) for a root password. There is no need to set one, and setting one is discouraged! As part of the FreePBX install, a secure (128 bit) password is generated, and used to lock down MySQL. If you set a password now, it is not possible for the installer to secure your database. Please just push 'enter' when prompted for a password.

Unlock and configure your root password.

You may find it helpful to log in directly as root to manage and update your system. We recommend you do set a root password, and enable SSH logins from root, so you don't need to go through secondary steps that may cause problems.  This command enables SSH root logins, and prompts you for a new root password.

sed -i 's/PermitRootLogin without-password/PermitRootLogin yes/' /etc/sshd/sshd_config
service ssh restart
sudo passwd root

Switch to the Root User

THIS IS IMPORTANT!  You must run the entire process as root. Attempting to use 'sudo' later on will not work. Please don't ignore this. You must run this command to switch to an interactive root shell.

sudo -i

Update Your System

apt-get update && apt-get upgrade -y 

Install Required Dependencies

apt-get install -y build-essential linux-headers-`uname -r` openssh-server apache2 mysql-server\
  mysql-client bison flex php5 php5-curl php5-cli php5-mysql php-pear php5-gd curl sox\
  libncurses5-dev libssl-dev libmysqlclient-dev mpg123 libxml2-dev libnewt-dev sqlite3\
  libsqlite3-dev pkg-config automake libtool autoconf git unixodbc-dev uuid uuid-dev\
  libasound2-dev libogg-dev libvorbis-dev libcurl4-openssl-dev libical-dev libneon27-dev libsrtp0-dev\
  libspandsp-dev libmyodbc
 

Reboot server

reboot

After the Reboot

Ensure that you re-run 'sudo -i', or log in as the root user. As mentioned above, the entire install process must be run as 'root', and failure to do so will cause unexpected problems.

Install Legacy pear requirements

pear install Console_Getopt

Install Dependencies for Google Voice (if required)

You may skip this section if you do not require Google Voice support.

Install iksemel

cd /usr/src
wget https://iksemel.googlecode.com/files/iksemel-1.4.tar.gz
tar xf iksemel-1.4.tar.gz
cd iksemel-*
./configure
make
make install

Install and Configure Asterisk

Download Asterisk source files.

cd /usr/src
wget http://downloads.asterisk.org/pub/telephony/dahdi-linux-complete/dahdi-linux-complete-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/libpri/libpri-1.4-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-13-current.tar.gz
wget -O jansson.tar.gz https://github.com/akheron/jansson/archive/v2.7.tar.gz
wget http://www.pjsip.org/release/2.4/pjproject-2.4.tar.bz2

Compile and install DAHDI.

If you don't have any physical PSTN hardware attached to this machine, you don't need to install DAHDI (For example, a T1 or E1 card, or a USB device). Most smaller setups will not have DAHDI hardware, and this step can be safely skipped.

cd /usr/src
tar xvfz dahdi-linux-complete-current.tar.gz
rm -f dahdi-linux-complete-current.tar.gz
cd dahdi-linux-complete-*
make all
make install
make config
cd /usr/src
tar xvfz libpri-1.4-current.tar.gz
rm -f libpri-1.4-current.tar.gz
cd libpri-*
make
make install

Compile and install pjproject

cd /usr/src
tar -xjvf pjproject-2.4.tar.bz2
rm -f pjproject-2.4.tar.bz2
cd pjproject-2.4
CFLAGS='-DPJ_HAS_IPV6=1' ./configure --enable-shared --disable-sound --disable-resample --disable-video --disable-opencore-amr
make dep
make
make install

Compile and Install jansson

cd /usr/src
tar vxfz jansson.tar.gz
rm -f jansson.tar.gz
cd jansson-*
autoreconf -i
./configure
make
make install

Compile and install Asterisk

cd /usr/src
tar xvfz asterisk-13-current.tar.gz
rm -f asterisk-13-current.tar.gz
cd asterisk-*
contrib/scripts/install_prereq install
./configure
contrib/scripts/get_mp3_source.sh
make menuselect

You will be prompted at the point to pick which modules to build. Most of them will already be enabled, but if you want to have MP3 support (eg, for Music on Hold), you need to manually turn on 'format_mp3' on the first page.

After selecting 'Save & Exit' you can then continue

make
make install
make config
ldconfig
update-rc.d -f asterisk remove

Install Asterisk Soundfiles.

The 'make install' above installs a standard low-quality base sound file by default. This is suitable if you are on a small, underpowered system (such as a Rasberry Pi), but on a larger system you should install higher quality soundfiles.  Note that this installs the (8khz) 'wav' soundfiles and G722 (High Definition 'Wideband') audio.

cd /var/lib/asterisk/sounds
wget http://downloads.asterisk.org/pub/telephony/sounds/asterisk-core-sounds-en-wav-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/sounds/asterisk-extra-sounds-en-wav-current.tar.gz
tar xvf asterisk-core-sounds-en-wav-current.tar.gz
rm -f asterisk-core-sounds-en-wav-current.tar.gz
tar xfz asterisk-extra-sounds-en-wav-current.tar.gz
rm -f asterisk-extra-sounds-en-wav-current.tar.gz
# Wideband Audio download 
wget http://downloads.asterisk.org/pub/telephony/sounds/asterisk-core-sounds-en-g722-current.tar.gz
wget http://downloads.asterisk.org/pub/telephony/sounds/asterisk-extra-sounds-en-g722-current.tar.gz
tar xfz asterisk-extra-sounds-en-g722-current.tar.gz
rm -f asterisk-extra-sounds-en-g722-current.tar.gz
tar xfz asterisk-core-sounds-en-g722-current.tar.gz
rm -f asterisk-core-sounds-en-g722-current.tar.gz

Install and Configure FreePBX

Create the Asterisk user and set base file permissions.

useradd -m asterisk
chown asterisk. /var/run/asterisk
chown -R asterisk. /etc/asterisk
chown -R asterisk. /var/{lib,log,spool}/asterisk
chown -R asterisk. /usr/lib/asterisk
rm -rf /var/www/html

A few small modifications to Apache.

sed -i 's/\(^upload_max_filesize = \).*/\120M/' /etc/php5/apache2/php.ini
cp /etc/apache2/apache2.conf /etc/apache2/apache2.conf_orig
sed -i 's/^\(User\|Group\).*/\1 asterisk/' /etc/apache2/apache2.conf
sed -i 's/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf
service apache2 restart

Configure ODBC

Edit /etc/odbcinst.ini and add the following. Note that this command assumes you are installing to a new machine, and that the file is empty. If this is not a freshly installed machine, please manually verify the contents of the file, rather than just copying and pasting the lines below. The 'EOF' does no go in the file, it simply signals to the 'cat' command that you have finished pasting.

cat >> /etc/odbcinst.ini << EOF
[MySQL]
Description = ODBC for MySQL
Driver = /usr/lib/x86_64-linux-gnu/odbc/libmyodbc.so
Setup = /usr/lib/x86_64-linux-gnu/odbc/libodbcmyS.so
FileUsage = 1
 
EOF

You may need to verify these paths, if you're not on a x86_64 machine. You can use the command `find / -name libmyodbc.so` to verify the location
Edit or create /etc/odbc.ini and add the following section. Note that, again, this command assumes you are installing to a new machine, and the file is empty. Please manually verify the contents of the files if this is not the case.

cat >> /etc/odbc.ini << EOF
[MySQL-asteriskcdrdb]
Description=MySQL connection to 'asteriskcdrdb' database
driver=MySQL
server=localhost
database=asteriskcdrdb
Port=3306
Socket=/var/run/mysqld/mysqld.sock
option=3
 
EOF

Download and install FreePBX.

cd /usr/src
wget http://mirror.freepbx.org/modules/packages/freepbx/freepbx-13.0-latest.tgz
tar vxfz freepbx-13.0-latest.tgz
rm -f freepbx-13.0-latest.tgz
cd freepbx
./start_asterisk start
./install -n

That's it!

You can now start using FreePBX.  Open up your web browser and connect to the IP address or hostname of your new FreePBX server.  You will see the Admin setup page, which is where you set your  'admin' account password, and configure an email address to receive update notifications.
We hope you enjoy using FreePBX 13!

Ipod Touch 4G torn down, only 256MB RAM found

iFixit has finally gotten their hands on the new iPod Touch and did their customary “teardown” to take a look inside the device. A couple of interesting things were found, sort of letdown in my opinion.

When they got into the 1GHz A4 processor, they found that the model is identical to the one used on the iPad and not the iPhone 4. What this means it that just like the iPad, the new iPod Touch only has 256MB RAM and not 512MB as most people initially believed.

Another thing to point out is with regards to the Retina Display. The iPod Touch 4G has the same resolution as that of the iPhone 4. However, it lacks the In-Plane Switching (IPS) technology that’s available on the iPad and iPhone 4.

The IPS gives these devices a wide-viewing angle of up to 178 degrees and the new Touch doesn’t have it. This might result to less than stellar viewing on games requiring you to tilt the iPod.

These and the poor camera that you may have already heard about makes the iPod Touch 4G a bit of a letdown for me despite the initial hoopla. But it won’t stop me from getting one.

Check out the interesting step-by-step teardown did by iFixit. It’s really interesting.

source: PinoyTechBlog

Seven Steps to Better SIP Security with Asterisk

In case any of you were wondering why there has been a fairly notable upswing in the attacks happening on SIP endpoints, the answer is “script kiddies.”  In the last few months, a number of new tools have made it easy for knuckle-draggers to attack and defraud SIP endpoints, Asterisk-based systems included.  There are easily-available tools that scan networks looking for SIP hosts, and then scan hosts looking for valid extensions, and then scan valid extensions looking for passwords.  You can take steps, NOW, to eliminate many of these problems.  I think the community is interested in coming up with an integrated Asterisk-based solution that is much wider in scope for dynamic protection (community-shared blacklists is the current thinking) but that doesn’t mean you should wait for some new tool to defend your systems.  You can IMMEDIATELY take fairly common-sense measures to protect your Asterisk server from the bulk of the scans and attacks that are on the increase. The methods and tools for protection already exists – just apply them, and you’ll be able to sleep more soundly at night.
 

Seven Easy Steps to Better SIP Security on Asterisk:
 

1) Don’t accept SIP authentication requests from all IP addresses.  Use the “permit=” and “deny=” lines in sip.conf to only allow a reasonable subset of IP addresess to reach each listed extension/user in your sip.conf file.  Even if you accept inbound calls from “anywhere” (via [default]) don’t let those users reach authenticated elements!
 

2) Set “alwaysauthreject=yes” in your sip.conf file.  This option has been around for a while (since 1.2?) but the default is “no”, which allows extension information leakage.  Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames, denying remote attackers the ability to detect existing extensions with brute-force guessing attacks.
 

3) Use STRONG passwords for SIP entities.  This is probably the most important step you can take.  Don’t just concatenate two words together and suffix it with “1″ – if you’ve seen how sophisticated the tools are that guess passwords, you’d understand that trivial obfuscation like that is a minor hinderance to a modern CPU.  Use symbols, numbers, and a mix of upper and lowercase letters at least 12 digits long.
 

4) Block your AMI manager ports.  Use “permit=” and “deny=” lines in manager.conf to reduce inbound connections to known hosts only.  Use strong passwords here, again at least 12 characters with a complex mix of symbols, numbers, and letters.
 

5) Allow only one or two calls at a time per SIP entity, where possible.  At the worst, limiting your exposure to toll fraud is a wise thing to do.  This also limits your exposure when legitimate password holders on your system lose control of their passphrase – writing it on the bottom of the SIP phone, for instance, which I’ve seen.
 

6) Make your SIP usernames different than your extensions.  While it is convenient to have extension “1234″ map to SIP entry “1234″ which is also SIP user “1234″, this is an easy target for attackers to guess SIP authentication names.  Use the MAC address of the device, or some sort of combination of a common phrase + extension MD5 hash (example: from a shell prompt, try “md5 -s ThePassword5000″)
 

7) Ensure your [default] context is secure.  Don’t allow unauthenticated callers to reach any contexts that allow toll calls.  Permit only a limited number of active calls through your default context (use the “GROUP” function as a counter.)  Prohibit unauthenticated calls entirely (if you don’t want them) by setting “allowguest=no” in the [general] part of sip.conf.
 

These 7 basics will protect most people, but there are certainly other steps you can take that are more complex and reactive.  Here is a fail2ban recipe which might allow you to ban endpoints based on volume of requests.  There is discussion on the asterisk-user and asterisk-dev mailing lists of incorporating this type of functionality into Asterisk – let’s hear your ideas!
 

If you’d like to see an example of the tools that you’re up against, see this demo video of an automated attack tool that does scan, guess, and crack methods via a click-and-drool interface.
 
In summary: basic security measures will protect you against the vast majority of SIP-based brute-force attacks.  Most of the SIP attackers are fools with tools – they are opportunists who see an easy way to defraud people who have not considered the costs of insecure methods.  Asterisk has some methods to prevent the most obvious attacks from succeeding at the network level, but the most effective method of protection are the administrative issues of password robustness and username obscurity. 

source: Digium