SUGGESTIONS Lets Encrypt?

[pbxhq]

I was installing Incredible PBX 2021 on Debian 10 in the cloud following the instructions here: http://nerdvittles.com/?p=34086

It was an impressive installation process, very thorough.

For everything it included in terms of security, I was shocked that no form of SSL is included, especially considering how many are likely not installing this locally. I think it would be quite trivial to add a parameter to ask for hostname, and to automate installation of certbot, cert issuance, etc.

Is this included and I just missed it? Or a huge oversight from Incredible PBX?

 

[pbxhq]

Maybe the fact that nerd vittles website itself doesn't even enforce SSL is telling...

 

[pbxhq]

Or is the web interface just not supposed to be open to the public? Somewhat creates a problem for those without a static IP if that is the case

 

[jerrm]

I think it would be quite trivial to add a parameter to ask for hostname, and to automate installation of certbot, cert issuance, etc.

No need for certbot unless you want dns-01 auth(for now). The Certificate Manager module should now be pretty much 100% scriptable.

Maybe the fact that nerd vittles website itself doesn't even enforce SSL is telling...

What content on nerdvittles has need for encryption? Why waste the cycles? Anyone worried about nerdvittles traffic needs a new foil hat or can manually specify https.

Or is the web interface just not supposed to be open to the public? Somewhat creates a problem for those without a static IP if that is the case

As designed it will be closed to the open net by default. Still no ssl means possibility of sniffing the admin password if someone can get in the middle.

How does dynamic vs static IP make any difference?

 

[pbxhq]

No need for certbot unless you want dns-01 auth(for now). The Certificate Manager module should now be pretty much 100% scriptable.

I secured mine with dns-01 auth, but others may not be able to do it as easily.

What content on nerdvittles has need for encryption? Why waste the cycles? Anyone worried about nerdvittles traffic needs a new foil hat or can manually specify https.

Google heavily frowns upon any website that is not SSL secured. If the site has any intention whatsoever of having decent SEO rankings, then forced SSL should be a priority. It doesn't cost anything and there is no reason to not enforce SSL on every single public website. I am not saying his site doesn't rank well in Google, I didn't check, but however it is ranking now, it would be better if SSL secured. Not to mention duplicate content issues with having a non-ssl and SSL version of the same page (unless canonical URL tags are in use, again didn't check)

How does dynamic vs static IP make any difference?

Instructions show how to deploy in the cloud. By default, your current IP is whitelisted so you can access the web portal. Without a static IP, guess what happens next time you try to access it and your IP is no longer the same? Do I need to explain further?

 

[kenn10]

With TM3 on IncrediblePBX and a DDNS updater utility on the appropriate end user device, you can have a dynamic IP address behind a FQDN that a cron job updates based on the schedule you set. It whitelists the current IP to the system. I use it with my cell phone and laptop all the time.

Of course if you choose to "Go Public" on IncrediblePBX, ports 80 and 8080 are locked to the installing IP but you can set up a VPN for additional remote access.

 

[pbxhq]

I didn't say there weren't workarounds, I was more so just wondering why something that is being presented as cloud capable would not have this built in.

 

[jerrm]

I secured mine with dns-01 auth, but others may not be able to do it as easily.

I'm pro dns-01 auth, but I don't see how it can easily be generically scripted. Too many moving parts, differing providers, apis, and authentication methods. A lot more than just prompt for fqdn would be needed.. http-01 is pretty easy in comparison. Think it's part of the reason Sangoma never went farther with dns-01 inside of FreePBX.

Google heavily frowns upon any website that is not SSL secured.

https does work, not sure how that calculates into the score. It still ranks high on queries I would expect it to hit on. Looking at results, there's an odd mix of http and https links. You would think google would choose one over the other. Maybe it's just whichever spider found the page first.

Without a static IP, guess what happens next time you try to access it and your IP is no longer the same?

OK, but a tangent to the ssl points. Couldn't see how it made a difference to the topic being discussed.

 

[pbxhq]

I'm pro dns-01 auth, but I don't see how it can easily be generically scripted. Too many moving parts, differing providers, apis, and authentication methods. A lot more than just prompt for fqdn would be needed.. http-01 is pretty easy in comparison. Think it's part of the reason Sangoma never went farther with dns-01 inside of FreePBX.

I didn't inspect the Apache config, but if you have a hostname pointing to your cloud instance, HTTP auth shouldn't be an issue. I know after the install process it would not work, perhaps due to firewall, or something else going on with Apache config, or something else altogether. I just needed a quick asterisk with GUI so I could test something, didn't really care to dig in to see why it wasn't working.

If the installer simply asked if you have a publicly accessible hostname at the beginning, it would be very easy to do HTTP auth on a fresh virtual host. Renewals could be an issue depending on what gets changed during the install process--it would likely require some tweaks.

https does work, not sure how that calculates into the score. It still ranks high on queries I would expect it to hit on. Looking at results, there's an odd mix of http and https links. You would think google would choose one over the other. Maybe it's just whichever spider found the page first.

I didn't say HTTPS doens't work. Having a non-secure website is a big factor in SEO score, some research will show you that. The fact that both secure and non-secure results show up in google says he is not using canonical tags to indicate the primary URL for a page that is accessible via two different URLs. Simply re-directing non-ssl to SSL pages with htaccess or other method would immensely help SEO for the site. Google hates duplicate content, and they hate non-secure webpages. Don't take my word for it, check for yourself

 

[jerrm]

If the installer simply asked if you have a publicly accessible hostname at the beginning

Agree in principle, but in practice, probably nearly useless. I'd bet the number of folks who setup dns before they start the install (or would pause to setup and come back) is virtually nil.

Still, agree it should be part of the standard install, but would save it for the end with a stern warning to come back after setting up dns if skipped. User could complete in the GUI or a simple script could generate the certs using fwconsole.

The fact that both secure and non-secure results show up in google says he is not using canonical tags to indicate the primary URL

Took a look. Looks like whatever wordpress plugin in use does generate a canonical tag, but plugs in http/https based on the current request. Probably the worst case scenario.

 

[pbxhq]

Probably the worst case scenario.

Accurate

 

[krzykat]

I'm sure there are install instructions for LE SSL on the site. If you need help with it, let me know and I'll dig up my install instructions.

 

[Halea]

One easy way to enable SSL on your IncrediblePBX is to install stunnel on it and create a tunnel connecting https to http locally. For the SSL certificates you use webmin's built in Letsencrypt management tool and you use the same certificate, including the location for stunnel. This way both your webmin and PBX Gui get https with a valid, automatically renewing certificate.

 

[pbxhq]

I had SSL up and running on mine in a few minutes by using lets encrypt with dns auth. I refuse to enter a password over a non-secure connection, so this is the first thing I did. I'll probably tear down that VM instance now anyways, I got my test done that I needed.

Seeing the "FreePBX" interface brought back some memories though, was a short, but fun journey.

As for other methods of securely connecting in as others have suggested--those are great options for long term users. I just needed to run a couple quick tests to see if a clients issues were his config or a problem on my side, which only took a few minutes to complete. The most time consuming part of the process was waiting on the install script, and I was using a fairly beefy VM.

Agree in principle, but in practice, probably nearly useless. I'd bet the number of folks who setup dns before they start the install (or would pause to setup and come back) is virtually nil.

I can't think of anything better to do while waiting for a VM instance to spin up. I always setup a hostname of some sort to point to any cloud vm/instance. Maybe I'm the exception to the rule. Takes 2 seconds to point some subdomain at an IP address.

 

[jerrm]

The most time consuming part of the process was waiting on the install script, and I was using a fairly beefy VM.

I need to spin up and test the Debian install. I haven't actually used IPBX in a long time. I moved to Debian and my own install scripts years ago. I keep a test IPBX instance up, but it's last re-install was the CentOS "2020" version.

I can't think of anything better to do while waiting for a VM instance to spin up.

But we aren't really the target market. Those that already have the knowledge and infrastructure in place probably don't need the prompting. I just do everything over an ssh tunnel until things are settled down - especially on a test system..

I think the value of IPBX is giving folks enough hand holding to get past the "can I do it" fears and to a working system ASAP. Ward has to walk the line of keeping it KISS and having a complete system. There are plenty of things I would do differently, but I can usually understand why it's done a particular way, even if I may not agree.

Still, at this point at least a strong push toward encryption is warranted, and it's all scriptable in current FreePBX versions.

 

[pbxhq]

Agreed on just about everything you said.

Although, after not having looked at a FreePBX web interface for many many years, the number of menu items and options were extreme. KISS is SmartPBX that I offer in my solution. FreePBX is exponentially more complicated and confusing than a modern designed app, one which was designed to be able to be managed by someone who isn't in the industry.

And it's not even that FreePBX does more, it just has all the options scattered across what seemed like 40+ different configuration pages.

Everyone is entitled to their opinion, but looking at it again now after being exposed to many other solutions, I feel FreePBX is for a very specific niche. A knowledgable one, that for one reason or another, needs to have their own PBX. If its going to be run in the cloud, it almost certainly makes more sense for a business to go with a redundant system as opposed to a self-hosted, self-maintained option. I can see certain use cases for the on-prem PBX, but even that is going the way of the dinosaur.

Not trying to start a fight, just giving my opinion after having about a 5 year break from seeing what FreePBX looks like and revisiting it.

 

[jerrm]

Not trying to start a fight, just giving my opinion

No problem. Very possible it wouldn't be my choice today.

Seven or so years ago when I was evaluating there were a handful of features FreePBX did that other contenders either didn't do at all or didn't do as well for my needs, not that some weren't much better in other areas. Honestly don't think I looked at Kazoo.

Now with years of accumulated knowledge, scripts, and custom modules the bar to consider a change is pretty high, but the phone stuff is more value-add than a core business in our situation.

 

[krzykat]

Agreed on just about everything you said.

Although, after not having looked at a FreePBX web interface for many many years, the number of menu items and options were extreme. KISS is SmartPBX that I offer in my solution. FreePBX is exponentially more complicated and confusing than a modern designed app, one which was designed to be able to be managed by someone who isn't in the industry.

And it's not even that FreePBX does more, it just has all the options scattered across what seemed like 40+ different configuration pages.

Not trying to start a fight, just giving my opinion after having about a 5 year break from seeing what FreePBX looks like and revisiting it.

What did you use, or do you know of any knowledgebase areas to learn about how to convert from FreePBX to Kazoo? It would sure be nice to have something such as:

Item in FPBX: -> How to do in Kazoo:
Inbound Route -> SmartPBX->Numbers
Ring Group -> SmartPBX->Groups
Trunks -> Carriers

Or whatever they are. I realize its a new way of thinking of things with the different apps and how they interact with each other and such. I imagine after you get as involved with it as you have, its much easier, but for a person that is coming from FPBX its a pretty steep learning curve.

Do you have any reference materials you'd recommend to learn to accomplish the same tasks with Kazoo as one can do in FPBX ? Seems like a good departure point.

 

[billsimon]

KISS is SmartPBX that I offer in my solution. FreePBX is exponentially more complicated and confusing than a modern designed app, one which was designed to be able to be managed by someone who isn't in the industry.

What alternative would you recommend for the person who wants to run their own server and not subscribe to your or another cloud service? Some of us have gotten really familiar with FreePBX and as a result, look at it and say "that's not complicated at all." But of course, it's because of the familiarity.

 

[pbxhq]

Maybe my comment was taken out of context. FreePBX is great for what it is, as Kazoo is great for what it is. I don't suggest anyone to switch to Kazoo if FreePBX does what they need. Kazoo is a carrier grade multi-tenant switching platform with a lot of extra features on top.

If you are a single tenant (one account, one set of users), Kazoo is almost certainly over-complicated for your use case. Can you gain some redundancy by switching to it? Yes, but a fully redundant setup is leagues more complicated than a single server setup.

I originally started using Kazoo as an alternative to a farm of VMs running FreePBX. If you are running numerous FreePBX, then I advise exploring something easier to maintain and scale.

Edit: Something else to keep in mind, is that everything about Kazoo was designed so that it can be redundant, scale horizontally, and handle massive amounts of volume. I can't think of any examples off the top of my head, but I remember when I first started using Kazoo, that some things that were simple in FreePBX were either very difficult or impossible in Kazoo.