astlinux-users — AstLinux Users Mailing List

Re: [Astlinux-users] Syslogd to remote

[Ionel C. <ion...@me...>]

Thanks Lonnie and that is where I am going crazy LOL.  In my rc.conf I have nothing defined for SYSLOGHOST=Not sure if I plugged that value somewhere else? Or I have a startup script  I know is running and sending logs to my .77 :)On Sep 20, 2023, at 11:43 AM, Lonnie Abelbeck <li...@lo...> wrote:On Sep 20, 2023, at 10:37 AM, Ionel Chila via Astlinux-users <ast...@li...> wrote:For the love of my life I can't find the settings from my syslog that is currently sending logs to an external server. Can't find the config file nor anyweher in the web gui menu? Am I going crazy here?I know I am sending stuff out :)HOME-PBX init.d # ps -ef |grep syslog 310 root     syslogd -s 1024 -b 2 935 root     syslogd -R 192.168.0.77:514 -L -O /var/log/messagesHi Ionel,You have the SYSLOGHOST variable defined (ie. SYSLOGHOST="192.168.0.77:514")For documentation reference look in /stat/etc/rc.conf [1]Lonnie[1] https://github.com/astlinux-project/astlinux/blob/0c813dffa5d59ffa34d39624eb6a63ae7662a535/project/astlinux/target_skeleton/stat/etc/rc.conf#L476_______________________________________________Astlinux-users mailing lis...@li...https://lists.sourceforge.net/lists/listinfo/astlinux-usersDonations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Syslogd to remote

[Lonnie A. <li...@lo...>]

> On Sep 20, 2023, at 10:37 AM, Ionel Chila via Astlinux-users <ast...@li...> wrote:
> 
> For the love of my life I can't find the settings from my syslog that is currently sending logs to an external server. Can't find the config file nor anyweher in the web gui menu? Am I going crazy here?
> I know I am sending stuff out :)
> 
> HOME-PBX init.d # ps -ef |grep syslog
>   310 root     syslogd -s 1024 -b 2
>   935 root     syslogd -R 192.168.0.77:514 -L -O /var/log/messages
> 

Hi Ionel,

You have the SYSLOGHOST variable defined (ie. SYSLOGHOST="192.168.0.77:514")

For documentation reference look in /stat/etc/rc.conf [1]

Lonnie

[1] https://github.com/astlinux-project/astlinux/blob/0c813dffa5d59ffa34d39624eb6a63ae7662a535/project/astlinux/target_skeleton/stat/etc/rc.conf#L476

[Astlinux-users] Syslogd to remote

[Ionel C. <ion...@me...>]

For the love of my life I can't find the settings from my syslog that is currently sending logs to an external server. Can't find the config file nor anyweher in the web gui menu? Am I going crazy here?I know I am sending stuff out :)HOME-PBX init.d # ps -ef |grep syslog  310 root     syslogd -s 1024 -b 2  935 root     syslogd -R 192.168.0.77:514 -L -O /var/log/messages

[Astlinux-users] AstLinux Pre-Release: astlinux-1.5-5875-b12fc0

[Lonnie A. <li...@lo...>]

Announcing AstLinux Pre-Release: astlinux-1.5-5875-b12fc0

AstLinux Project -> Development
https://www.astlinux-project.org/dev.html

** IMPORTANT NOTICE

-- Changes to supported firmware builds:
	== Previous 'ast13se' and 'ast16' firmware branches are no longer updated.
	== New 'ast16se' firmware branch, Asterisk 16.x built --without-pjproject and --without-dahdi
	== Previous 'ast18' firmware branch, Asterisk 18.x built --with-pjproject and --with-dahdi
	== New 'ast20' firmware branch, Asterisk 20.x built --with-pjproject and --with-dahdi

** The AstLinux Team is regularly upgrading packages containing security and bug fixes as well as adding new features of our own.

-- Linux Kernel 5.10.191 (version bump), security and bug fixes

-- OpenSSL, version bump to 1.1.1v, security fixes: CVE-2023-3446, CVE-2023-3817

-- chrony, version bump to 4.4

-- libcurl (curl) version bump to 8.2.1, security fixes: CVE-2023-32001

-- libxml2, version bump to 2.11.5

-- msmtp, version bump to 1.8.24

-- netsnmp, version bump to 5.9.4

-- screen, version 4.9.1, security fix: CVE-2023-24626

-- tinyproxy, version 1.11.1, now included in the standard builds, but disabled by default

-- unixodbc, version bump to 2.3.12

-- upgrade-run-image, limit "noram" loop mount from being removed during upgrade.

-- vnStat, version bump to 2.11

-- zlib, version bump to 1.3

-- Asterisk 16.30.0 ('16se' version bump)
	Last Asterisk 16.x "Legacy" version, built --without-pjproject and --without-dahdi

-- Asterisk 18.19.0 (version bump) and 20.4.0 (new version)
	Built --with-pjproject and --with-dahdi

-- DAHDI, dahdi-linux 3.2.0 (no change) and dahdi-tools 3.2.0 (no change)
	Add build fix to include "astribank" utilities

-- Added rc.conf variable DAHDI_DISABLE, disable DAHDI when set to "yes", defaults to "no".

-- pjsip 2.13.1 (version bump)

-- libpri, version bump to 1.6.1

-- Complete Pre-Release ChangeLog:
https://astlinux-project.org/beta/astlinux-changelog/ChangeLog.txt

The "AstLinux Pre-Release ChangeLog" and "Pre-Release Repository URL" entries can be found under the "Development" tab of the AstLinux Project web site ...

AstLinux Project -> Development
https://www.astlinux-project.org/dev.html


AstLinux Team

Re: [Astlinux-users] Accessing devices behind Astlinux

[Michael K. <mic...@ip...>]

Phew spent most of the day thinking about this but have come up a plan moving forward.
I have decided that we will continue to use SSH and SOCKS as we have been successfully doing so with a couple of improvements:

  1.  OpenSSH supports ProxyJump which you can use in ~/.ssh/config or as a -J directive. This will automatically pass your SSH tunnel through a hardened proxy server which you can set up individual users and then restrict SSH access from your Astlinux servers to this Jump server only. It seems to work well from my limited testing and Astlinux can be a Jump server.
  2.  As Lonnie mentioned we will script the addition and removal of SSH keys from devices from a trusted device (my laptop probably)

Thanks guys for your help.

Regards
Michael Knill


From: Michael Keuter <li...@mk...>
Date: Saturday, 19 August 2023 at 2:20 am
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Accessing devices behind Astlinux
Here is also an interesting video regarding jump servers:

https://www.youtube.com/watch?v=KIeBC7NIzj4

Michael

http://www.mksolutions.info

> Am 18.08.2023 um 17:44 schrieb Michael Keuter <li...@mk...>:
>
> Nice video, very interesting.
>
> BTW: on macOS you can install Proxychain via Homebrew with:
>
> brew install proxychains-ng
>
> and call it with "proxychain4 firefox".
>
>> Am 18.08.2023 um 17:02 schrieb Lonnie Abelbeck <li...@lo...>:
>>
>> Hi Michael,
>>
>> I don't have any personal experience to share, but Tom Lawrence has a related video [1]
>>
>> Youtube: SSH Jump Server Access and How To Pivot Using OpenVPN & Proxychains
>>
>> I suspect this could all be done with SSH+SOCKS (Proxychains) and no OpenVPN tunnel as his example does.
>>
>> Key takeaways are to encrypt the Jump Server's drive (and backup), keep it local and secure from the internet, limit remote AstLinux SSH access via its firewall and Jump Server ssh key.
>>
>>
>> Alternatively, some sort of automation to keep the remote AstLinux SSH keys updated from one hardened location.
>>
>> Lonnie
>>
>> [1] https://www.youtube.com/watch?v=jqudlmfG0zA
>>
>>
>>
>>> On Aug 18, 2023, at 2:17 AM, Michael Knill <mic...@ip...> wrote:
>>>
>>> Hi All
>>>
>>> Here is the issue:
>>> We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
>>> We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.
>>>
>>> Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
>>> Could there be any other options e.g. HTTPS proxy?
>>>
>>> Regards
>>>
>>> Michael Knill
>>> Managing Director



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Accessing devices behind Astlinux

[Michael K. <mic...@ip...>]

Thanks guys. Very interesting info.

We are already using SSH Key only and SOCKS to access devices behind Astlinux which works well.
I didn’t know about proxychains though which will be MUCH better than having to keep changing the proxy config on Firefox.

I have considered using a jump server in our management network but there was always the concern that if it was compromised then attackers are a step closer to being able to access all our systems and possibly the devices behind them.
There are certainly a few things that you can do however to mitigate this including encrypting drives (and backups) and having multiple layers of security.

Certainly some more ideas to think about.

Thanks again.

Regards
Michael Knill


From: Michael Keuter <li...@mk...>
Date: Saturday, 19 August 2023 at 2:20 am
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Accessing devices behind Astlinux
Here is also an interesting video regarding jump servers:

https://www.youtube.com/watch?v=KIeBC7NIzj4

Michael

http://www.mksolutions.info

> Am 18.08.2023 um 17:44 schrieb Michael Keuter <li...@mk...>:
>
> Nice video, very interesting.
>
> BTW: on macOS you can install Proxychain via Homebrew with:
>
> brew install proxychains-ng
>
> and call it with "proxychain4 firefox".
>
>> Am 18.08.2023 um 17:02 schrieb Lonnie Abelbeck <li...@lo...>:
>>
>> Hi Michael,
>>
>> I don't have any personal experience to share, but Tom Lawrence has a related video [1]
>>
>> Youtube: SSH Jump Server Access and How To Pivot Using OpenVPN & Proxychains
>>
>> I suspect this could all be done with SSH+SOCKS (Proxychains) and no OpenVPN tunnel as his example does.
>>
>> Key takeaways are to encrypt the Jump Server's drive (and backup), keep it local and secure from the internet, limit remote AstLinux SSH access via its firewall and Jump Server ssh key.
>>
>>
>> Alternatively, some sort of automation to keep the remote AstLinux SSH keys updated from one hardened location.
>>
>> Lonnie
>>
>> [1] https://www.youtube.com/watch?v=jqudlmfG0zA
>>
>>
>>
>>> On Aug 18, 2023, at 2:17 AM, Michael Knill <mic...@ip...> wrote:
>>>
>>> Hi All
>>>
>>> Here is the issue:
>>> We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
>>> We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.
>>>
>>> Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
>>> Could there be any other options e.g. HTTPS proxy?
>>>
>>> Regards
>>>
>>> Michael Knill
>>> Managing Director



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Accessing devices behind Astlinux

[Michael K. <li...@mk...>]

Here is also an interesting video regarding jump servers:

https://www.youtube.com/watch?v=KIeBC7NIzj4

Michael

http://www.mksolutions.info

> Am 18.08.2023 um 17:44 schrieb Michael Keuter <li...@mk...>:
> 
> Nice video, very interesting.
> 
> BTW: on macOS you can install Proxychain via Homebrew with:
> 
> brew install proxychains-ng
> 
> and call it with "proxychain4 firefox".
> 
>> Am 18.08.2023 um 17:02 schrieb Lonnie Abelbeck <li...@lo...>:
>> 
>> Hi Michael,
>> 
>> I don't have any personal experience to share, but Tom Lawrence has a related video [1]
>> 
>> Youtube: SSH Jump Server Access and How To Pivot Using OpenVPN & Proxychains
>> 
>> I suspect this could all be done with SSH+SOCKS (Proxychains) and no OpenVPN tunnel as his example does.
>> 
>> Key takeaways are to encrypt the Jump Server's drive (and backup), keep it local and secure from the internet, limit remote AstLinux SSH access via its firewall and Jump Server ssh key.
>> 
>> 
>> Alternatively, some sort of automation to keep the remote AstLinux SSH keys updated from one hardened location.
>> 
>> Lonnie
>> 
>> [1] https://www.youtube.com/watch?v=jqudlmfG0zA
>> 
>> 
>> 
>>> On Aug 18, 2023, at 2:17 AM, Michael Knill <mic...@ip...> wrote:
>>> 
>>> Hi All
>>> 
>>> Here is the issue:
>>> We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
>>> We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.
>>> 
>>> Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
>>> Could there be any other options e.g. HTTPS proxy?
>>> 
>>> Regards
>>> 
>>> Michael Knill
>>> Managing Director

Re: [Astlinux-users] Accessing devices behind Astlinux

[Michael K. <li...@mk...>]

Nice video, very interesting.

BTW: on macOS you can install Proxychain via Homebrew with:

brew install proxychains-ng

and call it with "proxychain4 firefox".

> Am 18.08.2023 um 17:02 schrieb Lonnie Abelbeck <li...@lo...>:
> 
> Hi Michael,
> 
> I don't have any personal experience to share, but Tom Lawrence has a related video [1]
> 
> Youtube: SSH Jump Server Access and How To Pivot Using OpenVPN & Proxychains
> 
> I suspect this could all be done with SSH+SOCKS (Proxychains) and no OpenVPN tunnel as his example does.
> 
> Key takeaways are to encrypt the Jump Server's drive (and backup), keep it local and secure from the internet, limit remote AstLinux SSH access via its firewall and Jump Server ssh key.
> 
> 
> Alternatively, some sort of automation to keep the remote AstLinux SSH keys updated from one hardened location.
> 
> Lonnie
> 
> [1] https://www.youtube.com/watch?v=jqudlmfG0zA
> 
> 
> 
>> On Aug 18, 2023, at 2:17 AM, Michael Knill <mic...@ip...> wrote:
>> 
>> Hi All
>> 
>> Here is the issue:
>> We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
>> We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.
>> 
>> Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
>> Could there be any other options e.g. HTTPS proxy?
>> 
>> Regards
>> 
>> Michael Knill
>> Managing Director
>> 
>> D: +61 2 6189 1360
>> P: +61 2 6140 4656
>> E: mic...@ip...
>> W: ipcsolutions.com.au
>> 
>> <image001.png>
>> Smarter Business Communications
>> 
>> _______________________________________________
>> Astlinux-users mailing list
>> Ast...@li...
>> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>> 
>> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
> 
> 
> 
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



Michael

http://www.mksolutions.info

Re: [Astlinux-users] Accessing devices behind Astlinux

[Lonnie A. <li...@lo...>]

Hi Michael,

I don't have any personal experience to share, but Tom Lawrence has a related video [1]

Youtube: SSH Jump Server Access and How To Pivot Using OpenVPN & Proxychains

I suspect this could all be done with SSH+SOCKS (Proxychains) and no OpenVPN tunnel as his example does.

Key takeaways are to encrypt the Jump Server's drive (and backup), keep it local and secure from the internet, limit remote AstLinux SSH access via its firewall and Jump Server ssh key.


Alternatively, some sort of automation to keep the remote AstLinux SSH keys updated from one hardened location.

Lonnie

[1] https://www.youtube.com/watch?v=jqudlmfG0zA



> On Aug 18, 2023, at 2:17 AM, Michael Knill <mic...@ip...> wrote:
> 
> Hi All
>  
> Here is the issue:
> We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
> We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.
>  
> Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
> Could there be any other options e.g. HTTPS proxy?
>  
> Regards
>  
> Michael Knill
> Managing Director
>  
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>  
>  <image001.png>
> Smarter Business Communications
>  
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

[Astlinux-users] Accessing devices behind Astlinux

[Michael K. <mic...@ip...>]

Hi All

Here is the issue:
We access devices behind Astlinux currently using SSH Tunnelling and SOCKS. It works well however it is becoming increasingly difficult in managing local authentication to do this such as using SSH Keys.
We are going to be bringing on additional staff and I don’t want to have to go into every system to add credentials or keys every time we bring on a new staffmember.

Just wondering if there are any options for external authentication of SSH rather than local on Astlinux e.g. using RADIUS
Could there be any other options e.g. HTTPS proxy?

Regards

Michael Knill
Managing Director

D: +61 2 6189 1360<tel:+61261891360>
P: +61 2 6140 4656<tel:+61261404656>
E: mic...@ip...<mailto:mic...@ip...>
W: ipcsolutions.com.au<https://ipcsolutions.com.au/>

 [Icon  Description automatically generated]
Smarter Business Communications

Re: [Astlinux-users] Looking to implement DNS-TLS

[Michael K. <mic...@ip...>]

Thanks 😊

Regards
Michael Knill


From: Lonnie Abelbeck <li...@lo...>
Date: Friday, 11 August 2023 at 10:19 am
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Looking to implement DNS-TLS
Sounds like you have a use case to implement the the /mnt/kd/dnsmasq.static trick/workaround.

Lonnie


> On Aug 10, 2023, at 6:38 PM, Michael Knill <mic...@ip...> wrote:
>
> Hi Lonnie
>
> Whoops sorry for assuming you are psychic. It’s the dyndns-host-open plugin for the firewall.
> You mentioned with the /mnt/kd/dnsmasq.static trick (I called it workaround) that it should only be implemented if it was not working. But DNS not working would be a bad thing and although I have a static entry for access in the firewall it would prevent access for all other addresses and ports using the dyndns-host-open plugin.
>
> Yes I suspect it would be rare but the impact would be high if it happened.
>
> Regards
> Michael Knill
>
>
> From: Lonnie Abelbeck <li...@lo...>
> Date: Thursday, 10 August 2023 at 11:26 pm
> To: AstLinux Users Mailing List <ast...@li...>
> Subject: Re: [Astlinux-users] Looking to implement DNS-TLS
>
> Hi Michael,
>
> Not sure what you mean by "dyn-dns plugin"?  Plugin to what?
>
> In this day and age, certificates that depend on the system to have a valid time are quite common.
>
> If you are using Network tab -> "Dynamic DNS Update:", the update will use HTTPS (via curl) to secure your credentials, which will require a valid system time.  Note the "Dynamic DNS Update:" (set external DNS record) has nothing to do with "DNS-TLS" (retrieve DNS).
>
> The AstLinux system clock is maintained via one or more of:
>
> 1) CMOS flash with battery RTC (bare metal)
>
> 2) Virtual Machine host provides date/time (VM)
>
> 3) Time is set on startup using chrony using Network tab -> "Network Time Settings:"
>
>
> While I have not had any practical issues over the years using "DNS-TLS", you can either use a manual IPv4 address in "Network Time Settings:" or use the /mnt/kd/dnsmasq.static trick as described here [1] to "almost" guarantee the clock is valid at startup.
>
> Lonnie
>
> [1] https://doc.astlinux-project.org/userdoc:tt_dns_tls_proxy#possible_startup_issues
>
>
>
>
> > On Aug 10, 2023, at 1:28 AM, Michael Knill <mic...@ip...> wrote:
> >
> > Hi Group
> >
> > I’m currently using the dyn-dns plugin and wanting to extend it for additional Astlinux access.
> > I’m concerned that DNS traffic is currently not being encrypted so I want to use DNS-TLS.
> >
> > I have two questions:
> >        • As you have mentioned in the notes, as it relies on reasonably correct time which needs DNS to be set correctly, I am concerned that we will not be able to access the system with dyn-dns if this occurs. Should I implement the workaround for this in /mnt/kd/dnsmasq.static always?
> >        • I currently have 1.1.1.1 & 8.8.8.8 configured as my standard DNS. I assume this is not possible with the DNS Proxy and DNSSEC? I do realise that Anycast DNS is very close to 100% uptime but I’m just cautious.
> >
> > Regards
> >
> > Michael Knill
> > Managing Director
> >
> > D: +61 2 6189 1360
> > P: +61 2 6140 4656
> > E: mic...@ip...
> > W: ipcsolutions.com.au
> >
> >  <image001.png>
> > Smarter Business Communications
> >
> > _______________________________________________
> > Astlinux-users mailing list
> > Ast...@li...
> > https://lists.sourceforge.net/lists/listinfo/astlinux-users
> >
> > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
>
>
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Looking to implement DNS-TLS

[Lonnie A. <li...@lo...>]

Sounds like you have a use case to implement the the /mnt/kd/dnsmasq.static trick/workaround.

Lonnie


> On Aug 10, 2023, at 6:38 PM, Michael Knill <mic...@ip...> wrote:
> 
> Hi Lonnie
>  
> Whoops sorry for assuming you are psychic. It’s the dyndns-host-open plugin for the firewall.
> You mentioned with the /mnt/kd/dnsmasq.static trick (I called it workaround) that it should only be implemented if it was not working. But DNS not working would be a bad thing and although I have a static entry for access in the firewall it would prevent access for all other addresses and ports using the dyndns-host-open plugin.
>  
> Yes I suspect it would be rare but the impact would be high if it happened.
>  
> Regards
> Michael Knill
>  
>  
> From: Lonnie Abelbeck <li...@lo...>
> Date: Thursday, 10 August 2023 at 11:26 pm
> To: AstLinux Users Mailing List <ast...@li...>
> Subject: Re: [Astlinux-users] Looking to implement DNS-TLS
> 
> Hi Michael,
> 
> Not sure what you mean by "dyn-dns plugin"?  Plugin to what?
> 
> In this day and age, certificates that depend on the system to have a valid time are quite common.
> 
> If you are using Network tab -> "Dynamic DNS Update:", the update will use HTTPS (via curl) to secure your credentials, which will require a valid system time.  Note the "Dynamic DNS Update:" (set external DNS record) has nothing to do with "DNS-TLS" (retrieve DNS).
> 
> The AstLinux system clock is maintained via one or more of:
> 
> 1) CMOS flash with battery RTC (bare metal)
> 
> 2) Virtual Machine host provides date/time (VM)
> 
> 3) Time is set on startup using chrony using Network tab -> "Network Time Settings:"
> 
> 
> While I have not had any practical issues over the years using "DNS-TLS", you can either use a manual IPv4 address in "Network Time Settings:" or use the /mnt/kd/dnsmasq.static trick as described here [1] to "almost" guarantee the clock is valid at startup.
> 
> Lonnie
> 
> [1] https://doc.astlinux-project.org/userdoc:tt_dns_tls_proxy#possible_startup_issues
> 
> 
> 
> 
> > On Aug 10, 2023, at 1:28 AM, Michael Knill <mic...@ip...> wrote:
> > 
> > Hi Group
> >  
> > I’m currently using the dyn-dns plugin and wanting to extend it for additional Astlinux access.
> > I’m concerned that DNS traffic is currently not being encrypted so I want to use DNS-TLS.
> >  
> > I have two questions:
> >        • As you have mentioned in the notes, as it relies on reasonably correct time which needs DNS to be set correctly, I am concerned that we will not be able to access the system with dyn-dns if this occurs. Should I implement the workaround for this in /mnt/kd/dnsmasq.static always?
> >        • I currently have 1.1.1.1 & 8.8.8.8 configured as my standard DNS. I assume this is not possible with the DNS Proxy and DNSSEC? I do realise that Anycast DNS is very close to 100% uptime but I’m just cautious.
> >  
> > Regards
> >  
> > Michael Knill
> > Managing Director
> >  
> > D: +61 2 6189 1360
> > P: +61 2 6140 4656
> > E: mic...@ip...
> > W: ipcsolutions.com.au
> >  
> >  <image001.png>
> > Smarter Business Communications
> >  
> > _______________________________________________
> > Astlinux-users mailing list
> > Ast...@li...
> > https://lists.sourceforge.net/lists/listinfo/astlinux-users
> > 
> > Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
> 
> 
> 
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Looking to implement DNS-TLS

[Michael K. <mic...@ip...>]

Hi Lonnie

Whoops sorry for assuming you are psychic. It’s the dyndns-host-open plugin for the firewall.
You mentioned with the /mnt/kd/dnsmasq.static trick (I called it workaround) that it should only be implemented if it was not working. But DNS not working would be a bad thing and although I have a static entry for access in the firewall it would prevent access for all other addresses and ports using the dyndns-host-open plugin.

Yes I suspect it would be rare but the impact would be high if it happened.

Regards
Michael Knill


From: Lonnie Abelbeck <li...@lo...>
Date: Thursday, 10 August 2023 at 11:26 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Looking to implement DNS-TLS
Hi Michael,

Not sure what you mean by "dyn-dns plugin"?  Plugin to what?

In this day and age, certificates that depend on the system to have a valid time are quite common.

If you are using Network tab -> "Dynamic DNS Update:", the update will use HTTPS (via curl) to secure your credentials, which will require a valid system time.  Note the "Dynamic DNS Update:" (set external DNS record) has nothing to do with "DNS-TLS" (retrieve DNS).

The AstLinux system clock is maintained via one or more of:

1) CMOS flash with battery RTC (bare metal)

2) Virtual Machine host provides date/time (VM)

3) Time is set on startup using chrony using Network tab -> "Network Time Settings:"


While I have not had any practical issues over the years using "DNS-TLS", you can either use a manual IPv4 address in "Network Time Settings:" or use the /mnt/kd/dnsmasq.static trick as described here [1] to "almost" guarantee the clock is valid at startup.

Lonnie

[1] https://doc.astlinux-project.org/userdoc:tt_dns_tls_proxy#possible_startup_issues




> On Aug 10, 2023, at 1:28 AM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> I’m currently using the dyn-dns plugin and wanting to extend it for additional Astlinux access.
> I’m concerned that DNS traffic is currently not being encrypted so I want to use DNS-TLS.
>
> I have two questions:
>        • As you have mentioned in the notes, as it relies on reasonably correct time which needs DNS to be set correctly, I am concerned that we will not be able to access the system with dyn-dns if this occurs. Should I implement the workaround for this in /mnt/kd/dnsmasq.static always?
>        • I currently have 1.1.1.1 & 8.8.8.8 configured as my standard DNS. I assume this is not possible with the DNS Proxy and DNSSEC? I do realise that Anycast DNS is very close to 100% uptime but I’m just cautious.
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
>  <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Looking to implement DNS-TLS

[Lonnie A. <li...@lo...>]

Hi Michael,

Not sure what you mean by "dyn-dns plugin"?  Plugin to what?

In this day and age, certificates that depend on the system to have a valid time are quite common.

If you are using Network tab -> "Dynamic DNS Update:", the update will use HTTPS (via curl) to secure your credentials, which will require a valid system time.  Note the "Dynamic DNS Update:" (set external DNS record) has nothing to do with "DNS-TLS" (retrieve DNS).

The AstLinux system clock is maintained via one or more of:

1) CMOS flash with battery RTC (bare metal)

2) Virtual Machine host provides date/time (VM)

3) Time is set on startup using chrony using Network tab -> "Network Time Settings:"


While I have not had any practical issues over the years using "DNS-TLS", you can either use a manual IPv4 address in "Network Time Settings:" or use the /mnt/kd/dnsmasq.static trick as described here [1] to "almost" guarantee the clock is valid at startup.

Lonnie

[1] https://doc.astlinux-project.org/userdoc:tt_dns_tls_proxy#possible_startup_issues




> On Aug 10, 2023, at 1:28 AM, Michael Knill <mic...@ip...> wrote:
> 
> Hi Group
>  
> I’m currently using the dyn-dns plugin and wanting to extend it for additional Astlinux access.
> I’m concerned that DNS traffic is currently not being encrypted so I want to use DNS-TLS.
>  
> I have two questions:
> 	• As you have mentioned in the notes, as it relies on reasonably correct time which needs DNS to be set correctly, I am concerned that we will not be able to access the system with dyn-dns if this occurs. Should I implement the workaround for this in /mnt/kd/dnsmasq.static always?
> 	• I currently have 1.1.1.1 & 8.8.8.8 configured as my standard DNS. I assume this is not possible with the DNS Proxy and DNSSEC? I do realise that Anycast DNS is very close to 100% uptime but I’m just cautious.
>  
> Regards
>  
> Michael Knill
> Managing Director
>  
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>  
>  <image001.png>
> Smarter Business Communications
>  
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

[Astlinux-users] Looking to implement DNS-TLS

[Michael K. <mic...@ip...>]

Hi Group

I’m currently using the dyn-dns plugin and wanting to extend it for additional Astlinux access.
I’m concerned that DNS traffic is currently not being encrypted so I want to use DNS-TLS.

I have two questions:

  1.  As you have mentioned in the notes, as it relies on reasonably correct time which needs DNS to be set correctly, I am concerned that we will not be able to access the system with dyn-dns if this occurs. Should I implement the workaround for this in /mnt/kd/dnsmasq.static always?
  2.  I currently have 1.1.1.1 & 8.8.8.8 configured as my standard DNS. I assume this is not possible with the DNS Proxy and DNSSEC? I do realise that Anycast DNS is very close to 100% uptime but I’m just cautious.

Regards

Michael Knill
Managing Director

D: +61 2 6189 1360<tel:+61261891360>
P: +61 2 6140 4656<tel:+61261404656>
E: mic...@ip...<mailto:mic...@ip...>
W: ipcsolutions.com.au<https://ipcsolutions.com.au/>

 [Icon  Description automatically generated]
Smarter Business Communications

Re: [Astlinux-users] What is .wh.__dir_opaque

[Michael K. <mic...@ip...>]

Thanks Lonnie. I will remove to keep things clean.

Regards
Michael Knill


From: Lonnie Abelbeck <li...@lo...>
Date: Thursday, 3 August 2023 at 10:42 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] What is .wh.__dir_opaque
Hi Michael,

AstLinux version 1.3.8 and older used a unionfs driver (kernel based) that used "whiteout" files added to the filesystem (ex. .wh.__dir_opaque) to note added/removed directories, among other things.

AstLinux version 1.3.10 and newer uses a different unionfs driver (FUSE based), so the old whiteout files (ex. .wh.__dir_opaque) are no longer used/needed.

These whiteout files are of zero size, so the simplest is to ignore them.  If you want to remove the old whiteout files, you can.

Lonnie




> On Aug 3, 2023, at 4:59 AM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> Im getting ‘.wh.__dir_opaque’ files in a number of directories on an old Astlinux system that I have recently upgraded.
> Just wondering what they are and whether I should delete them?
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
>  <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] What is .wh.__dir_opaque

[Lonnie A. <li...@lo...>]

Hi Michael,

AstLinux version 1.3.8 and older used a unionfs driver (kernel based) that used "whiteout" files added to the filesystem (ex. .wh.__dir_opaque) to note added/removed directories, among other things.

AstLinux version 1.3.10 and newer uses a different unionfs driver (FUSE based), so the old whiteout files (ex. .wh.__dir_opaque) are no longer used/needed.

These whiteout files are of zero size, so the simplest is to ignore them.  If you want to remove the old whiteout files, you can.

Lonnie




> On Aug 3, 2023, at 4:59 AM, Michael Knill <mic...@ip...> wrote:
> 
> Hi Group
>  
> Im getting ‘.wh.__dir_opaque’ files in a number of directories on an old Astlinux system that I have recently upgraded.
> Just wondering what they are and whether I should delete them?
>  
> Regards
>  
> Michael Knill
> Managing Director
>  
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>  
>  <image001.png>
> Smarter Business Communications
>  
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

[Astlinux-users] What is .wh.__dir_opaque

[Michael K. <mic...@ip...>]

Hi Group

Im getting ‘.wh.__dir_opaque’ files in a number of directories on an old Astlinux system that I have recently upgraded.
Just wondering what they are and whether I should delete them?

Regards

Michael Knill
Managing Director

D: +61 2 6189 1360<tel:+61261891360>
P: +61 2 6140 4656<tel:+61261404656>
E: mic...@ip...<mailto:mic...@ip...>
W: ipcsolutions.com.au<https://ipcsolutions.com.au/>

 [Icon  Description automatically generated]
Smarter Business Communications

[Astlinux-users] Announcing AstLinux Release: 1.5.1

[Lonnie A. <li...@lo...>]

Announcing AstLinux Release: 1.5.1

More Info: AstLinux Project
https://www.astlinux-project.org/

AstLinux 1.5.1 Highlights:
* Asterisk Versions: 13.38.3, 16.30.0, 18.18.0

* Linux Kernel 5.10.179, security and bug fixes
* RUNNIX, version bump to runnix-0.6.15
* OpenSSL, version bump to 1.1.1u, security fixes: CVE-2023-0464, CVE-2023-0465, CVE-2023-0466, CVE-2023-2650
* libcurl (curl) version bump to 8.1.2, security fixes: CVE-2023-27537, CVE-2023-27536, CVE-2023-27535, CVE-2023-27534, CVE-2023-27533, CVE-2023-28319, CVE-2023-28320, * CVE-2023-28321, CVE-2023-28322
* libcap, version bump to 2.69, security fixes: CVE-2023-2602, CVE-2023-2603
* libpcap, version bump to 1.10.4
* libxml2, version bump to 2.10.4, security fixes: CVE-2023-29469, CVE-2023-28484
* dnsmasq, version 2.84, security fix: CVE-2023-28450
* Fossil, (major) version bump to 2.22
* ncurses, version bump to 6.4, security fix: CVE-2023-29491
* pjsip version bump to 2.13
* sngrep, version bump to 1.7.0
* sqlite, version bump to 3.42.0
* tiff, version bump to 4.5.1
* tcpdump, version bump to 4.99.4
* udev (eudev), version bump to 3.2.12
* zabbix, version bump to 4.0.47, security fix: CVE-2023-29456
* Asterisk '13se' (stable edition) version 13.38.3 is the last Asterisk 13.x "Legacy" version, built --without-pjproject
* Package upgrades providing important security and bug fixes

Full ChangeLog:
https://raw.githubusercontent.com/astlinux-project/astlinux/1.5.1/docs/ChangeLog.txt

All users are encouraged to upgrade, read the ChangeLog for the details.

AstLinux Team

Re: [Astlinux-users] Opus codec for home assitant

[Lonnie A. <li...@lo...>]

Hi Sándor,

> I can hear the beep of Home Assistant, and after I say something, it happily announces, that he couldn't understand that :)

Excellent!  Great to hear.

BTW, if needed there are OPUS CODEC custom config settings in Asterisk by editing /etc/asterisk/codecs.conf and at the end of the file "OPUS Examples", commented-out by default.

As for attribution, no personal credit is needed, but mentioning the AstLinux Project would be fine.  Be sure to mention the Asterisk OPUS CODEC "Usage Tracking" as some may be uncomfortable with that.

For the record, I have no experience with Home Assistant, but I found this "Support for other codecs in VOIP integration" [1] which describes your issue here.

Even if Home Assistant supported ulaw/alaw in the future, having an Asterisk PBX managing the voice calls could be generally useful.  The AstLinux Project provides a small footprint solution for those willing to do some CLI asterisk configuration.

Lonnie

[1] https://community.home-assistant.io/t/support-for-other-codecs-in-voip-integration/568580



> On Jun 28, 2023, at 11:49 PM, Sándor Balázs <bal...@ho...> wrote:
> 
> Hi Lonnie,
> 
> Thank you for your quick, and very accurate response!
> This was everything I needed. I can hear the beep of Home Assistant, and after I say something, it happily announces, that he couldn't understand that :)
> (this is most likely a voice recognition issue, I didn't finished configuring that yet)
> So thank you very much again!
> 
> I'm planning to create a tutorial about how to get Home Assistant working with older cisco phones for voice control.
> Can I use your description for this purpose? If so, then do you have a contact information you would like to be used in the attribution?
> 
> Sándor
> ________________________________________
> Feladó: Lonnie Abelbeck <li...@lo...>
> Elküldve: 2023. június 28., szerda 22:27
> Címzett: AstLinux Users Mailing List
> Tárgy: Re: [Astlinux-users] Opus codec for home assitant
> 
> Hi Sándor,
> 
> Thanks for giving AstLinux a spin.
> 
> First, answer your Status page question.  Asterisk supports either the older chan_sip or newer chan_pjsip SIP drivers.  Asterisk 18's default config only loads chan_pjsip and not chan_sip, so the 'sip show registry' and 'sip show peers' CLI commands are not supported by chan_pjsip.  The web interface Prefs tab can be used to uncheck "Show SIP Trunk Registrations" and "Show SIP Peer Status" if you decide to not use chan_sip.
> 
> AstLinux does not include the OPUS CODEC as part of the standard build.  Two reasons...
> 
> 1) While it may seem the OPUS CODEC is free to use [1], patent issues may still exist.  Perform proper due diligence.
> 
> 2) Asterisk/Digium/Sangoma have built in a "Usage Tracking" feature [2].  Both codec_opus.so and format_ogg_opus.so modules are linked with libcurl.so to provide the "Usage Tracking" feature.
> 
> 
> OK, with that out of the way, I took your challenge to add the OPUS CODEC to AstLinux.  I used Asterisk 18 as you did.  Proceeded to install in a VM.
> =-=-=
> 
> == First, in order to write to /usr/lib/asterisk/modules/ you must set an advanced configuration option.  Using the web interface:
> Network tab -> Advanced Configuration -> User System Variables: { Edit User Variables }
> 
> add the line...
> 
> ASTERISK_RW_MODULES_DIR="yes"
> 
> click { Save Changes } followed by clicking  { Reload/Restart } [ Apply user.conf variables ] - x Confirm
> 
> == Using the AstLinux CLI, restart asterisk
> 
> pbx ~ # service asterisk stop
> Stopping Asterisk...
> pbx ~ # service asterisk init
> Starting Asterisk...
> 
> == Now download and add the codec_opus modules from Digium.
> 
> pbx ~ # mkdir /mnt/kd/opus
> 
> pbx ~ # cd /mnt/kd/opus
> 
> pbx opus # curl -O https://downloads.digium.com/pub/telephony/codec_opus/asterisk-18.0/x86-64/codec_opus-18.0_1.3.0-x86_64.tar.gz
> 
> pbx opus # tar xzvf codec_opus-18.0_1.3.0-x86_64.tar.gz
> 
> pbx opus # cd codec_opus-18.0_1.3.0-x86_64
> 
> pbx codec_opus-18.0_1.3.0-x86_64 # cp *_opus.so /usr/lib/asterisk/modules/
> 
> == The codec_opus_config-en_US.xml file needs to be copied (AstLinux specific location)
> 
> pbx codec_opus-18.0_1.3.0-x86_64 # cp codec_opus_config-en_US.xml /stat/var/lib/asterisk/documentation/thirdparty/
> 
> == As a quick sanity check, use the AstLinux "show-union" command, it should look like...
> 
> pbx codec_opus-18.0_1.3.0-x86_64 # show-union
> /mnt/asturw/usr/lib/asterisk/modules/codec_opus.so
> /mnt/asturw/usr/lib/asterisk/modules/format_ogg_opus.so
> /mnt/asturw/etc/shadow-
> /mnt/asturw/etc/passwd
> /mnt/asturw/etc/passwd-
> /mnt/asturw/etc/shadow
> /mnt/asturw/stat/var/lib/asterisk/documentation/thirdparty/codec_opus_config-en_US.xml
> /mnt/asturw/stat/var/www/admin/.htpasswd
> 
> == Finally, restart asterisk to use the new modules
> 
> pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk stop
> Stopping Asterisk...
> pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk init
> Starting Asterisk...
> 
> =-=-=
> 
> I hope this gets you started.
> 
> Be aware that there is some Asterisk knowledge required to perform the CODEC translation task you desire.
> 
> Lonnie
> 
> 
> [1] https://opus-codec.org/license/
> 
> [2] Opus Software Codec for Asterisk README: "Usage Tracking" The codec_opus module will periodically attempt to send usage statistics to an Asterisk community server. The statistics are sent at most every 24 hours.
> 
> 
> 
> 
>> On Jun 28, 2023, at 9:39 AM, Sándor Balázs <bal...@ho...> wrote:
>> 
>> I have some older cisco phones with SIP and alaw/ulaw support. And I want to connect to home assistant.
>> The direct IP call thing failed for some reason and not knowing what the reason might be, I turned to asterisk. I didn't want to install linux for this... but of course this thing is linux only...
>> So I happily found this project, and got my VM working in a few minutes. astlinux-1.5.0 x86_64 - Asterisk 18.16.0
>> 
>> I want to note here, that on the Status page these messages appear instead of the content of the div...
>> SIP Trunk Registrations: No such command 'sip show registry' (type 'core show help sip show' for other possible commands)
>> SIP Peer Status: No such command 'sip show peers' (type 'core show help sip show' for other possible commands)
>> 
>> So after some experimenting I noticed, that microsip can only communicate with home assistant only if the opus codec is enabled.
>> so home assitant supposedly uses opus. My phones do not support opus, and there is no way I can get CISCO to create a firmware that does.
>> 
>> So of course I googled it. And asterisk can translate between codecs. I found a maillist thread that said, that version 13 is the first version containing OPUS. I use version 18 so it's not a problem. Itried to enable it in astlinux, but after a few attempts I came to the conclusion, that I might miss the "codec_opus.so" in "/usr/lib/asterisk/modules/".
>> Firstly it said, that it is read only... so I remounted it as read-write but then it complains about not enought space, as it is 100% utilised...
>> 
>> So my question is:
>> Where can I download the version that contains support for opus?
>> If for some reason there isn't any, then how can I manually add it without recompiling the whole thing? (I do not want to use linux after all)
> 

Re: [Astlinux-users] Opus codec for home assitant

[Sándor B. <bal...@ho...>]

Hi Lonnie,

Thank you for your quick, and very accurate response!
This was everything I needed. I can hear the beep of Home Assistant, and after I say something, it happily announces, that he couldn't understand that :)
(this is most likely a voice recognition issue, I didn't finished configuring that yet)
So thank you very much again!

I'm planning to create a tutorial about how to get Home Assistant working with older cisco phones for voice control.
Can I use your description for this purpose? If so, then do you have a contact information you would like to be used in the attribution?

Sándor
________________________________________
Feladó: Lonnie Abelbeck <li...@lo...>
Elküldve: 2023. június 28., szerda 22:27
Címzett: AstLinux Users Mailing List
Tárgy: Re: [Astlinux-users] Opus codec for home assitant

Hi Sándor,

Thanks for giving AstLinux a spin.

First, answer your Status page question.  Asterisk supports either the older chan_sip or newer chan_pjsip SIP drivers.  Asterisk 18's default config only loads chan_pjsip and not chan_sip, so the 'sip show registry' and 'sip show peers' CLI commands are not supported by chan_pjsip.  The web interface Prefs tab can be used to uncheck "Show SIP Trunk Registrations" and "Show SIP Peer Status" if you decide to not use chan_sip.

AstLinux does not include the OPUS CODEC as part of the standard build.  Two reasons...

1) While it may seem the OPUS CODEC is free to use [1], patent issues may still exist.  Perform proper due diligence.

2) Asterisk/Digium/Sangoma have built in a "Usage Tracking" feature [2].  Both codec_opus.so and format_ogg_opus.so modules are linked with libcurl.so to provide the "Usage Tracking" feature.


OK, with that out of the way, I took your challenge to add the OPUS CODEC to AstLinux.  I used Asterisk 18 as you did.  Proceeded to install in a VM.
=-=-=

== First, in order to write to /usr/lib/asterisk/modules/ you must set an advanced configuration option.  Using the web interface:
Network tab -> Advanced Configuration -> User System Variables: { Edit User Variables }

add the line...

ASTERISK_RW_MODULES_DIR="yes"

click { Save Changes } followed by clicking  { Reload/Restart } [ Apply user.conf variables ] - x Confirm

== Using the AstLinux CLI, restart asterisk

pbx ~ # service asterisk stop
Stopping Asterisk...
pbx ~ # service asterisk init
Starting Asterisk...

== Now download and add the codec_opus modules from Digium.

pbx ~ # mkdir /mnt/kd/opus

pbx ~ # cd /mnt/kd/opus

pbx opus # curl -O https://downloads.digium.com/pub/telephony/codec_opus/asterisk-18.0/x86-64/codec_opus-18.0_1.3.0-x86_64.tar.gz

pbx opus # tar xzvf codec_opus-18.0_1.3.0-x86_64.tar.gz

pbx opus # cd codec_opus-18.0_1.3.0-x86_64

pbx codec_opus-18.0_1.3.0-x86_64 # cp *_opus.so /usr/lib/asterisk/modules/

== The codec_opus_config-en_US.xml file needs to be copied (AstLinux specific location)

pbx codec_opus-18.0_1.3.0-x86_64 # cp codec_opus_config-en_US.xml /stat/var/lib/asterisk/documentation/thirdparty/

== As a quick sanity check, use the AstLinux "show-union" command, it should look like...

pbx codec_opus-18.0_1.3.0-x86_64 # show-union
/mnt/asturw/usr/lib/asterisk/modules/codec_opus.so
/mnt/asturw/usr/lib/asterisk/modules/format_ogg_opus.so
/mnt/asturw/etc/shadow-
/mnt/asturw/etc/passwd
/mnt/asturw/etc/passwd-
/mnt/asturw/etc/shadow
/mnt/asturw/stat/var/lib/asterisk/documentation/thirdparty/codec_opus_config-en_US.xml
/mnt/asturw/stat/var/www/admin/.htpasswd

== Finally, restart asterisk to use the new modules

pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk stop
Stopping Asterisk...
pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk init
Starting Asterisk...

=-=-=

I hope this gets you started.

Be aware that there is some Asterisk knowledge required to perform the CODEC translation task you desire.

Lonnie


[1] https://opus-codec.org/license/

[2] Opus Software Codec for Asterisk README: "Usage Tracking" The codec_opus module will periodically attempt to send usage statistics to an Asterisk community server. The statistics are sent at most every 24 hours.




> On Jun 28, 2023, at 9:39 AM, Sándor Balázs <bal...@ho...> wrote:
>
> I have some older cisco phones with SIP and alaw/ulaw support. And I want to connect to home assistant.
> The direct IP call thing failed for some reason and not knowing what the reason might be, I turned to asterisk. I didn't want to install linux for this... but of course this thing is linux only...
> So I happily found this project, and got my VM working in a few minutes. astlinux-1.5.0 x86_64 - Asterisk 18.16.0
>
> I want to note here, that on the Status page these messages appear instead of the content of the div...
> SIP Trunk Registrations: No such command 'sip show registry' (type 'core show help sip show' for other possible commands)
> SIP Peer Status: No such command 'sip show peers' (type 'core show help sip show' for other possible commands)
>
> So after some experimenting I noticed, that microsip can only communicate with home assistant only if the opus codec is enabled.
> so home assitant supposedly uses opus. My phones do not support opus, and there is no way I can get CISCO to create a firmware that does.
>
> So of course I googled it. And asterisk can translate between codecs. I found a maillist thread that said, that version 13 is the first version containing OPUS. I use version 18 so it's not a problem. Itried to enable it in astlinux, but after a few attempts I came to the conclusion, that I might miss the "codec_opus.so" in "/usr/lib/asterisk/modules/".
> Firstly it said, that it is read only... so I remounted it as read-write but then it complains about not enought space, as it is 100% utilised...
>
> So my question is:
> Where can I download the version that contains support for opus?
> If for some reason there isn't any, then how can I manually add it without recompiling the whole thing? (I do not want to use linux after all)



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7

[Michael K. <mic...@ip...>]

Hi Group

I can now confirm that removing the adaptive jitterbuffer from voicemail (and other modules in the call flow prior to voicemail) fixed this problem.
I will be trying to find out why but will leave as disabled until confirmed working again.
Thanks all for your help.

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Thursday, 22 June 2023 at 7:19 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Another update:
I actually think I have fixed the problem. I removed the adaptive jitterbuffer from voicemail in the dialplan and I was able to make it happen again after over 30 attempts. I put it back and it cut off the first call.
Will implement out in the wild and see if it fixes the problem. Will let you know how I go.
PS sorry for all the emails.

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Thursday, 22 June 2023 at 5:51 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Scratch the last email. Had it that only one of them dropped out and the other kept working.

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Thursday, 22 June 2023 at 5:04 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Another update:
In my testing I had two phone calls going simultaneously (one from my mobile and one from my deskphone) and they both dropped out at virtually the same time.
[Jun 22 16:58:13] WARNING[8830][C-000000c4]: file.c:293 ast_writestream: Translated frame write failed
[Jun 22 16:58:13] WARNING[8830][C-000000c4]: app.c:2010 __ast_play_and_record: Error writing frame
    -- Recording was 0 seconds long but needs to be at least 1 - abandoning
….
[Jun 22 16:58:30] WARNING[8806][C-000000c3]: file.c:293 ast_writestream: Translated frame write failed
[Jun 22 16:58:30] WARNING[8806][C-000000c3]: app.c:2010 __ast_play_and_record: Error writing frame

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Thursday, 22 June 2023 at 3:13 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Update:
Using tcpdump I managed to do a packet capture as the problem is unfortunately occurring frequently enough to make this possible.
After looking at the pcap with Wireshark, the RTP stream looked fine and I could not find any empty RTP frames e.g. all had payload entries and were the same size. They were all G.711 PCMA encoded as well.

Surely it cant be a disk write issue otherwise I would probably be seeing other issues and its usually intermittent?

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Thursday, 22 June 2023 at 2:24 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Hmm the problem is still there after these changes and I have now stopped my upgrades until its fixed.
After posting on the forum, jcolp has responded with:

--------
The two cases for format_wav to return an error for writing is:

  1.  It was given a frame with no data in it
  2.  An error occurred when writing it to the disk

The first case would require probably orchestrating things and going through the complete media flow to determine where/how a frame with no data appeared.
--------

Any ideas where I would start my troubleshooting?

Regards
Michael Knill


From: Michael Knill <mic...@ip...>
Date: Wednesday, 14 June 2023 at 6:16 am
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Hi Lonnie

Thanks for this.

So the testing I performed was to call into the system from my mobile to a number that goes directly to voicemail without a greeting. If the call stayed up for a couple of seconds then I would hang up and call again.
Whenever I got the Warning messages, the call actually dropped. Another log line I didnt add was:
-- Recording was 0 seconds long but needs to be at least 1 – abandoning

I also posted on the Asterisk forum and someone mentioned that a solution to the problem could be setting “transmit_silence=yes” in asterisk.conf which I tried and it significantly reduced (possibly eliminated) the problem.

I will try setting this at a couple of our problem sites to see if it fixes the problem and let you know how I go.

Regards
Michael Knill


From: Lonnie Abelbeck <li...@lo...>
Date: Tuesday, 13 June 2023 at 10:26 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7
Hi Michael,

I looked through the Asterisk code, this is basic core code, but some 'code stirring' has occurred between 13 and 16.

If you can replicate it in the lab, does Astlinux 1.5.0 / 13se work as expected with your voicemail.conf?

Does the error occur only on long (longer) voicemails?

Does the error occur intermittently or all the time?  Any pattern?

Lonnie



> On Jun 13, 2023, at 5:52 AM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> Im trying to find out why I am getting voicemail errors on Asterisk 16 on Astlinux 1.4.7 and hoping someone may have an idea where I should start investigating. Im getting reports and example voicemails where the person has been cut off mid recording only on Asterisk 16 on Astlinux 1.4.7.
> Im intermittently getting the following which from testing happens prior to it dropping out:
> Jun 13 13:18:47 25160-Clinic88-CM1 local0.warn asterisk[1203]: WARNING[1533][C-000004bc]: file.c:293 in ast_writestream: Translated frame write failed
> Jun 13 13:18:47 25160-Clinic88-CM1 local0.warn asterisk[1203]: WARNING[1533][C-000004bc]: app.c:2010 in __ast_play_and_record: Error writing frame
>
> Nothing on 1.3.10 using Asterisk 13. Both have the same voicemail config:
> [general]
> format = wav
> maxsecs = 180
> minsecs = 1
> maxmsg = 1000
> maxgreet = 60
> maxsilence = 0
> minpassword = 4
> silencethreshold = 128
> maxlogins = 3
> nextaftercmd = yes
> sendvoicemail = yes
> review = yes
> operator = yes
> forcename = yes
> forcegreetings = yes
> tempgreetwarn = yes
> callback = DialPlan1
> exitcontext = voicemail-exit
> externpass = /mnt/kd/scripts/vm_password_sync
> externnotify = php /mnt/kd/scripts/voicemailnotify.php
>
> I have tried Astlinux 1.5.0 and it still happens. I cant seem to find any related bugs.
>
> Any ideas?
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
>  <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....

Re: [Astlinux-users] Opus codec for home assitant

[Lonnie A. <li...@lo...>]

Hi Sándor,

Thanks for giving AstLinux a spin.

First, answer your Status page question.  Asterisk supports either the older chan_sip or newer chan_pjsip SIP drivers.  Asterisk 18's default config only loads chan_pjsip and not chan_sip, so the 'sip show registry' and 'sip show peers' CLI commands are not supported by chan_pjsip.  The web interface Prefs tab can be used to uncheck "Show SIP Trunk Registrations" and "Show SIP Peer Status" if you decide to not use chan_sip.

AstLinux does not include the OPUS CODEC as part of the standard build.  Two reasons...

1) While it may seem the OPUS CODEC is free to use [1], patent issues may still exist.  Perform proper due diligence.

2) Asterisk/Digium/Sangoma have built in a "Usage Tracking" feature [2].  Both codec_opus.so and format_ogg_opus.so modules are linked with libcurl.so to provide the "Usage Tracking" feature.


OK, with that out of the way, I took your challenge to add the OPUS CODEC to AstLinux.  I used Asterisk 18 as you did.  Proceeded to install in a VM.
=-=-=

== First, in order to write to /usr/lib/asterisk/modules/ you must set an advanced configuration option.  Using the web interface:
Network tab -> Advanced Configuration -> User System Variables: { Edit User Variables }

add the line...

ASTERISK_RW_MODULES_DIR="yes"

click { Save Changes } followed by clicking  { Reload/Restart } [ Apply user.conf variables ] - x Confirm

== Using the AstLinux CLI, restart asterisk

pbx ~ # service asterisk stop
Stopping Asterisk...
pbx ~ # service asterisk init
Starting Asterisk...

== Now download and add the codec_opus modules from Digium.

pbx ~ # mkdir /mnt/kd/opus

pbx ~ # cd /mnt/kd/opus

pbx opus # curl -O https://downloads.digium.com/pub/telephony/codec_opus/asterisk-18.0/x86-64/codec_opus-18.0_1.3.0-x86_64.tar.gz

pbx opus # tar xzvf codec_opus-18.0_1.3.0-x86_64.tar.gz

pbx opus # cd codec_opus-18.0_1.3.0-x86_64

pbx codec_opus-18.0_1.3.0-x86_64 # cp *_opus.so /usr/lib/asterisk/modules/

== The codec_opus_config-en_US.xml file needs to be copied (AstLinux specific location)

pbx codec_opus-18.0_1.3.0-x86_64 # cp codec_opus_config-en_US.xml /stat/var/lib/asterisk/documentation/thirdparty/

== As a quick sanity check, use the AstLinux "show-union" command, it should look like...

pbx codec_opus-18.0_1.3.0-x86_64 # show-union 
/mnt/asturw/usr/lib/asterisk/modules/codec_opus.so
/mnt/asturw/usr/lib/asterisk/modules/format_ogg_opus.so
/mnt/asturw/etc/shadow-
/mnt/asturw/etc/passwd
/mnt/asturw/etc/passwd-
/mnt/asturw/etc/shadow
/mnt/asturw/stat/var/lib/asterisk/documentation/thirdparty/codec_opus_config-en_US.xml
/mnt/asturw/stat/var/www/admin/.htpasswd

== Finally, restart asterisk to use the new modules

pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk stop
Stopping Asterisk...
pbx codec_opus-18.0_1.3.0-x86_64 # service asterisk init
Starting Asterisk...

=-=-=

I hope this gets you started.

Be aware that there is some Asterisk knowledge required to perform the CODEC translation task you desire.

Lonnie


[1] https://opus-codec.org/license/

[2] Opus Software Codec for Asterisk README: "Usage Tracking" The codec_opus module will periodically attempt to send usage statistics to an Asterisk community server. The statistics are sent at most every 24 hours.




> On Jun 28, 2023, at 9:39 AM, Sándor Balázs <bal...@ho...> wrote:
> 
> I have some older cisco phones with SIP and alaw/ulaw support. And I want to connect to home assistant.
> The direct IP call thing failed for some reason and not knowing what the reason might be, I turned to asterisk. I didn't want to install linux for this... but of course this thing is linux only...
> So I happily found this project, and got my VM working in a few minutes. astlinux-1.5.0 x86_64 - Asterisk 18.16.0
> 
> I want to note here, that on the Status page these messages appear instead of the content of the div...
> SIP Trunk Registrations: No such command 'sip show registry' (type 'core show help sip show' for other possible commands)
> SIP Peer Status: No such command 'sip show peers' (type 'core show help sip show' for other possible commands)
> 
> So after some experimenting I noticed, that microsip can only communicate with home assistant only if the opus codec is enabled.
> so home assitant supposedly uses opus. My phones do not support opus, and there is no way I can get CISCO to create a firmware that does.
> 
> So of course I googled it. And asterisk can translate between codecs. I found a maillist thread that said, that version 13 is the first version containing OPUS. I use version 18 so it's not a problem. Itried to enable it in astlinux, but after a few attempts I came to the conclusion, that I might miss the "codec_opus.so" in "/usr/lib/asterisk/modules/".
> Firstly it said, that it is read only... so I remounted it as read-write but then it complains about not enought space, as it is 100% utilised...
> 
> So my question is:
> Where can I download the version that contains support for opus?
> If for some reason there isn't any, then how can I manually add it without recompiling the whole thing? (I do not want to use linux after all)

[Astlinux-users] Opus codec for home assitant

[Sándor B. <bal...@ho...>]

I have some older cisco phones with SIP and alaw/ulaw support. And I want to connect to home assistant.
The direct IP call thing failed for some reason and not knowing what the reason might be, I turned to asterisk. I didn't want to install linux for this... but of course this thing is linux only...
So I happily found this project, and got my VM working in a few minutes. astlinux-1.5.0 x86_64 - Asterisk 18.16.0

I want to note here, that on the Status page these messages appear instead of the content of the div...
SIP Trunk Registrations: No such command 'sip show registry' (type 'core show help sip show' for other possible commands)
SIP Peer Status: No such command 'sip show peers' (type 'core show help sip show' for other possible commands)

So after some experimenting I noticed, that microsip can only communicate with home assistant only if the opus codec is enabled.
so home assitant supposedly uses opus. My phones do not support opus, and there is no way I can get CISCO to create a firmware that does.

So of course I googled it. And asterisk can translate between codecs. I found a maillist thread that said, that version 13 is the first version containing OPUS. I use version 18 so it's not a problem. Itried to enable it in astlinux, but after a few attempts I came to the conclusion, that I might miss the "codec_opus.so" in "/usr/lib/asterisk/modules/".
Firstly it said, that it is read only... so I remounted it as read-write but then it complains about not enought space, as it is 100% utilised...

So my question is:
Where can I download the version that contains support for opus?
If for some reason there isn't any, then how can I manually add it without recompiling the whole thing? (I do not want to use linux after all)

Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7

[darricklegacy <dha...@dj...>]

Have you replaced the disk? Sounds like you might have a failing drive based on everything else you've tried.

________________________________
From: Michael Knill <mic...@ip...>
Sent: Wednesday, June 21, 2023 11:24:05 PM
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7


Hmm the problem is still there after these changes and I have now stopped my upgrades until its fixed.

After posting on the forum, jcolp has responded with:



--------

The two cases for format_wav to return an error for writing is:

  1.  It was given a frame with no data in it
  2.  An error occurred when writing it to the disk



The first case would require probably orchestrating things and going through the complete media flow to determine where/how a frame with no data appeared.

--------



Any ideas where I would start my troubleshooting?



Regards

Michael Knill





From: Michael Knill <mic...@ip...>
Date: Wednesday, 14 June 2023 at 6:16 am
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7

Hi Lonnie



Thanks for this.



So the testing I performed was to call into the system from my mobile to a number that goes directly to voicemail without a greeting. If the call stayed up for a couple of seconds then I would hang up and call again.
Whenever I got the Warning messages, the call actually dropped. Another log line I didnt add was:

-- Recording was 0 seconds long but needs to be at least 1 – abandoning



I also posted on the Asterisk forum and someone mentioned that a solution to the problem could be setting “transmit_silence=yes” in asterisk.conf which I tried and it significantly reduced (possibly eliminated) the problem.



I will try setting this at a couple of our problem sites to see if it fixes the problem and let you know how I go.



Regards

Michael Knill





From: Lonnie Abelbeck <li...@lo...>
Date: Tuesday, 13 June 2023 at 10:26 pm
To: AstLinux Users Mailing List <ast...@li...>
Subject: Re: [Astlinux-users] Problems with voicemail and Asterisk 16 on Astlinux 1.4.7

Hi Michael,

I looked through the Asterisk code, this is basic core code, but some 'code stirring' has occurred between 13 and 16.

If you can replicate it in the lab, does Astlinux 1.5.0 / 13se work as expected with your voicemail.conf?

Does the error occur only on long (longer) voicemails?

Does the error occur intermittently or all the time?  Any pattern?

Lonnie



> On Jun 13, 2023, at 5:52 AM, Michael Knill <mic...@ip...> wrote:
>
> Hi Group
>
> Im trying to find out why I am getting voicemail errors on Asterisk 16 on Astlinux 1.4.7 and hoping someone may have an idea where I should start investigating. Im getting reports and example voicemails where the person has been cut off mid recording only on Asterisk 16 on Astlinux 1.4.7.
> Im intermittently getting the following which from testing happens prior to it dropping out:
> Jun 13 13:18:47 25160-Clinic88-CM1 local0.warn asterisk[1203]: WARNING[1533][C-000004bc]: file.c:293 in ast_writestream: Translated frame write failed
> Jun 13 13:18:47 25160-Clinic88-CM1 local0.warn asterisk[1203]: WARNING[1533][C-000004bc]: app.c:2010 in __ast_play_and_record: Error writing frame
>
> Nothing on 1.3.10 using Asterisk 13. Both have the same voicemail config:
> [general]
> format = wav
> maxsecs = 180
> minsecs = 1
> maxmsg = 1000
> maxgreet = 60
> maxsilence = 0
> minpassword = 4
> silencethreshold = 128
> maxlogins = 3
> nextaftercmd = yes
> sendvoicemail = yes
> review = yes
> operator = yes
> forcename = yes
> forcegreetings = yes
> tempgreetwarn = yes
> callback = DialPlan1
> exitcontext = voicemail-exit
> externpass = /mnt/kd/scripts/vm_password_sync
> externnotify = php /mnt/kd/scripts/voicemailnotify.php
>
> I have tried Astlinux 1.5.0 and it still happens. I cant seem to find any related bugs.
>
> Any ideas?
>
> Regards
>
> Michael Knill
> Managing Director
>
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>
>  <image001.png>
> Smarter Business Communications
>
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
>
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....



_______________________________________________
Astlinux-users mailing list
Ast...@li...
https://lists.sourceforge.net/lists/listinfo/astlinux-users

Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....