Firewall Disabled

[MrXirtam]

I have been noticing, one by one, the multiple different servers I manage, a particular security concern. I use the fail2ban and I have it send me emails on attempts. The pattern I have noticed is I will receive emails of attempts that were banned, multiple ones in a row. When I log onto the server to check the status of it, I see right away that the firewall is disabled! I check on these frequently, at least once a week and I know they are always enabled and running. I enable the firewall, and monitor it afterwards, and there are no problems after that happens. But this has happened to three different FreePBX systems I manage. I don’t know if it’s coincidence but the only common factor I can see is that all of them had their Let’s Encrypt cert due to renew. They still had nearly a month left, so they were still valid, but there was a security message indicating it was due to for renewal and it hadn’t processed automatically yet. When I manually update the certificate, it processes normally and shows it is updated. I run this after the firewall was re-enabled. I do not know if this is a bug with this particular series of events, but as I mentioned, it has happened on multiple different servers. Any ideas?

They are all running the following versions:
FreePBX 15.0.16.72
Asterisk 16.11.1
Firewall Module 15.0.6.20
Certificate Manager Module 15.0.25.3

[jerrm]

The release LetsEncrypt updates are broken, and as you’ve discovered, leave the firewall completely broken.

The edge certman module is a little better, but can still leave the firewall disabled or compromised.

A few of the recent discussions:

Firewall getting disabled somehow

Hello. Hope everyone is doing alright. This is the second day in a row, I wake up from the PBX system with SIP and SSH bans. Yesterday I logged in and saw the firewall disabled and thought it was I who left the firewall off. Once I turned it on, everything became quite again. Today, I wake up to the same thing. Firewall disabled again and i’m getting attacked again. Not sure what’s is going on. I’m about to update YUM and also change my passwords (which are randomly generated). I’d like to fig…

LetsEncrypt HTTP-01 functionality

Just a suggestion, but someone at Sangoma needs to grab the LetsEncrypt problem by the balls very quickly. If it only is supposed to work for “the distro” please clarify.

Concerned about a possible vulnerability with SSL or SEC-2020-004 or New LetsEncrypt FW rules

I suddenly got several hundred alerts from Fail2Ban for services (SSH, SIP, and recidive!!) that were not exposed to Internet/Public zones… upon further inspection somehow the FreePBX firewall services were inadvertently turned off but not by me… diving deeper into the freepbx_security.log I found the following: [2020-Jul-29 22:14:08] [freepbx_security.NOTICE]: [Restapps] WARNING!!! Unexpected activity has been detected from: 176.126.175.10 [] [] [2020-Jul-30 00:22:09] [freepbx_security.NOTI…

Some Certificates are Expiring

I’m seeing 2 errors in FreePBX Dashboard – screenshot attached. [image] My freepbx portals’s SSL certificate shows expiring in Oct 2020, so that’s fine. I’m unable to understand what the issue is & which PBX Services do I need to restart? the whole server as in reboot or something else? Thanks

Firewall keep getting disable

System Firewall is ver 15.0.6.12 I recently (4 weeks) upgraded from FreePBX 13 to FreePBX 15.0.16.57. Everything was running smooth the first three weeks (no issue) Approx 3 weeks and 5 days from the upgrade, the firewall somehow get disable at night. No issue re-enabling it. All setting are still there. But the next night its disable again, Appreciate any info

LE Certs Wont Change

So I’m having issues with the Lets Encrypt certificates not changing out on the web portal. I Leave my firewall port forward disabled until it’s time to renew. I then turn it back on every 60ish days, renew the cert manually(with the update cert button) then turn the port forward back off. I’ve been doing this for a couple years and never had any issues until about 2 months ago. My certificate is renewed but the pbx won’t change the certificate to the new one and it’s like it’s stuck with the …

[MrXirtam]

Ooof, I wasn’t able to find any of those articles. Thank you for the insight. Hopefully they can be squared away soon.

[phoneguy82 (Phone Guy)]

Yep, same here. Firewall is disabled every single morning and thousands of attempted fraud calls and etc. This is just crazy, it’s been almost a week since first reports! It was working just fine a couple weeks back and then bam. I am also using their Distro and I see the bug report is minor and resolved already. ITS NOT RESOLVED SANGOMA!!! I have a couple customers wanting to ditch this system due to all the issues recently.
FIX YOUR Code!!
This bug report is what Im talking about. Oh, and even on Edge track newest version of CertManager is only 15.0.25.3, regardless as .4 doesnt fix the problem either from the posts and reports so far.
https://issues.freepbx.org/browse/FREEPBX-21683