SYSADMINMAN» sysadminman – Asterisk VPS – Trixbox, Elastix, PIAF, A2Billing

Asterisk/FreePBX dial plan injection vulnerability

matt — Sun, 28 Feb 2010 23:52:42 +0000

There is an interesting discussion on the PBX-in-a-Flash forums here regarding an Asterisk security announcement.

If you write custom Asterisk contexts outside of FreePBX then you should read through how to do this securely. You should not be using wildcard pattern matching as this could be used to create channels in a manner not intended.

Also raised is the potential of a Asterisk/FreePBX system being compromised via the Asterisk Recording Interface (ARI). This is the web interface that allows you to view and manage voicemails. If you do not use this feature of FreePBX it is strongly recommended that you remove access to it. This can be done simply by running the following command as root on systems with standard configuration -

chmod 000 /var/www/html/recordings

This will prevent the ARI being accessible via a browser.

If you would like more information regarding Asterisk diaplan security please see the following resources -

http://www.asterisk.org/node/49906
http://downloads.asterisk.org/pub/security/AST-2010-002.html
http://svn.asterisk.org/svn/asterisk/trunk/README-SERIOUSLY.bestpractices.txt
http://www.freepbx.org/forum/freepbx/users/dial-plan-injection-vulnerability

Also, always use complex and difficult-to-guess passwords in all areas when setting up Asterisk/FreePBX

If you have a sysadminman VPS and would like the ARI interface disabling please raise a ticket via the helpdesk.

As always thanks to Ward Mundy and Joe Roper who make a great contribution to the Asterisk community.

E-mail to voice call – with Asterisk, Postfix and Cepstral

matt — Sun, 14 Feb 2010 11:56:09 +0000

A few times recently I’ve wanted to be able to turn an e-mail into a voice call. This would be especially handy for emergency server monitoring and notification.

Here is my first attempt. It’s also my first attempt at writing something in Python so you definitely use at your own risk!

There is room for improvement as there is no validation on any of the fields extracted from the e-mail.

It also assumes that these components are already in place -

Asterisk (with Astersk Manager Interface)
E-mail server (I’m using Postfix)
Ceptral text-to-speech (www.cepstral.com) – installed in /opt/swift/bin
Python (I’m using v2.4.3)

First we need to pipe the incoming e-mail to our Python script. For this I added a line to /etc/aliases -

emailspeak: "|/usr/local/bin/emailspeak.py"

and ran newaliases -

newaliases

Now for the script which is called ‘/usr/local/bin/emailspeak.py’

You will need to change at least the USER, SECRET and TRUNK settings at the top of the script to match you Asterisk setup.

#!/usr/bin/env python
# emailspeak.py by sysadminman - http://sysadminman.net
# v1.0 13/2/10

# Import libs we need
import sys, time, email, email.Message, email.Errors, email.Utils, smtplib, os, socket, random
from datetime import date
from email.Iterators import typed_subpart_iterator
from time import sleep

# Asterisk Manager connection details
HOST = '127.0.0.1'
PORT = 5038
# Asterisk Manager username and password
USER = 'manageruser'
SECRET = 'managerpass'
# Set the name of the SIP trunk to use for outbound calls
TRUNK = 'trunkforcalls'

# Generate a random number as a string. We'll use this for file names later on
callnum = str(random.randint(1, 100000000))

# Taken from here, with thanks - http://ginstrom.com/scribbles/2007/11/19/parsing-multilingual-email-with-python/
def get_charset(message, default="ascii"):
"""Get the message charset"""

if message.get_content_charset():
return message.get_content_charset()

if message.get_charset():
return message.get_charset()

return default

# Taken from here, with thanks - http://ginstrom.com/scribbles/2007/11/19/parsing-multilingual-email-with-python/
def get_body(message):
"""Get the body of the email message"""

if message.is_multipart():
#get the plain text version only
text_parts = [part
for part in typed_subpart_iterator(message,
'text',
'plain')]
body = []
for part in text_parts:
charset = get_charset(part, get_charset(message))
body.append(unicode(part.get_payload(decode=True),
charset,
"replace"))

return u"\n".join(body).strip()

else: # if it is not multipart, the payload will be a string
# representing the message body
body = unicode(message.get_payload(decode=True),
get_charset(message),
"replace")
return body.strip()

# Read the e-mail message that has been piped to us by Postfix
raw_msg = sys.stdin.read()
emailmsg = email.message_from_string(raw_msg)

# Extract database Fields from mail
msgfrom = emailmsg['From']
msgto = emailmsg['To']
msgsubj = emailmsg['Subject']
msgbody = get_body(emailmsg)

# Write a log file in /tmp with a record of the e-mails
currtime = date.today().strftime("%B %d, %Y")
logfile = open('/tmp/email2voice.log', 'a')
logfile.write(currtime + "\n")
logfile.write("Call Number: " + callnum + "\n")
logfile.write("From: " + msgfrom + "\n")
logfile.write("To: " + msgto + "\n")
logfile.write("Subject: " + msgsubj + "\n")
logfile.write("Body: " + msgbody + "\n\n")
logfile.close()

# Convert the body of the text to a wav file
swiftcommand = "/opt/swift/bin/swift -n Millie-8kHz -o /tmp/" + callnum + ".wav '" + msgbody + "'"
os.system(swiftcommand)

# We need to allow Asterisk permission to read the wav file
chmodcommand = "chmod 777 /tmp/" + callnum + ".wav"
os.system(chmodcommand)

# Set the number to be dailed as the subject of the e-mail
OUTBOUND = msgsubj

# Send the call details to the Asteirsk Manager Interface
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
sleep(3)
s.send('Action: login\r\n')
s.send('Username: ' + USER + '\r\n')
s.send('Secret: ' + SECRET + '\r\n\r\n')
sleep(3)
s.send('Events: off\r\n\r\n')
sleep(3)
s.send('Action: originate\r\n')
s.send('Channel: Sip/' + TRUNK + '/' + OUTBOUND + '\r\n')
s.send('WaitTime: 30\r\n')
s.send('CallerId: 1234\r\n')
s.send('Application: playback\r\n')
s.send('Data: /tmp/' + callnum + '\r\n')
s.send('Context: from-internal\r\n')
s.send('Async: true\r\n')
s.send('Priority: 1\r\n\r\n')
sleep(3)
s.send('Action: Logoff\r\n\r\n')
s.close()

And that should be it. To test just send an e-mail to emailspeak@yourserver.com with the telephone number you want to call as the subject line, and the text you want to be read in the body.

Don’t forget to write the telephone number in the format that your SIP provider is expecting it.

FreePBX security advisory for version 2.5.1

matt — Sun, 24 Jan 2010 09:53:32 +0000

On 15/1/2010 a security advisory was released for FreePBX version 2.5.1 (and potentially earlier versions) concerning a SQL injection vulnerability. If you are running this version then I would suggest upgrading to version 2.5.2. You can find more details of the vulnerability here.

You can upgrade through the FreePBX GUI by using the module admin menu. Here are the steps -

* While FreePBX 2.6 is available please make sure you’re aware of any implications before updating to this version.

1 – Select the ‘Module Admin’ menu

2 – Click ‘Upgrade All’

3 – Click ‘Process’

4 – Click ‘Confirm’

5 – Click ‘Return’

6 -Click ‘Apply Changes’

Disabling the OpenFire service in Elastix

matt — Thu, 14 Jan 2010 20:03:33 +0000

Elastix includes an Instant Messenger server called OpenFire. While not enabled by default it is very easy to enable.

What’s not so obvious is how to disable OpenFire if you decide, once you’ve had a look at it, you don’t want/need to run it. You might want to do this as OpenFire runs on Java which can be quite memory hungry, also it opens another point of attack to your server.

The easiest way to disable it is via the command prompt by running -

service openfire stop

chkconfig openfire off

This will also stop it starting automatically when the server is rebooted.

Slow rate browsing in A2Billing

matt — Sun, 10 Jan 2010 11:35:49 +0000

I recently looked at an A2Billing 1.34 install that was slow to browse the rates through the GUI. There were over 800,000 rates which was causing the slowdown. While probably not a good idea to have so many rates, it is possible to speed up this screen by creating an index in MySQL.

To do that -

(you should be able to get the username/password you need from the top of the /etc/asterisk/a2billing.conf file)

mysql -u a2billing-user -p mya2billing

Create an index on the destination field in the cc_ratecard table -

create index ind_cc_ratecard_destination using btree on cc_ratecard(destination);

To find out why queries are taking so long in MySQL you can turn on the slow-query log in MySQL.

See here for more info – http://dev.mysql.com/doc/refman/5.1/en/slow-query-log.html

Sysadminman Elsatix VPS template updated to Elastix 1.6

matt — Wed, 16 Dec 2009 20:27:06 +0000

The Sysadminman Elastix VPS template has been updated to version 1.6

See here for more details – http://sysadminman.net/distro-elastix.html

Skype for Asterisk with Elastix

matt — Sun, 13 Dec 2009 12:18:09 +0000

I was about to write a blog post about setting up Skype for Asterisk on Elastix but after searching round on the web I found this great blog post by ‘Bob’ on the Elastix website.

It gives a good walkthrough and screenshots for getting Skype for Asterisk from Digium up and running.

If you do want to install this on your Sysadminman Elastix VPS just open a support ticket first asking for an éth0′device to be setup as you’ll need this for the Digium registration process

No audio with certain Asterisk calls

matt — Fri, 11 Dec 2009 22:37:37 +0000

I had an unusual problem recently with certain calls going to the PSTN via a SIP provider. The call would connect but with no audio at either end.

I’ve seen this lots before and is often caused by NAT or a firewall blocking the audio stream but that wasn’t the cause this time.

The problem was caused my trunk only being setup to allow the ulaw codec (allow=ulaw on the trunk). What I think was happening was that my provider was accepting, and connecting, the call but then when it tried to hand the call off to it’s upstream provider, which only accepted alaw, it would fail.

So if you’re having problems with connected calls but no audio it might be worth enabling all of the codecs on the trunk to rule out any codec mismatch issues.

If that doesn’t help look at NAT or firewalling

A2Billing upgraded to v1.4.2.1 on Sysadminman VPS

matt — Sun, 25 Oct 2009 13:59:22 +0000

The version of A2Billing has been updated to the latest release on the Sysadminman VPS template.

This template now includes -

Asterisk v1.6
FreePBX v2.5
A2Billing v1.4.2.1

More details can be found here – http://sysadminman.net/uk-voip-vps.html

asterisk.org gets a facelift

matt — Mon, 19 Oct 2009 18:22:37 +0000

The home of Asterisk has had a nice makeover. With well over 1 million downloads already this year it is definitely a major player in the VOIP space.

Check it out here – www.asterisk.org