Categories
Handsets

Gigaset Handsets

All the Gigaset DECT bases and handsets we sell are compatible with each other, but some handsets may only offer basic or limited compatability find out more information contact us

 

 

For full details of handset features click on the handsets image

 

Categories
Knowledge Base

Trusting Linux servers

This hopes to explain in simple steps setting up a pair (or more) servers as a trusted group.
So what do we want to achieve ? Well we wnat to be able to ssh, sftp, rsync etc between servers and not need to enter passwords
Steps required
1 Hosts File
2 Editing sshd_config
3 Create the ssh keys
4 Setting up the Auth. users file
Hosts File

Firstly we need to make sure all servers are in the hosts file
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost
127.0.0.1 asterisk2.local
# We point to eth0 on our own box
192.168.10.100 asterisk2.local
192.168.10.100 asterisk2
# We point to eth1 on the other box
192.168.10.108 asterisk1

Editing sshd_config

Now we need to edit the /etc/ssh/sshd_config file
so that the following

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile /root/.ssh/authorized_keys

replaces

#RSAAuthentication yes
#PubkeyAuthentication yes
#AuthorizedKeysFile .ssh/authorized_keys

Now restart the sshd
/etc/init.d/sshd restart

Create the ssh keys

We now need to create the keys on each server
ssh-keygen -t rsa
and hit return for all the questions.
this will create 2 files in /root/.ssh

go the /root/.ssh directory and copy the id_rsa.pub to the other server and get its id_rsa.pub

sftp asterisk1

put id_rsa.pub asterisk2.pub
get id_rsa.pub asterisk1.pub
bye

Setting up the Auth. users file

In the /root/.ssh directory you will now have for example :-

asterisk1.pub id_rsa id_rsa.pub known_hosts

We now need to copy the asterisk1.pub to the authorized_keys file

cat asterisk1.pub >> authorized_keys

Do the same on the other server.

You should now be able to ssh and rsync between servers.

Categories
Gateways

Xorcom Astribank

Astribank is a versatile and powerful channel bank that was specifically designed for the Asterisk IP-PBX. Astribank supports all the common telephony lines and trunks: FXS, FXO, BRI, E1/T1 PRI, T1 CAS and E1 R2. The Astribank driver is a part of the standard Asterisk distribution.

DataSheet

Categories
Knowledge Base

Sip debugging with wireshark

Wireshark and Cloudshark are invaluable tools for debugging sip and iax issues on your Asterisk server.

Here we have a short Video that goes over the basics of getting a call captured and opened in Cloudshark

we also have a short tutorial for download here in PDF format

First we need to get the packets we want. This is far simpler than its thought. We use a simple command line tool called tcpdump, if its not installed install it now, You wont be able to live without it.

Here we have 2 commands, The first captures packets on interface eth0, -n means we won’t convert addresses, -w means we just capture raw packets and udp means its only the udp packets we want and finally port 5060 means its only the sip messaging we want. In the second we dont specify port 5060 so that we get the rtp stream as well.

/usr/sbin/tcpdump -n -i eth0 -w /tmp/wireshark.pcap -s2000 udp port 5060
 /usr/sbin/tcpdump -n -i eth0 -w /tmp/wireshark.pcap -s2000 udp
screen -S "udpDump" -dm tcpdump -n -i eth0 -C 9 -W 15 -w /var/log/asterisk/dumpsip.pcap -s2000 udp port 5060

The command above will write to file in the background and will rotate at 9 meg so suitable for cloudshark

Once you have started the capture and made a call as required you will get a file called for example /tmp/wireshark.pcap copy this to your workstation via ftp or sftp as you would copy any file.

Categories
Products and services Services Support

Categories
Knowledge Base

Better SIP security

In Seven Steps

Original Text by J Todd March 28th, 2009

In case any of you were wondering why there has been a fairly notable upswing in the attacks happening on SIP endpoints, the answer is “script kiddies.”  In the last few months, a number of new tools have made it easy for knuckle-draggers to attack and defraud SIP endpoints, Asterisk-based systems included.  There are easily-available tools that scan networks looking for SIP hosts, and then scan hosts looking for valid extensions, and then scan valid extensions looking for passwords.You can take steps, NOW, to eliminate many of these problems.  I think the community is interested in coming up with an integrated Asterisk-based solution that is much wider in scope for dynamic protection (community-shared blacklists is the current thinking) but that doesn’t mean you should wait for some new tool to defend your systems.  You can IMMEDIATELY take fairly common-sense measures to protect your Asterisk server from the bulk of the scans and attacks that are on the increase. The methods and tools for protection already exists – just apply them, and you’ll be able to sleep more soundly at night.

Seven Easy Steps to Better SIP Security on Asterisk:

 

1) Don’t accept SIP authentication requests from all IP addresses.  Use the “permit=” and “deny=” lines in sip.conf to only allow a reasonable subset of IP addresess to reach each listed extension/user in your sip.conf file.  Even if you accept inbound calls from “anywhere” (via [default]) don’t let those users reach authenticated elements!

 

2) Set “alwaysauthreject=yes” in your sip.conf file.  This option has been around for a while (since 1.2?) but the default is “no”, which allows extension information leakage.  Setting this to “yes” will reject bad authentication requests on valid usernames with the same rejection information as with invalid usernames, denying remote attackers the ability to detect existing extensions with brute-force guessing attacks.

 

3) Use STRONG passwords for SIP entities.  This is probably the most important step you can take.  Don’t just concatenate two words together and suffix it with “1? – if you’ve seen how sophisticated the tools are that guess passwords, you’d understand that trivial obfuscation like that is a minor hinderance to a modern CPU.  Use symbols, numbers, and a mix of upper and lowercase letters at least 12 digits long.

 

4) Block your AMI manager ports.  Use “permit=” and “deny=” lines in manager.conf to reduce inbound connections to known hosts only.  Use strong passwords here, again at least 12 characters with a complex mix of symbols, numbers, and letters.

 

5) Allow only one or two calls at a time per SIP entity, where possible.  At the worst, limiting your exposure to toll fraud is a wise thing to do.  This also limits your exposure when legitimate password holders on your system lose control of their passphrase – writing it on the bottom of the SIP phone, for instance, which I’ve seen.

 

6) Make your SIP usernames different than your extensions.  While it is convenient to have extension “1234? map to SIP entry “1234? which is also SIP user “1234?, this is an easy target for attackers to guess SIP authentication names.  Use the MAC address of the device, or some sort of combination of a common phrase + extension MD5 hash (example: from a shell prompt, try “md5 -s ThePassword5000?)

 

7) Ensure your [default] context is secure.  Don’t allow unauthenticated callers to reach any contexts that allow toll calls.  Permit only a limited number of active calls through your default context (use the “GROUP” function as a counter.)  Prohibit unauthenticated calls entirely (if you don’t want them) by setting “allowguest=no” in the [general] part of sip.conf.

 

These 7 basics will protect most people, but there are certainly other steps you can take that are more complex and reactive.  Here is a fail2ban recipe which might allow you to ban endpoints based on volume of requests.  There is discussion on the asterisk-user and asterisk-dev mailing lists of incorporating this type of functionality into Asterisk – let’s hear your ideas!

 

If you’d like to see an example of the tools that you’re up against, see this demo video of an automated attack tool that does scan, guess, and crack methods via a click-and-drool interface.
In summary: basic security measures will protect you against the vast majority of SIP-based brute-force attacks.  Most of the SIP attackers are fools with tools – they are opportunists who see an easy way to defraud people who have not considered the costs of insecure methods.  Asterisk has some methods to prevent the most obvious attacks from succeeding at the network level, but the most effective method of protection are the administrative issues of password robustness and username obscurity.

 

JTodd
Digium
Categories
Knowledge Base Technical

Nagios plugin for reading the Asterisk Database

This is a simple plugin that is based on one by Jason Rivers We have changed it now to read the ASTDB (Asterisk internal Database and then based on ok and Critical keys it will report OK or Critical staus reports to Nagios.

This was written for reporting if an Elastix system is in Day or Night mode.

You can define the Database Family, Key, Critical value and OK value. This means you can cutomise it to what ever you need to report.

 

The Code is below, make you may need to change /usr/bin/nc for what ever you use for netcat.

any issues email us, but dont forget this is given for free not supported for free.

#!/bin/bash
#
# Program : check_asterisk_ami
# :
# Author : Original code by Jason Rivers < jason@jasonrivers.co.uk >
# : Modified by Cyber-cottage.co.uk for checking the asterisk Database
# :
# Purpose : Nagios plugin to return Information from an Asterisk host using AMI
# :
# Parameters : --help
# : --version
# :
# Returns : Standard Nagios status_* codes as defined in utils.sh
# :
# Licence : GPL
#
# Notes : See --help for details
#============:==============================================================
PROGNAME=`basename $0`
PROGPATH=`echo $0 | /bin/sed -e 's,[\/][^\/][^\/]*$,,'`
REVISION=`echo '$Revision: 1.1.0.6 $' | sed -e 's/[^0-9.]//g'`
. $PROGPATH/utils.sh
print_usage() {
echo "Usage: $PROGNAME [-H hostname] [-u username] [-p password] [-P port] [-k DBkey] [-c critical] [-o ok] [-f family]"
echo " -H Hostname"
echo " -u AMI Username"
echo " -p AMI Password"
echo " -P (optional) AMI PORT"
echo " -k Database key"
echo " -f Database family"
echo " -c Critical Key"
echo " -o OK KEY"
echo ""
echo "SupportedCommands:"
echo " Most DB familiys that toggle such as DayNight in elastix"
echo "Usage: $PROGNAME --help"
echo "Usage: $PROGNAME --version"
}
print_help() {
print_revision $PROGNAME $REVISION
echo ""
echo "Nagios Plugin to check Asterisk ASTDB using AMI"
echo ""
print_usage
echo ""
echo "Asterisk Call Status Check. orignal version by © Jason Rivers 2011 changes to do ASTDB by cyber-cottage.co.uk"
echo ""
exit 0
# support
}
# If we have arguments, process them.
#
exitstatus=$STATE_WARNING #default
while test -n "$1"; do
case "$1" in
--help)
print_help
exit $STATE_OK
;;
-h)
print_help
exit $STATE_OK
;;
--version)
print_revision $PROGNAME $REVISION
exit $STATE_OK
;;
-V)
print_revision $PROGNAME $REVISION
exit $STATE_OK
;;
-H)
REMOTEHOST=$2;
shift;
;;
-P) AMIPORT=$2;
shift;
;;
-u) AMIUSER=$2;
shift;
;;
-p) AMIPASS=$2;
shift;
;;
-c)
CRITICALNAME=$2
shift;
;;
-o)
OKNAME=$2
shift;
;;
-k)
DBKEY=$2;
shift;
;;
-f)
FAMIL=$2;
shift;
;;
*)
echo "Unknown argument: $1"
print_usage
exit $STATE_UNKNOWN
;;
esac
shift
done
if [ "${AMIPORT}" = "" ]; then
AMIPORT="5038"
fi
if [ "${FAMIL}" = "" ]; then
##WARNING
echo="CRITICAL: Unknown KEY"
print_help
exit=$STATE_CRITICAL
else
## Checking Astdb
CHANNELS=`/bin/echo -e "Action: login Username: ${AMIUSER} Secret: ${AMIPASS} Events: off Action: DBGet Family: ${FAMIL} Key: ${DBKEY} Action: Logoff " | /usr/bin/nc $REMOTEHOST ${AMIPORT} | awk '/Val/ {print $2}'|tr -d " "`
if [ "$CHANNELS" = "" ]; then
echo "UNKNOWN: Unable to get ASTDB status"
exit $STATUS_UNKNOWN
fi
if [ "$CHANNELS" = "${OKNAME}" ]; then
exitstatus=$STATU_OK
MSG="OK: ${DBKEY} Asterisk Emergency message not active"
elif [ "$CHANNELS" = "" ]; then
exitstatus=$STATU_WARNING
MSG="WARNING: Asterisk Unknown status"
elif [ "$CHANNELS" = "$CRITICALNAME" ]; then
exitstatus=$STATU_CRITICAL
MSG="CRITICAL: ${DBKEY} Asterisk Emergency message active"
fi
fi
echo $MSG
exit $exitstatus

Categories
Knowledge Base Technical

Installing Webdav on Centos with untrusted ssl certificates

Webdav (Web-based Distributed Authoring and Versioning) is a set of methods based on the Hypertext Transfer Protocol (HTTP) that facilitates collaboration between users in editing and managing documents and files stored on World Wide Web servers.This can be useful to allow backing up of data between servers. In Linux there is a command line client called cadaver that in theory allows you to script its use.

This isnt as staight forward as it could have been and we spent half a day and a lot of Googling to get to the bottom of common problems, Such as auto loging in, Untrusted ssl certificates and scripting.

So here is a simple run down on what you have to do to script with webdav and cadaver

Install cadaver

yum install cadaver

once installed you will need to install the certificate for the untrusted ssl site

for example
wget http://website/untrusted.server.com.cer
now convert this to a .pem file
openssl x509 -inform der -in untrusted.server.com.cer -out untrusted.server.com.pem

now add this to your cert.pem file.

in centos this seems to be in the  /usr/share/ssl/ directory
cat untrusted.server.com.pem >> /usr/share/ssl/cert.pem

you now need to edit the ./netrc file with the server and logon details
vi ~/.netrc

machine untrusted.server.com
login   user
password        secret

save the file.

now when you connect you wont be promted for accepting the certificate or a username and password

cadaver -et  https://untrusted.server.com
dav:/>

Ok now we want to script the actions.
This is as simple as creating a script file.

for example

vi ~/.cadavscript
ls
pwd
quit

will give the following output

cadaver -et  https://untrusted.server.com/ < ~/.cadavscript
dav:/> Listing collection `/’: succeeded.
test.txt                              35  Aug 19 15:04
dav:/> Current collection is `https://untrusted.server.com/’.
dav:/> Connection to `untrusted.server.com’ closed.

So create a script to do what you want and your done

Categories
Design Installation Services Support Technical

Gradwell Approved Professional

A Gradwell Approved Professional (GAP) has a core set of knowledge required to succeed with the Gradwell product set and systems. To become a Gradwell Approved Professional partners must pass an examination and show an in depth knowledge of Gradwell Products and Voip Support.

This means you can be confident that they can:

  • Achieve consistent roll outs of reliable business telephony services.
  • Confidently resolve end user technical issues within an acceptable time frame.

To signup to Gradwell services with us CLICK HERE

Categories
Peripherals Products

The Algo 8180 SIP Audio Alerter

The 8180 SIP Audio Alerter is a loud ringing, paging and intercom device for use with SIP telephone systems. It has two main uses. The first is as a loud ringer for use in places such as warehouses. The second use is as a paging and intercom system. It can operate in both these modes at the same time by appearing as two different extensions on your phone system at the same time.

When registered with a SIP server, one endpoint will play an audio file from internal memory upon ring detection. The second endpoint will auto-answer for voice paging or full intercom (two way audio).

Equipped with a high efficiency integrated amplifier and tuned high quality loudspeaker, the 8180 is typically eight times louder than a telephone speaker. Several audio files are pre-loaded into the 8180 internal memory for ring sounds but users may also record or upload custom audio files, music, sound effects, or voice announcements.

Ambient noise monitoring

The advanced features of the 8180 include SoundSureTM technology which automatically adjusts loud ring and loudspeaker volume to compensate for background ambient noise. Ideal for variable noise environments (restaurants, workshops, classrooms, etc.), SoundSureTM ensures that ringing or paging is always heard but not unnecessarily loud.

Applications / Usage scenario

  • Loud Ringer in noisy or variable noise environments (classroom, restaurant, machine shop)
  • Voice Paging (warehouse, workshop)
  • Outdoor ringing or paging
  • Multi-cast wide area notification

Easy to Install

  • Network managed SIP endpoint
  • Configuration is possible using the feature buttons or web interface
  • PoE eliminates local power supply

Features

  • Voice Paging with talkback capability
  • High efficiency and high output wideband speaker
  • Multicast receive or broadcast capability
  • Outputs for external speaker, slave amplifier, or visual alerter
  • Dual purpose loud ringing and/or talkback voice paging
  • Significantly louder (eight to twenty times) than typical telephones
  • Low frequency tones outperform traditional shrill electronic ringers
  • SoundSureTM ambient noise compensation adjusts output for noise level
  • Multicasting capability for wide area notification

Customisable

  • Pre-loaded with several ring tones including bell, chime, gong, buzzer, warble, and dogs
  • Supports custom uploaded WAV files or recorded messages
  • Selectable/customisable alert tones or announcements

Please contact for pricing and avalibility