| 00:13.02 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.125.178) |
| 00:16.47 | ChannelZ | ExecIf uses expression?true:false like it says, not expression,true,false |
| 00:17.56 | *** join/#asterisk pontis (~pontis@83.137.2.145) |
| 00:20.45 | ChannelZ | so ExecIf($[${CALLPROCESS}=0]?Goto(sendcong)) presumably |
| 01:24.44 | *** join/#asterisk Schmee (~zaphod@ppp100-124.static.internode.on.net) |
| 01:27.31 | Schmee | Morning all. Simple question, is there a way, using the command line, to simulate multiple parked calls? |
| 01:38.32 | *** join/#asterisk amizraa (~amizraa@gateway/tor-sasl/amizraa) |
| 01:40.26 | ChannelZ | none that I can think of |
| 01:47.23 | *** join/#asterisk timahvo1 (~rogue@41.212.120.45) |
| 01:52.34 | Schmee | Maybe there's something I missed in the AGI docs. I'll take another look. Thanks anyway |
| 01:57.28 | *** join/#asterisk killown (~killown@pdpc/supporter/student/killown) |
| 02:16.36 | ChannelZ | You could maybe clobber together a test extension that parks the call and then use 'channel originate' on Local channels to call them |
| 02:17.18 | *** join/#asterisk vinhdizzo (~vinh@cpe-66-74-182-202.socal.res.rr.com) |
| 02:30.54 | *** join/#asterisk hebber (~hebber@node-14pg.pool-125-25.dynamic.totbb.net) |
| 02:32.09 | Schmee | ChannelZ: thanks, that's a great idea. I'll give that a try. Have to get going for now though. Thanks again |
| 02:33.33 | *** join/#asterisk JuStIcIa_ (~artur0@190.167.30.205) |
| 02:33.45 | *** join/#asterisk sawgood (~sawgood@23-24-214-61-static.hfc.comcastbusiness.net) |
| 02:44.06 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.126.218) |
| 02:52.27 | Kobaz | if anyone cares... the sdp port zero problem i was having over the weekend, i fixed by upgrading the ipod bria, it was being stupid and had some bugs apparently |
| 03:09.09 | *** join/#asterisk yano (yano@freenode/staff/yano) |
| 03:25.13 | *** join/#asterisk killown (~killown@pdpc/supporter/student/killown) |
| 03:28.01 | *** join/#asterisk timahvo1 (~rogue@41.212.120.45) |
| 03:39.23 | *** join/#asterisk andrewyager (~andrewyag@CPE-144-132-193-27.nsw.bigpond.net.au) |
| 03:59.55 | ChannelZ | Bria? Bugs? NOOOOOO! |
| 04:35.18 | *** join/#asterisk mintos (mvaliyav@nat/redhat/x-tufjwqmvfgfnghwu) |
| 04:51.31 | *** join/#asterisk timahvo1 (~rogue@41.212.120.45) |
| 04:54.11 | *** join/#asterisk gerhard7 (~gerhard7@77-172-47-159.ip.telfort.nl) |
| 04:58.11 | *** join/#asterisk bmg505 (~leon@196.210.161.223) |
| 05:05.51 | *** join/#asterisk asvx (~svx@193.105.11.73) |
| 05:15.30 | *** join/#asterisk threesome (~threesome@ip-94-113-12-233.net.upcbroadband.cz) |
| 05:30.02 | *** join/#asterisk _mnathani_ (~mnathani@198-84-231-11.cpe.teksavvy.com) |
| 05:37.32 | *** join/#asterisk killown (~killown@pdpc/supporter/student/killown) |
| 05:41.35 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.125.154) |
| 05:42.42 | *** join/#asterisk suneye (~atcmmi@116.25.194.238) |
| 05:51.40 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.125.154) |
| 06:00.49 | *** join/#asterisk Thesulac (~Thesulac@82.94.204.46) |
| 06:15.49 | *** join/#asterisk AlbinoGeek (AcademyInt@unaffiliated/albinogeek) |
| 06:16.38 | AlbinoGeek | Hey there! I'm having an issue on an existing system where without dialing 0011 I am able to dial international numbers, and it's not logging as international (but it is getting through.) |
| 06:19.25 | ChannelZ | Welly ou should look at your dialplan... |
| 06:24.07 | *** join/#asterisk vfabi (~fabi@host-static-93-116-255-140.moldtelecom.md) |
| 06:25.13 | AlbinoGeek | I'm also having another issue where my provider is getting 401 instead of 407, will doing the rfc compensate fix this? |
| 06:26.49 | ChannelZ | "doing the rfc"? |
| 06:28.27 | AlbinoGeek | ChannelZ: (adding the rfc2833compensate configuration) |
| 06:28.47 | AlbinoGeek | rfc2833compensate=yes |
| 06:29.23 | *** join/#asterisk Maliuta (nikolai@donetsk.lusan.id.au) |
| 06:32.48 | ChannelZ | I dunno, are they running a really ancient version of asterisk? |
| 06:33.25 | ChannelZ | and are you currently using rfc2833? If they are sending out the wrong DTMF maybe you should think about a new provider |
| 06:44.50 | AlbinoGeek | ChannelZ: Not currently using rfc2833compensate, no. |
| 06:45.09 | AlbinoGeek | The provider is siptalk.com.au, it's an australian client running this asterisk. |
| 06:45.33 | AlbinoGeek | And unfortunately, just about everything in Australia technology wise is always ancient. |
| 06:46.19 | AlbinoGeek | -- |
| 06:46.26 | AlbinoGeek | Fixed that issue anyways, having another issue now |
| 06:46.40 | AlbinoGeek | Clients are able to dial out international calls (and be connected) without dialing 0011 to get out. |
| 06:47.24 | *** join/#asterisk sundancer (~monolith@BSN-176-181-85.dial-up.dsl.siol.net) |
| 06:50.34 | sundancer | hi, i have asterisk 1.4.24.1 running on public IP. recently i noticed i am receiving unwanted INVITEs from some public IP. what bothers me that my asterisk sends back 404 or 503 errors. Can i prevent that? I dont want my asterisk to respond on INVITE if peer is not authenticated |
| 06:50.50 | ChannelZ | No, I meant are you using rfc2833 for DTMF in the first place, not compensate. |
| 06:51.30 | ChannelZ | And I have the same answer about your international calls, check your dialplan. Either you're sending digits to your ITSP you think you're not, or they are doing something downstream that you'll have to take up with them |
| 06:51.43 | wdoekes | sundancer: sending a 401/407 is part of authentication. skipping responses is not an option |
| 06:52.14 | wdoekes | sundancer: use the firewall to whitelist IPs instead |
| 06:52.32 | sundancer | i have road warrior clients, i cant |
| 06:52.51 | ChannelZ | You can't not respond to an unauthenticated INVITE. The first one always is. |
| 06:53.29 | sundancer | im responding with 404 |
| 06:53.40 | wdoekes | yea.. that's really a bug |
| 06:53.46 | wdoekes | you have alwaysauthreject=no |
| 06:54.50 | AlbinoGeek | ChannelZ: Oh no, we're not using dtmf |
| 06:54.56 | AlbinoGeek | not rfc2833 for dtmf ** |
| 06:55.22 | ChannelZ | so compensate is meaningless. You're doing inband?? |
| 06:55.38 | sundancer | wdoekes: i have alwaysauthreject=yes in context=bogon-calls |
| 06:55.58 | sundancer | wdoekes: sorry. thats in [general] section |
| 06:56.10 | sundancer | default context is bogon-calls |
| 06:56.23 | wdoekes | you have allowguest=yes (default?) |
| 06:56.34 | sundancer | hm yes |
| 06:57.02 | sundancer | allowguest=yes |
| 06:57.08 | sundancer | also in [general' |
| 06:57.10 | sundancer | ] |
| 06:57.20 | *** join/#asterisk v0lZy (~Thunderbi@mail.silk-group.net) |
| 06:57.43 | wdoekes | that means that unauthenticated clients are assumed to be guests, they land in the bogon-calls context, and from there they get a 404 |
| 06:58.38 | sundancer | in [bogon-calls] i have only this: exten => _X.,1,Congestion |
| 06:58.49 | wdoekes | ok.. so that's the 503 |
| 06:58.57 | wdoekes | but calls to "abc" get a 404 |
| 06:59.14 | sundancer | aha, ok.. that makes sense |
| 06:59.23 | wdoekes | I can see how you think that it should be able to simply discard all responses in bogon-calls, but there is no option to do that |
| 06:59.49 | sundancer | exactly my question yes :) thanks |
| 07:00.21 | sundancer | so how do you guys defend to unwanted INVITEs when someone is trying to make call without authentication? |
| 07:00.34 | wdoekes | we don't have allowguest=yes |
| 07:00.40 | ChannelZ | you could do a long Wait |
| 07:01.31 | AlbinoGeek | Hmm, some clients are getting "488 error" when trying to do outbound calls now. |
| 07:02.33 | wdoekes | AlbinoGeek: the sdp is getting rejected.. check the deny/allow list of codecs |
| 07:02.36 | sundancer | thank you for answers |
| 07:02.41 | sundancer | will dig :) |
| 07:03.10 | *** join/#asterisk kresp0 (~kresp0@97.Red-83-50-235.dynamicIP.rima-tde.net) |
| 07:03.28 | AlbinoGeek | Welp, I don't use this at all; PBX, VOIP, asterisk; nothing; client just handed me their asterisk server and said "make it wrok" |
| 07:03.47 | AlbinoGeek | So besides going over the configs, checking all users and authentication, etc etc I'm at a complete loss of what to do at this point. |
| 07:04.33 | ChannelZ | hire someone :/ |
| 07:06.01 | *** join/#asterisk jkroon (~jkroon@196.37.70.13) |
| 07:08.07 | *** join/#asterisk jsjc (~Adium@92.Red-83-38-209.dynamicIP.rima-tde.net) |
| 07:10.01 | AlbinoGeek | :/ I wish. |
| 07:10.20 | AlbinoGeek | Their last sysadmin looked at the issue (the intl calls) and quit the next day. |
| 07:10.29 | AlbinoGeek | And he was meant to be good with asterisk/pbx systems |
| 07:12.25 | ChannelZ | Well people lie. He obviously didn't know anything |
| 07:12.49 | ChannelZ | Anyway WE won't be able to solve anything without seeing anything |
| 07:14.21 | ChannelZ | What exactly is being dialed by the user to make these calls? And subsequently what gets passed to the ITSP? (are we actually even talking about SIP to an ITSP here or..?) |
| 07:16.42 | *** join/#asterisk sekil (~sekil@78.24.104.73) |
| 07:17.11 | sundancer | i changed type=friend to type=user for one of my voip handsets and now it cant register because of Registration from '<sip:c470ip@192.168.245.1>' failed for '192.168.245.21' - No matching peer found |
| 07:17.47 | sundancer | i also changed allowguest=no |
| 07:17.55 | sundancer | it was 'yes' before |
| 07:18.15 | sundancer | i have [c470ip] defined in sip.conf and host=dynamic |
| 07:19.52 | sundancer | im getting SIP/2.0 403 Forbidden (Bad auth). |
| 07:21.13 | sundancer | if i change type=friend for [c470ip] it can authenticate again |
| 07:21.20 | sundancer | what am i missing here? :) |
| 07:24.06 | wdoekes | sounds odd indeed, sundancer. however, you are using a rather old asterisk |
| 07:24.09 | *** join/#asterisk pa (~pa@unaffiliated/pa) |
| 07:24.54 | sundancer | i know.. its freebsd embedded on CF card, running on pcengines board alix2d3 |
| 07:25.23 | sundancer | and its real pain in the *beep* to upgrade |
| 07:26.25 | sundancer | maybe its time to move asterisk to VPS :) |
| 07:29.32 | ChannelZ | wierd that the IPs are different |
| 07:30.15 | sundancer | i have nat=yes .. and i dont really need that |
| 07:34.00 | wdoekes | ChannelZ: no, that's the registration header |
| 07:34.05 | wdoekes | it's the destination domain |
| 07:34.16 | ChannelZ | oh right |
| 07:34.42 | ChannelZ | should probably really be in bed |
| 07:35.05 | wdoekes | 9am here.. no time for bed yet |
| 07:35.08 | sundancer | :) |
| 07:35.47 | ChannelZ | Perhaps a more pertinent question is, is there a specific reason you wanted to make it a type=user? |
| 07:36.55 | wdoekes | sundancer: and you'll probably want to call the handset too, right? |
| 07:37.03 | sundancer | yes |
| 07:37.10 | wdoekes | then type=user is not an option |
| 07:37.16 | ChannelZ | 99% of the time you want type=peer |
| 07:37.48 | ChannelZ | registers will still match by name, but after that by IP/port. |
| 07:37.55 | *** join/#asterisk c0rnoTa (~c0rnoTa@78.24.154.190) |
| 07:37.56 | *** part/#asterisk c0rnoTa (~c0rnoTa@78.24.154.190) |
| 07:39.46 | sundancer | oh, ok then.. i thought by the name that type=user is for phones and stuff and type=peer is for upstream providers |
| 07:40.28 | ChannelZ | not really. It's really a terrible designation and was very misleadingly documented in the old Asterisk books |
| 07:41.08 | *** join/#asterisk threesome (~threesome@79.127.150.148) |
| 07:41.50 | ChannelZ | peers match calls by IP and port. users match calls by name. friend makes one of each. |
| 07:42.37 | ChannelZ | but since users don't have IPs, you can only get calls from them (from Asterisk's point of view) because it has no address to send calls TO. |
| 07:44.08 | *** join/#asterisk Rumbles (~Rumbles@mail.solutiontelecom.co.uk) |
| 07:44.10 | sundancer | good to know, thank you |
| 07:50.12 | *** join/#asterisk Maliuta (~nobusines@kiev.lusan.id.au) |
| 07:57.46 | *** join/#asterisk fling (~fling@fsf/member/fling) |
| 08:02.05 | *** join/#asterisk EnergyCoffee (~irc@216.105.40.250) |
| 08:05.39 | *** join/#asterisk sekil (~sekil@78.24.104.73) |
| 08:10.17 | *** join/#asterisk zerohalo (~zerohalo@74.61.196.236) |
| 08:28.33 | *** join/#asterisk hehol (~hehol@2001:1438:1009:200:6917:119:7e8f:d1f7) |
| 08:43.27 | *** join/#asterisk amizraa (~amizraa@gateway/tor-sasl/amizraa) |
| 08:48.55 | *** join/#asterisk andrewyager (~andrewyag@syd02s26-fw01.thecore.net.au) |
| 08:48.56 | *** join/#asterisk Rumbles (~Rumbles@159.253.51.222) |
| 08:49.39 | *** join/#asterisk eZz (~ez@46.164.133.77) |
| 08:50.17 | eZz | hello |
| 08:50.44 | eZz | anybody has a2billing working ? |
| 08:50.54 | *** join/#asterisk plantseeker (~Plantseek@77.240.63.97) |
| 08:52.33 | eZz | I broke my brain how to disable call-to-sip-iax-friend. Nothing works |
| 09:08.19 | *** join/#asterisk fjfalcon (~fjfalcon@fjfalcon.ru) |
| 09:10.02 | fjfalcon | Is there any "blocking" system in asterisk? Cause after friday one of our asterisk servers just stoped to respond for incoming request to other... but outgoing request to first server working fine... (IAX2 turns unreachable, SIP dont even shows any logs about missing calls). What it can be? |
| 09:15.54 | *** join/#asterisk gerhard7 (~gerhard7@77-172-47-159.ip.telfort.nl) |
| 09:17.07 | *** join/#asterisk plantseeker (~Plantseek@77.240.63.97) |
| 09:31.37 | *** join/#asterisk Thesulac (~Thesulac@82.94.204.46) |
| 09:45.13 | *** join/#asterisk ghost75 (~trechber@dslb-178-002-144-192.pools.arcor-ip.net) |
| 09:53.02 | *** join/#asterisk Greenlight (~email@cpc1-dund9-0-0-cust142.16-4.cable.virginmedia.com) |
| 17:50.53 | *** join/#asterisk infobot (~infobot@63.226.104.168) |
| 17:50.53 | *** topic/#asterisk is #asterisk The Open Source PBX and Telephony Platform (asterisk.org) -=- Asterisk 11.4.0 (2013/05/17), 10.12.2 (2013/03/27), 1.8.22.0 (2013/05/17), DAHDI-linux 2.6.2 (2013/03/08), DAHDI-tools 2.6.2 (2013/03/08), libpri 1.4.14 (2012/12/20) -=- Visit the official Asterisk wiki: wiki.asterisk.org |
| 17:52.06 | *** join/#asterisk infobot (~infobot@63.226.104.168) |
| 17:52.06 | *** topic/#asterisk is #asterisk The Open Source PBX and Telephony Platform (asterisk.org) -=- Asterisk 11.4.0 (2013/05/17), 10.12.2 (2013/03/27), 1.8.22.0 (2013/05/17), DAHDI-linux 2.6.2 (2013/03/08), DAHDI-tools 2.6.2 (2013/03/08), libpri 1.4.14 (2012/12/20) -=- Visit the official Asterisk wiki: wiki.asterisk.org |
| 17:53.10 | eagles0513875 | basically igcewieling i need something that will send out an activation code so a txt message would be sufficient |
| 17:53.12 | igcewieling | eagles0513875: in many parts of europe you can sign up for SMS service over POTS i.e ETSI ES 201 912 protocol 1 (this is the protocol Asterisk supports) |
| 17:53.34 | igcewieling | eagles0513875: sounds like you want to sign up for a standard text messaging service provider |
| 17:53.36 | *** join/#asterisk ChadAragorn (~ChadArago@63-235-131-194.dia.static.qwest.net) |
| 17:53.46 | eagles0513875 | ya i need to do more research into this |
| 17:53.50 | igcewieling | indeed. |
| 17:53.56 | jmetro | i need to become a text messaging provider, how does ? |
| 17:54.16 | eagles0513875 | i think in terms of verification to activate said pre paid card in this instance i think ill need to develop a custom app |
| 17:54.18 | eagles0513875 | anyway i must run |
| 17:58.42 | *** join/#asterisk dorphalsig (~dorphalsi@181.50.255.162) |
| 17:59.15 | dorphalsig | Hi. I'm unsure if I can ask a freepbx-related question here. Is this the right place? |
| 17:59.28 | Qwell | dorphalsig: You'd likely have better luck in #freepbx. |
| 17:59.37 | dorphalsig | looks like nobody's home over @ #freepbx |
| 18:00.04 | igcewieling | dorphalsig: most of the time we just point and laugh at people asking FreePBX questions. |
| 18:00.13 | jmetro | if its 100% freepbx we probably cant help but you could always ask |
| 18:00.37 | igcewieling | jmetro: 95% of issues with FreePBX are FreePBX related |
| 18:00.43 | tm1000 | lol |
| 18:00.46 | *** join/#asterisk nantou (~phonetic@gateway/tor-sasl/martinphone) |
| 18:01.02 | dorphalsig | The thing is. I installed everything and its running ok. I'm just trying to find out how many ppl called a specific queue in the last week |
| 18:01.15 | igcewieling | dorphalsig: sounds like something you'd find in the GUI |
| 18:01.29 | dorphalsig | But Hello, I have a working freepbx installation with a couple of queues, right now I would like to know how many calls entered each queue. I know you do that in the CDR, but I dont know if to look for lastapp queue or something that says from queue in channel |
| 18:01.30 | igcewieling | or you can access your CDRs manually and figure it out from reading them. |
| 18:02.00 | tm1000 | dorphalsig: what you are looking for doesn't exist. you'f have to code it yourself |
| 18:02.00 | dorphalsig | Yeah, I'm looking @ the cdr, however I find a lot of 'repeated' calls |
| 18:02.05 | tm1000 | thats what igcewieling is hinting at |
| 18:02.35 | dorphalsig | so my Q is2026 what should I be looking for? lastapp queue? |
| 18:02.52 | dorphalsig | channel containing from-queue? |
| 18:03.24 | tm1000 | dorphalsig: there is no logging like that |
| 18:03.24 | dorphalsig | because I'm seeing both and I'm a bit confused |
| 18:03.45 | tm1000 | and what you are seeing is cel most likely. which tracks a call through its various steps |
| 18:03.54 | tm1000 | you'd have to figure out how to dechipher what you are looking for |
| 18:04.05 | jmetro | queue show [queue] will show you processed i beleieve |
| 18:04.14 | jmetro | but to have it every week, either clear it out or keep track |
| 18:04.47 | *** join/#asterisk davlefou (~davlefou@unaffiliated/davlefou) |
| 18:04.58 | dorphalsig | I'm seeing this in some channel fields: Local/3131@from-queue-00000b5d;2 |
| 18:05.18 | igcewieling | dorphalsig: Local/ channels should be ignored |
| 18:05.41 | igcewieling | dorphalsig: if you were not using FreePBX you would not be seeing those Local channels |
| 18:06.12 | jmetro | i use local channels <.< |
| 18:06.18 | igcewieling | dorphalsig: when you see lastapp queue, you can be pretty sure the call was placed into the queue |
| 18:06.41 | igcewieling | jmetro: there are lots of useful things to do with Local/ channels. Reading CDRs is not one of them |
| 18:06.43 | dorphalsig | and from disposition I can see if it was answered or not, right? |
| 18:07.05 | igcewieling | dorphalsig: you'll have to figure that out on your own. |
| 18:07.14 | igcewieling | For the most part only crazy people use Asterisk queues. |
| 18:07.21 | jmetro | <- |
| 18:07.23 | jmetro | <------ |
| 18:07.29 | igcewieling | jmetro: exactly! |
| 18:07.36 | jmetro | and i am over 9000% more crazy for it |
| 18:07.42 | igcewieling | thankfully you are more the good kind of crazy |
| 18:07.56 | dorphalsig | Whats wrong with * queues? |
| 18:08.06 | igcewieling | more Dr. Who than Jeffry Dalmer. |
| 18:08.36 | jmetro | Setting up an * queue is...dramatic |
| 18:09.02 | *** join/#asterisk russum (~russum@pool-96-232-165-40.nycmny.fios.verizon.net) |
| 18:09.06 | jmetro | suddenly you will have announcements played every 5 seconds randomly at the beginning or middle of the queue. |
| 18:09.20 | Cuzner | that's a feature |
| 18:09.36 | igcewieling | Asterisk queues are overly complicated and under featured. |
| 18:09.40 | jmetro | and when a client is hearing an announcement its possible for them to be skipped in the queue. |
| 18:09.51 | jmetro | since the call is "answered" and then a sound file played to them |
| 18:09.55 | igcewieling | jmetro: don't you love that bug! |
| 18:10.09 | jmetro | it makes PERFECT programattical sense. Absolutely. |
| 18:10.19 | jmetro | Unfortunately thats not how CALLS WORK |
| 18:10.43 | igcewieling | jmetro: It totally violates the principle of least astonishment |
| 18:11.07 | jmetro | Oh, also, they decided to drop the queue strategy i needed for the F8sk of it. |
| 18:11.31 | dorphalsig | What queues work then? |
| 18:12.28 | igcewieling | dorphalsig: there is only one queueing system in Asterisk, you live with it and work around the issues if you REALLY need queues. |
| 18:12.34 | jmetro | * queues work if you need something very simple |
| 18:13.19 | jmetro | and even then, hope you dont get screwed with cooldown time or inuse bugs |
| 18:13.49 | Cuzner | jmetro: I had a trixbox running a small call center queue for ~4yrs... |
| 18:14.05 | jmetro | trixbox o.o |
| 18:14.07 | Cuzner | so yes, if it's simple, it works... |
| 18:14.47 | Cuzner | yea, with a sangoma tdm card in it, low volume small tech support call center, it worked well for what it was used for. |
| 18:15.52 | *** join/#asterisk timahvo1 (~rogue@41.212.120.45) |
| 18:15.59 | Cuzner | trixbox may be a dirty word in here, but it served its purpose, surprisingly well. |
| 18:16.26 | eirirs | lo |
| 18:16.27 | eirirs | l |
| 18:19.57 | Cuzner | shrugs |
| 18:21.08 | leifmadsen | using freepbx based systems or what not is fine until you want it to do something it can't do |
| 18:21.25 | leifmadsen | if it does what you need, then I don't see the point in building a complicated bit of machinery that is already sitting right there |
| 18:22.59 | igcewieling | leifmadsen: We use FreePBX extensively for customer deployments What we don't do is ask FreePBX questions on #asterisk. |
| 18:23.10 | leifmadsen | sure, that's fine |
| 18:23.30 | tm1000 | igcewieling: its a fine line sometimes |
| 18:24.06 | igcewieling | tm1000: sometimes, but usually if you are using FreePBX your question is FreePBX related. |
| 18:25.04 | *** join/#asterisk loompek (~noname@unaffiliated/loompek) |
| 18:25.16 | Cuzner | the point is to use the best tool for the job. |
| 18:25.45 | jmetro | i am using freepbx but am trying to paint my house, how many feet of fruit rollups do i need? |
| 18:26.09 | leifmadsen | all of them |
| 18:26.26 | Cuzner | hasn't had a fruit rollup in a long time |
| 18:26.41 | jmetro | Cuzner: youre welcome for reminding you :3 |
| 18:26.44 | Cuzner | now i'm craving one |
| 18:27.16 | jmetro | that and Gushers. |
| 18:32.55 | *** join/#asterisk tilt_ (~tilt@173-13-180-97-sfba.hfc.comcastbusiness.net) |
| 18:33.53 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 18:39.08 | *** join/#asterisk Defraz (~Defraz@mail.pocatellochildren.com) |
| 18:45.33 | *** part/#asterisk EnergyCoffee (~irc@216.105.40.250) |
| 18:56.48 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 19:00.36 | *** join/#asterisk gavimobile (~user@bzq-218-196-30.red.bezeqint.net) |
| 19:01.14 | gavimobile | why the hell would the folks in #postfix tell me that port 25 should not be used |
| 19:01.18 | gavimobile | my god |
| 19:05.03 | *** join/#asterisk tzafrir (~tzafrir@bzq-218-28-58.cablep.bezeqint.net) |
| 19:05.40 | *** join/#asterisk killown (~killown@pdpc/supporter/student/killown) |
| 19:10.45 | Cuzner | r/nocontext |
| 19:13.01 | jmetro | 25 is too common? |
| 19:14.51 | sp00kz | probably more along the lines of, the submission port is there for a reason |
| 19:19.17 | ChannelZ | yeah.. for working around ISP port blocking |
| 19:19.36 | sp00kz | among other things |
| 19:19.52 | ChannelZ | like? |
| 19:20.22 | sp00kz | an example is having specific antispam/virus rules applying to mail being sent by your users vs mail being recieved |
| 19:21.07 | loompek | so, here's the deal... |
| 19:22.25 | loompek | even though i'm now using asterisk 11.4.0 and logging security events to a log file, and using fail2ban with the following filter: .* SecurityEvent="InvalidPassword",.*RemoteAddress="IPV(4|6)\/(UDP|TCP|TLS)\/<HOST>\/.* |
| 19:22.43 | loompek | .. to ban hosts that are trying to authenticate |
| 19:23.26 | loompek | i can't seem to 'fetch' SIP OPTION requests which are sent by random sipvicious scanners |
| 19:24.18 | ChannelZ | As an aside, ou might use Invalid(Password|AccountID) |
| 19:25.03 | ChannelZ | And I guess OPTIONs don't generate security events |
| 19:25.39 | gavimobile | loompek: are you having an issue where your logs don't show the ip of the person trying to register? |
| 19:25.52 | gavimobile | instead it just shows the ip of your server instead |
| 19:26.19 | ChannelZ | https://wiki.asterisk.org/wiki/display/AST/Security+Events+to+Log |
| 19:26.34 | ChannelZ | gavimobile: the old notices used to be unclear in that fashion |
| 19:26.47 | loompek | gavimobile no.. in case the user tries to use SIP REGISTER with invalid password, the attempt gets logged (and ip gets baned using fail2ban afterwards) |
| 19:26.53 | ChannelZ | The newer security events are proper |
| 19:27.58 | gavimobile | I see |
| 19:29.21 | loompek | even though it would break protocols... i'd like asterisk to ignore and not answer invalid/unauthenticated SIP requests like REGISTER and OPTIONS... |
| 19:29.59 | gavimobile | for me the security events from 11 were the same as 1.8. ast_log(LOG_NOTICE, "Failed to authenticate device %s\n", sip_get_header(req, "From")); from chan_sip.c would not output the attackers ip address |
| 19:30.11 | gavimobile | so I added ast_log(LOG_NOTICE, "hacking attempt detected '%s'\n", ast_sockaddr_stringify_addr(addr)); under it |
| 19:30.26 | gavimobile | and fail2ban catches them like flies in fire |
| 19:30.33 | loompek | gavimobile ya... i upgraded to 11.4 from 1.8 and it seems to have worked |
| 19:30.56 | ChannelZ | The security events for those changed somewhere in the middle of 10.x IIRC |
| 19:31.14 | gavimobile | ChannelZ: im also on 11.4 and it wouldn't show me their ip address |
| 19:31.27 | ChannelZ | This is a new logger category, BTW.. security |
| 19:32.00 | gavimobile | I don't know if what I did was necessary, but it most definetly finds them and responds via fail2ban/iptables |
| 19:32.03 | loompek | ChannelZ ya... already on it... security => security :) |
| 19:32.20 | ChannelZ | gavimobile: what loompek said ^^ |
| 19:32.31 | loompek | in logger.conf that is |
| 19:32.48 | gavimobile | => == equalto or greater than? |
| 19:33.02 | gavimobile | did I understand you correctly? |
| 19:33.07 | ChannelZ | gavimobile: under older versions yes what you did was necessary - I had a similar patch of my own |
| 19:33.25 | gavimobile | ChannelZ: why not to 11.4 |
| 19:33.39 | gavimobile | 11.4 would not output their ip address |
| 19:33.44 | ChannelZ | Because they were moved into security events. |
| 19:34.07 | ChannelZ | Again, you need to make a new logger.conf entry for security |
| 19:34.25 | ChannelZ | or you can keep patching your source every time you update and do it the way you're doing it |
| 19:34.29 | gavimobile | ChannelZ: ahh now I understand you |
| 19:34.54 | gavimobile | I needed to edit logger.conf and change a few things to make it work properly or output properly for 11.4 compatibility |
| 19:35.20 | gavimobile | ChannelZ: thanks for being clear. ill read the documentation once I finish with this silly postfix server |
| 19:35.38 | gavimobile | no port 25... they must be crazy |
| 19:35.49 | ChannelZ | Well, chances are you want both |
| 19:35.54 | *** join/#asterisk c|oneman (cloneman@2605:6400:2:fed5:22:0:3b06:3913) |
| 19:35.57 | loompek | gavimobile postfix isn't silly |
| 19:36.16 | ChannelZ | unless your mail server isn't an on-network SMTP server (IE not an MX for any domain, just used for sending mail OUT) |
| 19:36.18 | *** join/#asterisk amizraa (~amizraa@gateway/tor-sasl/amizraa) |
| 19:36.22 | loompek | we use it for about 100k accounts on quite a few servers... |
| 19:36.36 | Cuzner | some tasks with postfix are silly |
| 19:36.59 | gavimobile | I am using it for a mx |
| 19:37.01 | loompek | such as? |
| 19:37.40 | gavimobile | loompek: maybe if you feel like it, you might give me a few pointers for my main.cf file |
| 19:37.41 | Cuzner | deleting specific messages out of the mail queue |
| 19:37.49 | Cuzner | here's the script i use |
| 19:37.51 | Cuzner | mailq | awk 'BEGIN { RS = "" } / cuzner@domain\.com$/ { print $1 }' | tr -d '*!' | postsuper -d - |
| 19:38.05 | Cuzner | you're welcome to steal it |
| 19:38.58 | gavimobile | main.cf |
| 19:39.06 | Cuzner | shudders |
| 19:39.11 | gavimobile | lol |
| 19:39.14 | Cuzner | i'm never going to argue than I like sendmail more. |
| 19:39.21 | Cuzner | m4 is evil |
| 19:39.33 | gavimobile | wow, reading the sendmail docs gave me a headach |
| 19:39.45 | ChannelZ | running it gives you brain tumors |
| 19:39.55 | gavimobile | ChannelZ: hahaha |
| 19:40.40 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.125.171) |
| 19:47.08 | *** join/#asterisk c|oneman (cloneman@2605:6400:2:fed5:22:0:3b06:3913) |
| 19:51.33 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.125.171) |
| 19:56.42 | loompek | Cuzner i'm using for i in sender1@domain1.com sender2@domain2.com; do mailq | grep " ${i}$" | awk '{print $1}' | sed -e 's/*//' | postsuper -d -; done |
| 19:57.04 | loompek | even thoug... |
| 19:57.20 | loompek | for i in sender1@domain1.com sender2@domain2.com; do mailq | grep " ${i}$" | awk '{print $1}' | sed -e 's/*$//' | postsuper -d -; done |
| 19:57.30 | loompek | this would be safer |
| 19:59.31 | *** join/#asterisk imox (~imox@24.134.17.195) |
| 20:01.30 | Cuzner | That works, mine was just quick an' dirty. |
| 20:01.40 | loompek | mine is quicker ;) |
| 20:01.57 | loompek | nevertheless... |
| 20:02.04 | Cuzner | um, we'll agree to disagree on that one |
| 20:02.11 | igcewieling | Cuzner: m4 isn't THAT evil. It is the application which uses it. |
| 20:02.49 | ChannelZ | I like M4s |
| 20:03.50 | loompek | so... any comments about my suggestion/request ... about asterisk of ignoring and not responding to invalid registers or unregistered options... |
| 20:04.18 | igcewieling | We use m4 with a custom patch to /etc/rc.d/init.d/iptables so we can split out site specific rules and global rules into different files. |
| 20:04.20 | ChannelZ | get hacking the source |
| 20:08.27 | *** join/#asterisk kresp0 (~kresp0@97.Red-83-50-235.dynamicIP.rima-tde.net) |
| 20:09.45 | *** join/#asterisk kresp0 (~kresp0@97.Red-83-50-235.dynamicIP.rima-tde.net) |
| 20:11.55 | *** join/#asterisk Praise- (~Fat@unaffiliated/praise) |
| 20:14.42 | *** join/#asterisk pontis (~pontis@83.137.2.145) |
| 20:14.45 | mjordan | gavimobile: security events != log messages. |
| 20:15.49 | gavimobile | mjordan: a bit late of a response but yea I got that |
| 20:15.56 | gavimobile | thanks mr jordan |
| 20:16.17 | gavimobile | is considering changing his nick to ljames |
| 20:16.52 | mjordan | gavimobile: sorry, was catching up on traffic :-) |
| 20:16.55 | igcewieling | Amazing how fast customers call back the billing department when their internet is shut off. |
| 20:18.11 | gavimobile | mjordan: that's alright! no need to appoligize :-) |
| 20:18.51 | mjordan | loompek: I'm not sure if you'd want to ignore inbound requests (depending on what you mean by "ignore"). You could raise security events however in handle_incoming for those requests that failed |
| 20:19.55 | mjordan | loompek: currently security events map tightly to authentication failures, but it could be expanded to include other items. |
| 20:21.50 | loompek | mjordan i wouldn't like expose the pbx system for all the bots out there... instead of responding to various sip OPTIONS which are generated by sipvicious, let's say... i'd like asterisk to ignore it.. in case i have let's say... 10 sip users and an option is received from an unauthorised ip... i wouldn't like asterisk to respond to it |
| 20:23.08 | mjordan | you need to respond with something. |
| 20:23.10 | jmetro | theyll get a call failed if you have contexts setup right |
| 20:23.59 | mjordan | in fact, failure to respond can actually create a situation in where an attacker - if they know you are at that address - can theoretically enumerate a valid endpoint. If they happen to hit upon an endpoint that is registered but they don't provide authentication, you have to challenge - and now they know a valid endpoint to hammer. |
| 20:26.14 | igcewieling | loompek: do you understand how SIP auth works? The password is not even sent by the client until the server responds to the first packet |
| 20:27.21 | loompek | igcewieling ya... client sends register, server responds with a challenge, client responds |
| 20:27.31 | mjordan | I can see value in sending authentication failure security events on OPTIONS requests (assuming you are authenticating OPTIONS requests, which is a setting). You could tie in an external service that monitors those events and, if it detects a lot of failed requests from an IP address, fail2bans it and/or creates an ACL in Asterisk and updates the configuration. |
| 20:27.45 | mjordan | loompek: it does that for any request that authenticates. |
| 20:27.50 | loompek | kinda figured that out while typing it |
| 20:28.56 | igcewieling | loompek: your best bet is to put a SIP proxy in front of Asterisk. SIP proxies allow low level control of SIP packets. Asterisk does not. |
| 20:29.31 | loompek | i dont know about that *everthing* is authenticated part... http://rula.net/652 |
| 20:30.21 | loompek | as you can see, a sipvicious sent OPTIONS and my system responded... even though i have no information about any clients from that ip |
| 20:32.26 | mjordan | loompek: auth_options_requests=yes |
| 20:34.19 | *** join/#asterisk c|oneman (cloneman@2605:6400:2:fed5:22:0:3b06:3913) |
| 20:37.09 | loompek | mjordan let's see now... |
| 20:40.16 | *** join/#asterisk brad_mssw (~brad@shop.monetra.com) |
| 20:53.11 | *** join/#asterisk bipul (~bipul@unaffiliated/bipul) |
| 21:11.35 | *** join/#asterisk italorossi (~italoross@187.61.168.117) |
| 21:15.10 | *** join/#asterisk BrokenArrow (~BrokenArr@unaffiliated/brokenarrow) |
| 21:18.48 | *** join/#asterisk FonJockey (~FonJockey@23.31.156.133) |
| 21:23.36 | *** join/#asterisk RypPn (~RypPn@unaffiliated/ryppn) |
| 21:51.06 | *** join/#asterisk russum (~russum@pool-96-232-165-40.nycmny.fios.verizon.net) |
| 22:01.04 | *** part/#asterisk russum (~russum@pool-96-232-165-40.nycmny.fios.verizon.net) |
| 22:03.04 | *** join/#asterisk talntid (~talntid@173-160-189-58-Washington.hfc.comcastbusiness.net) |
| 22:03.23 | talntid | after editing queues.conf, and doing a "queue reload members", i still show the old member. ideas? |
| 22:03.37 | talntid | 60ish current calls - so restarting all of * not possible |
| 22:05.04 | talntid | ashleys/ashleys 10.21.6.51 D N 5060 OK (15 ms) |
| 22:10.34 | *** join/#asterisk apb1963_ (~apb1963@174.134.117.244) |
| 22:16.37 | *** join/#asterisk navaismo (~navaismo@189.241.95.6) |
| 22:20.45 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 22:21.00 | *** join/#asterisk TimeRider (~steve@timerider.plus.com) |
| 22:23.14 | *** join/#asterisk nix8n82 (~AndChat27@24.143.11.81) |
| 22:25.44 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.126.19) |
| 22:39.56 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 22:52.00 | *** join/#asterisk threesome (~threesome@ip-94-113-12-233.net.upcbroadband.cz) |
| 23:10.44 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 23:23.33 | *** join/#asterisk DaPrivateer (~matt7229@71-9-155-174.static.oxfr.ma.charter.com) |
| 23:26.12 | *** join/#asterisk vlad_starkov (~vlad_star@109.188.124.164) |
| 23:27.54 | *** join/#asterisk italorossi (~italoross@187.61.168.117) |
| 23:31.54 | *** join/#asterisk italorossi (~italoross@187.60.66.11) |
| 23:33.14 | *** join/#asterisk slav3_kitten (~frankthet@unaffiliated/slav3-kitten/x-0866809) |
| 23:38.23 | *** join/#asterisk Draecos (~Draecos@203-59-205-139.dyn.iinet.net.au) |
| 23:42.22 | *** join/#asterisk DEMNVT (~Adium@rmsaus7.lnk.telstra.net) |
| 23:44.56 | *** join/#asterisk FonJockey (~FonJockey@c-24-30-113-162.hsd1.ca.comcast.net) |