TIPS Incredible PI help with users and security

[regfixit]

Hi All,
I have some newbie questions that I’ve tried to work out from the forums already but would appreciate some help. I am trying to make the jump from Windows to Linux for my voip stuff so I hope you’ll be gentle with me !

So, I have a raspberry PI and I downloaded the incredible PI image dated 28th July 2014 that is mentioned in the Nerdvittles article 10151. I am trying to make sure I have this as secure as possible. I will be away from home for extended periods so want to still be able to access it to make changes, etc and so was thinking to open SSH port on my router at home to the PI machine, but having read the warnings about exposing the PI to the internet am worried. I tried to read the articles about travelling man and the different users and passwords, but got a bit lost.

For example there is mention in some articles about using a script called passwd-master to update and align the various different users and passwords, but my pi image doesn’t seem to have that file.

I also read that there is a service called fail2ban to lock out IP addresses that repeatedly fail to login, but I don’t seem to have that either.

So far all I have done is change the root password, the freepbx gui admin user password and the extension 701 password. If I browse the passwd file it seems there is a user called asterisk, but I have no idea what the password for that is. There are also other users like www-data that I am not sure may have known passwords and so would be a risk if I open up the SSH port.

The PIAF newbie tutorial also mentions a webmin section, but again I don’t think I have that, or if I do I am not sure how to access it.

If anyone can help me or point me at the right articles to read I would be very grateful. It probably helps if I outline what I am trying to set up with it.

At the moment I have:
A PSTN line at home in Manchester
A windows XP machine running 3CX free version
A Grandstream GXW410 FXO gateway connected to the PSTN line and via home LAN to 3CX
Some FXS gateways attached to the 3CX via the home LAN
A voiptalk subscription linked to same caller ID as my PSTN line
When someone rings my PSTN number, it rings the phones connected to the FXS gateways.
If I make a calls from home 3CX routes either over voiptalk or via my PSTN line depending on the number called. The person called sees my PSTN caller ID regardless.

I will be spending several weeks at a flat in France and want to set it up so that if someone calls my home, it rings in France as well as at home. I also want to be able to call from France via my PSTN line at home or via the voiptalk number.

I tried this kind of thing in the past when I was working away in London by setting up an external extension at the remote location, but had issues with calls cutting off after a certain time, or one way audio.

I guess what I needed was a 3CX to 3CX link, but that is only available in paid version.

So I am looking to ditch 3CX and also like the idea of using a Pi instead of having to leave a full windows PC running at home. Plus also let’s face it the Pi is just way cooler than a PC. I am also interested in setting up a VPN tunnel from France to Home so that I can still access TV stuff that only works in the UK.

What I think I need to set up this is then:
A Pi at home running Asterisk
A Pi in France running Asterisk
A VPN link between the two
An Asterisk-Asterisk trunk (via the VPN or over the internet?)

What would also be great is if I could make my mobile phone also be able to answer PSTN incoming calls when it has wifi connection either in the France house, or remotely. And to be able to have people call my UK mobile number, but that I can answer on a French mobile without paying roaming charges on the UK mobile.

I know this is a lot of detail, but any help would be great. The biggest thing I guess is how to secure my Pi at home and still be able to access it remotely to change settings on it.

Thanks again for your advice !

 

[regfixit]

Sorry to bump my own thread, but meanwhile I have discovered the shadow file (last time I dabbled in Linux was 1996 and I don't think it existed then) so I gather these other userid's can't actually log on directly as they all have * as the password. I guess they are used to run the asterisk system in a way that it doesn't have full root access.

I also updated my pi and now the iptables does have some fail2ban entries, although there doesn't seem to be a service called fail2ban running - should there be ?

Any thoughts about the merits of connecting to Incredible Pi PBX's together as I want - I am wondering if I just connect them using the external IP addresses of each location, or it is better to set up VPN between them and connect them over the internal VPN network ?

Also, my FreePBX status page says I am using default ARI Admin password and default Asterisk Manager password - should I change these (and how if so !)?

 

[wardmundy]

Leave the passwords alone. Your server is locked down with IPtables. Lots of Asterisk functions depend upon those passwords and Asterisk Manager is locked down to localhost. ARI is a nightmare. When you lock out and back into Incredible Pi as root, the latest patch will be installed. Leave IPtables running, and you should be OK.

There's a version of NeoRouter VPN for the Raspberry Pi. It is explained in the Nerd Vittles tutorial. It takes about 2 minutes to set it up. Good luck!

 

[regfixit]

Thanks very much for your advice. Will take a look at that.

 

[regfixit]

I've managed to set up my Granstream GXW4104 for both inbound and outbound calls and my voiptalk via IAX for outbound.
However, I can only seem to get inbound to work with voiptalk if I forward UDP port 4569 to my Pi.
Does that sound right - I thought the idea was not to forward any ports at all to the PI and that somehow the IAX protocol outbound traffic would allow inbound traffic in as well ?

 

[MGD4me]

I thought the idea was not to forward any ports at all to the PI

Normally, that would be the case. I do not use voiptalk myself, so I can't speak specifically about what their "needs" would be. But if you could post the details regarding your Trunk configuration (sanitized, naturally) we can first make sure you set up correctly. For inbound calls to work properly, the critical details would be in how you are registering with voiptalk.

 

[regfixit]

That very kind of you, here are the details:
General settings:
Trunk name: voiptalk iax
Outbound caller ID: 01585xxxxxx (this is the voiptalk inbound PSTN number that is linked to my account)
CID Options: Allow any CID
Max channels: 2
Dialled no manip rules - blank for now, will add later to format number correctly with area code for local calls etc
Outgoing setttings:
Trunk name: voiptalk
Peer details:
username=844xxxxxx (voiptalk user ID)
type=peer
secret=<voiptalk password for this user ID)
qualify=yes
host=iax.voiptalk.org
Incoming settings:
User context: 01565xxxxxx (voiptalk inbound PSTN number)
username=01565xxxxxx
type=user
context=from-pstn
calltokenoptional=0.0.0.0/0.0.0.0
Register string: left blank

I tried putting 844xxxxxx:<password>@iax.voiptalk.org in the register string and saw messages on the CLI iax2 debug log like:
Tx-Frame Retry[000] -- OSeqno: 001 ISeqno: 001 Type: IAX Subclass: REGREQ
Timestamp: 00081ms SCall: 06525 DCall: 02933 [77.240.56.70:4569]
USERNAME : 844xxxxxx
REFRESH : 60
MD5 RESULT : <deleted>

Rx-Frame Retry[ No] -- OSeqno: 001 ISeqno: 002 Type: IAX Subclass: ACK
Timestamp: 00081ms SCall: 02933 DCall: 06525 [77.240.56.70:4569]
Rx-Frame Retry[ No] -- OSeqno: 001 ISeqno: 002 Type: IAX Subclass: REGREJ
Timestamp: 01058ms SCall: 02933 DCall: 06525 [77.240.56.70:4569]
CAUSE : Registration Refused
CAUSE CODE : 29
So I removed them.

There are also successfule POKE, PONG, ACK messages in the log from the same voiptalk IP address.

In voiptalk itself there is a section for how to route your incoming calls with various options. Mine was set to route 01565xxxxxx to voiptalk ID 844xxxxxx. I changed this to be route to IP PBX - Asterisk IAX and entered my public IP address and opened up port 4569 on my router to forward to my Pi. Then inbound calls worked. I noticed they came from a slightly different IP address than the one used by outgoing.

Rx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 000 Type: IAX Subclass: NEW​

Timestamp: 00044ms SCall: 07834 DCall: 00000 [77.240.54.12:4572]​

VERSION : 2​

CALLED NUMBER : 01565xxxxxx​

CODEC_PREFS : (alaw|ulaw|gsm|speex16|g729|g723)​

CALLING NUMBER : 01565yyyyyy​

CALLING PRESNTN : 3​

CALLING TYPEOFN : 0​

CALLING TRANSIT : 1​

CALLING NAME : 01565yyyyyy​

LANGUAGE : en​

USERNAME : 01565xxxxxx​

FORMAT : 8​

CAPABILITY : 65535​

ADSICPE : 2​

DATE TIME : 2014-11-04 08:47:14​

CALLTOKEN : 51 bytes​

​

-- Accepting UNAUTHENTICATED call from 77.240.54.12:​

-- > requested format = alaw,​

-- > requested prefs = (alaw|ulaw|gsm|speex16|g729|g723),​

-- > actual format = ulaw,​

-- > host prefs = (ulaw|alaw|gsm),​

-- > priority = mine​

Tx-Frame Retry[000] -- OSeqno: 000 ISeqno: 001 Type: IAX Subclass: ACCEPT​

Timestamp: 00010ms SCall: 07468 DCall: 07834 [77.240.54.12:4572]​

FORMAT : 4​

FORMAT2 : ulaw​

My concern is with that big UNAUTHENTICATED - I am guessing that with this setup, anyone can connect on port 4569 to my PI if they say they are calling from 01565xxxxxx as I couldn't see how the voiptalk user ID and password comes into play now.

I know on my 3CX system I don't have to open any ports to have incoming calls work via SIP so I am thinking the difference here using IAX is the Registration part and perhaps it's not supported by voiptalk (am going to log a support ticket to ask them). In the end I could switch it all back to use SIP instead of IAX, but was hopign to get the IAX working as I'd read it's more efficient in terms of bandwidth and I thought especially if I am in France making a call that is routed first to my home here and then from there to voiptalk, then that would be important.

Have closed the port again for now.

Once again many thanks for any pointers or tips.

 

[regfixit]

I had a reply from voiptalk and it is the case that they don't authenticate when passing inbound IAX calls:

Hassan (Telappliant)
Nov 05 10:30
Hi Dominic,
There is no authentication for IAX incoming. Please configure your IAX server to accept traffic from following IP address range for your incoming number.
217.14.138.0/24
77.240.48.0/24
77.240.54.0/24
77.240.56.32/27
77.240.60.0/24
77.240.61.160/27
So if anyone else will try to send you the traffic for the DID, your server will not accept it.
Thanks

What I was slightly puzzled by is that I have not so far added these to my Iptables so I would have thought the incoming IAX (from 77.240.54.12) should not even have reached my freepbx Asterisk system ?