SOLVED Action Required: Change ARI username / password

[Joe Diamond CPA]

Your system is using default ARI username so recommend you to please change ARI username and password at the earliest (If ARI is not visible, Please enable 'Display Readonly Settings' And 'Override Readonly Settings.

Ward, I thought this was only an issue with FreePBX, not Incredible PBX? how do i fix it please?

 

[KNERD]

It shows somewhat how to in the notice:

Your system is using default ARI username so recommend you to please change ARI username and password at the earliest (If ARI is not visible, Please enable 'Display Readonly Settings' And 'Override Readonly Settings

Those two are located in Advanced Settings and will be located in the very first three.
Enable those and the menu will appear to change them.

 

[Joe Diamond CPA]

hi ward, aleays great to correspond with you, hope you are well, so i went into advanced settings and those two settings are alreadty set to YES, I guess I need to know how to actually change the username/password, thankj you.

 

[KNERD]

hi ward, aleays great to correspond with you, hope you are well, so i went into advanced settings and those two settings are alreadty set to YES, I guess I need to know how to actually change the username/password, thankj you.

If you press CTRL + F in your browser then start typing in "ARI" in the search window while in Advanced Settings, you will find the menu part to change the ARI Username and ARI Password.

 

[wardmundy]

https://www.voip-info.org/forum/threads/freepbx-ari-exploit.26964/page-2#post-170403

 

[Joe Diamond CPA]

LOL i really am a NOOB! and you ward are a genius! thank you as always..we call the best of the best in the air force "steely eyed missile men! and you are one! thank you, it is now fixed. PS, i did originally follow those instructions and commands but I was unsuccessful, i had no idea that you could just do it in advanced settings, LOL, thank you AGAIN and take care!

 

[ostridge]

LOL i really am a NOOB! and you ward are a genius! thank you as always..we call the best of the best in the air force "steely eyed missile men! and you are one! thank you, it is now fixed. PS, i did originally follow those instructions and commands but I was unsuccessful, i had no idea that you could just do it in advanced settings, LOL, thank you AGAIN and take care!

You were correct Joe it is only an issue in FreePBX unless your pbx is public facing (Gone Public). If your pbx is hiding behind a nat firewall there isn't really (tongue in cheek) any or much danger? But to make the FreePBX warning go away use the code to randomise the username and password - so any theoretical exploit is 'secretly' protected.

The 'RANDOM' code may not work in later versions of bash but the linked code does.
ARI user and password randomised in Hex works with all bash versions.