FreePBX Security Warning

FreePBX Security
1

Good morning,

I understand the reasoning for this type of warning, but I was wondering if there was a way to supress it for a particular file? I recently modified the following file - “/var/www/html/admin/modules/superfecta/sources/source-WhoCalled_UK.module”, as the regex queries in this file no longer work as the Who-Called website has changed. I have modified the file so that it can correctly query numbers, but doing so has made it so that FreePBX constantly warns me of the file being altered.

Not totally familiar with GitHub but I did a pull request with my version of the file, with the working regex.

If it isn’t possible to supress this, I guess it’ll just be a case of either having a functional module or have a FreePBX console without any warnings.

Cheers,
Richie

2

Correct, you can’t suppress individual checks you can disable all checks in ‘advanced sertings’

3

Had a look in Advanced Settings, but I don’t have the “Enable Module Signature Checking” setting for whatever reason. Looking at screenshots online, this should be next to “Enable Module Tracks”.

image
image1806×733 11.7 KB

4

If it was possible to disable these checks for particular files, why wouldn’t a malicious actor that’s gotten a hold of the system and modified some file then disable it for those particular files?

5

You do have a valid point, but in my scenario, my install of FreePBX isn’t accessible externally (at all). I would just like to be able to prevent these warnings from being displayed, but the setting to do that doesn’t exist for me, not sure if it’s been removed.

6

Make sure you have these options set at the top maybe?

image
image1800×199 14.2 KB

7

There is no ‘easy’ way of disabling this check and that is deliberate for obvious reasons. If you want to sign the module yourself, you can, or you can wait until your PR is published.
https://sangomakb.atlassian.net/wiki/spaces/FP/pages/10420868/Signing+your+own+modules

8

Changing those resolved it, thank you! I can now see the setting for Module Signature Checking.

Cheers,
Richie

9

Thank you also, I’ll have a look at this!

10

I believe your PR needed a CLA done. I’m not sure if @kgupta saw it or commented.

1 Like
11

Thank you, just signed the CLA after receiving an email with the link to do so.

1 Like
12

With a PR under your belt you’re the most recent entry to the CC club*. Thanks Richie!
image

[* The CC group membership is manual, so ping me if you qualify]

1 Like
13

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.