I have 2 fresh installs on 2 seperate hardware box’s and on both of them I seem to have an extra Interface “wlan0” not sure were it is comming from but I cant remove it or the active “Trusted” button there for the Firewall is always misconfigured and not running.
I’m NOT updating the top post, because I don’t want people who are coming here new to see this post, but, I’ve build the (hopefully!) first release of Firewall.
I’ve removed the Beta warning, DDNS host registrations work correctly, and, I think everything is good to go!
The only reason why I’m not publishing it through the Mirror CDN is that it’s 4pm, and I have to go look after the kids for the rest of the afternoon, and I’d hate to break a couple of thousand systems and not know about it for 12 hours
So, if you’re game (and you kn ow how to type ‘service iptables stop’), feel free to install that module and see how it goes!
Great job on something that is well and truly overdue in a PBX Distro!!
So, I believe I found a hiccup in the processes that managed to get myself locked out!! As per the warnings and everything else I ensured that I had added my home IP address where I was testing from to the Whitelist of IP addresses and then ensured that the eth0 interface was set as External to ensure that traffic was starting to be filtered.
I checked the iptables and could see that my IP address had been added to the zone-trusted.
After this I then tried to connect my phone to a newly created extension and register it to receive incoming calls. I saw a couple of connection attempts and then it stopped and I lost access to the web management GUI.
After connecting back onto console and checking iptables I could see that fail2ban had killed my IP address due to multiple failed connection attempts. At first I thought I had the password wrong, but turns out it was due to using port 5060 instead of 5061 as it was only a SIP extension not PJSIP extension.
It seems that fail2ban is kicking in first and blocking the IP address before it gets to the trusted network IP addresses.
Hope this allows you to test and replicate.
I admittedly haven’t tried your new version, but I was testing with ISO downloaded yesterday on a fresh install of BETA – 10.13.66
Yep. I’m adding that to the known issues. I think I’m going to DISABLE fail2ban blocking (and only alert, if it can) SIP failures when firewall is enabled.
For those following the thread, a privilege escalation issue was discovered in Custom Port Ranges, where an attacker who already had webuser privileges could gain root.
So, looking at things a different way … sysadmin-rpm is only available for RHEL, and I quite understand that you are not in a position to remove the firewall’s dependency on it. And, if it works well that way, why would you want to? The current apporach keeps the abstraction between the firewall based security and anti-bad-webuser security clean.
The question that then arises is why sysadmin cannot be made available for debian systems. Options:
This is a commercial knowledge protection issue and it will only ever be available for commercially supported (ie. RHEL) systems. End of.
It could be ported to Debian relatively easily, but we are concerned about maintaining both versions. If this is the case, how complex is the port? Is it really that hard to maintain so it runs on both RHEL and Debian. Perhaps it could be reconstructed so it was relatively easy to support on both platforms?
It depends on something in RHEL which is not generally there in Debian. In this case, the question becomes: what does it rely on in RHEL? Perhaps the key to making firewall more available is add-in to Debian the functionality that it relies on. Is there a way of knowing this to see if it can be added in?
I want to make Debian one of our officially supported platforms, and getting the equivalent of sysadmin.dpkg will be the first thing I need to do. (I’m not a fan of Ubuntu. If the debian stuff happens to work on Ubuntu, then yay, but, Debian is after C7, not Ubuntu)
The complexity is twofold:
I want to keep it zended, which gives it inherent self-integrity checking. But that then means I need to care about packing up zend. If I don’t zend it, then I need to write another wrapper to reimplement that.
This is an exponential amount of smearing. PHP versions * Distros * CPU Arch = lots more packages to manage. This can all be automated, but, it still needs me to write it.
There’s nothing stopping you from just extracting the zended files from a CentOS machine (which will only work with php 5.3) and fiddling with them. I did have a bunch of PHP5.x (3,4,5,6) RPMS made as a proof of concept, but that was just me messing around on my Jenkins box at home, and not nearly enough to actually say ‘here, this works’.
I’m really really busy for the rest of this year. Early next year I’ll be able to spend some more time on this.
Or, if someone wants to figure out a way to do privilege escalation securely on debian, I’m all ears. It’s open source, do the pull request!
I absolutely get that, and I’m not asking anyone to change these priorities. I’m simply trying to work out how voluntary effort (ie me) can most help. I’ll keep hunting and thinking and seeing if I can work this out. Is there any chance that sysadmin will become open source (or is that what your final statement means?
Yes, I would like to put it on my pi, which is running a simple home system pretty well (only issue is the module start up speed as per the other thread, everything else is fantastic. If I skip invoking superfecta it’s fantastic).
I have seen other people ask for it.
One of the great things about freepbx is that it allows anyone to do something like this, and they may well be running Debian. It seems to me a useful addition to freepbx and would allow those with security concerns to use freepbx with greater confidence.
So, I have a personnel motivation which I recognise is not consistent with your core business direction, I also enjoy getting involved in projects and, before my current role, was involved in code development for both medical systems and those on jet engines, so I have a reasonable awareness of what constitutes reliable code.
If there is a different area that you would really appreciate volunteers getting involved in (although security and speed seen good places to me) then do tell me.
Zend won’t work on a Pi, so that means option 1 is right out.
Looks like that’s your only option. If you want to spend some time whiteboarding up some concepts, throw it in a google doc and I’ll see if I can poke holes in it!
I was trying out this firewall feature in FreePBX13 and when I moved the FreePBX server Ethernet connection to the external zone I was locked out of the GUI. This even though I put the IP of the computer connecting from in the “trusted” computers list. How Can I disable the firewall from the cli at the PBX server so I can get back the FreePBX GUI? I can’t find the CLI list of commands for the firewall anywhere on the forum or in the documentation.
I had the same thin happen. i uninstalled the firewall module via the following code.
amportal a ma uninstall firewall
the only issue I am running into is when I reinstall the firewall and enable it lock me out before I can make changes. Does anyone know what files I need to delete to remove the configuration?
You can, by default, access the https:// connection of your machine, which will let you fix the configuration. You’ll get a certificate error, but you should still be able to get in.
I had the firewall setup nicely with my hosted PBX, but then I did the update and lost all my settings. Now my extensions only register if I’m connecting from a trusted IP. The responsive firewall does not seem to be working correctly.
Also, it appears the firewall settings are lost every time asterisk is restarted. I believe this is a safety feature but…I think this needs to be a feature that can be turned off.
