Disabling root logins is done for accountability and so you can disable leaving employees accounts, selectively, when they leave.
Once you know the system is running FreePBX, the sangoma account becomes just as much a root account, as a direct login to root. If you want a real security improvement, you should remove sudo permission from sangoma (although potentially this could break scripts), and give each administrator a personal account with its own password.
That’s debatable. If you look at the official release announcement of FreePBX v17 and the move to Debian 12, Sangoma said there would be no further ISO development and there would no longer be install ISO for FreePBX now that it was on Debian 12. There was no SNGDEB for the first six months of FreePBX v17 being in General Availability status.
As far as I can tell the idea to have an ISO came from one person and for some reason they were allowed to run wild with it. I’ve seen nothing be issues being reported about the ISO since its release and it doesn’t seem to be slowing down on that front.
All the original documents revolving around the install of FreePBX v17 was based on the fact there was no ISO and you would be doing the Debian 12 install on your own and thus would have root access.
The bottom line is, your issues revolve around using SNGDEB and how it handled the OS install.
Well, I don’t want to step into the middle of internal politics. All I will say is I was about to download Debian when I noticed the ISO documentation linked above. It seemed official to me.
Furthermore, I hit the exact same issue before the ISO existed, so I think probably it is the install instructions/documentation that are in need of work.
For example, I would suggest an addition to step 13 on the ISO instruction page something along these lines:
For security purposes, the root user is unable to log in by default. If you want to log in as root you will need to first log in as the “sangoma” user and run this command:
sudo passwd rootto set the password for the root user. Otherwise, be aware that you can log in with the “sangoma” user but you will need to run most commands with “sudo.” For example, fwconsole is not available to the sangoma user unless you run it like this:sudo fwconsole firewall stop
I’ve learned a lot in this thread, and I’m grateful for all the help. I hope the above suggestion is helpful.
However, the first issue I had is that the firewall turns on and locks me out before I can even finish setting it up. That is not related to the SNGDEB, is it?
No, that is all FreePBX after install.
Thank you. I will file a bug report on Github.
This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.