Hey,
das pasende Sicherheits-
HOWTO findest Du hier, wenn Du 30 Minuten Zeit hast dann hast Du Sicherheit
Aber bringen wir die Karre mal zum laufen.
Da Du ja nichts dringliches im Asterisken hast - tu mir doch bitte mal einen Gefallen.
In die BASH (root) :
In Dein Code-Verzeichnis (kompilierter Asterisk)
Code:
zBsp.
cd /usr/src/asterisk-1.6.x.x
make clean & make & make install & make config
Hinweis! Du hast natürlich nun root als Umgebung installiert, in einer nahen Zeit sollten wir kurz über das erstellen einer eigenen Asterisk Umgebung (Nutzername dediziert für den Betrieb) reden...
Nun hast Du die reinen Samples im Verzeichnis
Code:
cd /etc/asterisk
mkdir samples
mv * samples
Nun hast Du ein Verzeichnis SAMPLES und dort liegen alle vordefinierten Konfigurationen, wenn Du Rat & Tat brauchst schaust Du dort eben rein und kopierst Dir per COPY&PASTE was Du brauchst - so habe ich es immer gemacht wenn ich meinen Asterisken konfiguriert habe (wenigstens initial)
Okay, wichtigste Dateien aus den Samples holen und zum eigenen Verständnis einmal durchschauen - brauchst IMHO nichts zu ändern :
Hinweis Grundbefehle nano
(STRG+W suchen,
STRG+w -> dann STRG+R suchen & ersetzen,
STRG+X beenden (speichernggf.)
STRG+C die aktuelle Zeilennummer
Code:
cd /etc/asterisk
cp samples/logger.conf logger.conf
nano logger.conf (mit STRG+X kommst Du wieder raus)
cp samples/modules.conf modules.conf
nano modules.conf (mit STRG+X kommst Du wieder raus)
cp samples/asterisk.conf asterisk.conf
nano asterisk.conf (mit STRG+X kommst Du wieder raus)
Du holst Dir bitte ebenfalls noch (wie hier beschrieben) folgende Dateien :
asterisk.adsi
cdr.conf
cdr_custom.conf
cdr_manager.conf
cli.conf
codecs.conf
dnsmgr.conf (benötigt Veränderungen)
features.conf
indications.conf
manager.conf
meetme.conf
modules.conf
musiconhold.conf (benötigt Veränderungen .. : )
default suchen & ersetzen
Code:
[default] ; Neuer MP3Player, soll stabiler sein.
; z bedeutet shuffle - hier ggf. sinnvoll
mode=custom
directory=/var/lib/asterisk/mohmp3
application=/usr/bin/madplay -Q -z -o raw:- --mono -R 8000 -a -12
sort=alpha
rtp.conf (nicht kopieren, sondern nur dies hier in die neue Datei rtp.conf einsetzen: )
Code:
[general]
rtpstart=10000
rtpend=11000
Hinweis - die Firewall muss diese Ports an den Asterisk weiterleiten, da Du einen vServer hast und schlimmstensfalls "iptables -L" nichts bringt - hast Du freie Bahn.
skinny.conf
udptl.conf
voicemail.conf (kannst Du nach Deinem belieben umkonfigurieren.
Ich denke das dies den meisten Sinn macht,
HOLE NUR KONFIGDATEIEN AUS DEN SAMPLES DESSEN OPTIONEN DU KENNST,
dann klappts auch mit dem Asterisken
Alle haben mal klein angefangen.
Die wichtigsten beiden Dateien :
sip.conf (ich gebe Dir meine komplette SIP.CONF - sieht etwas mächtig aus, ist aber alles wichtige beschrieben & eingekürzt)
Code:
[general]
localnet=10.0.0.0/255.255.255.0 ; Dein lokaler IP Bereich (ich habe ihn schlichtweg ausgeklammert)
externhost=<DEINE IP> ; Deine IP des vServers solange sie statisch ist
externrefresh=10
nat=no
; *******************************************************
; SICHERHEITSASPEKTE ANFANG *
; *******************************************************
alwaysauthreject=yes ; Wir lassen abgewiesene User nicht wissen DAS es diesen User mit falschem Pwd auch wirklich gibt..!
allowguest=no ; Allow or reject guest calls (default is yes)
; Angeschlossene Geräte über Ihre Default IP
deny=89.32.214.0/0.0.0.0 ; ein beispiel für den ausschluss einer ip
; *******************************************************
; SICHERHEITSASPEKTE ENDE *
; *******************************************************
context=eingehend ; Default context for incoming calls
tcpenable=no ; Enable server for incoming TCP connections (default is no)
bindport=5060
tcpbindaddr=0.0.0.0 ; IP address for TCP server to bind to (0.0.0.0 binds to all interfaces)
; Optionally add a port number, 192.168.1.1:5062 (default is port 5060)
srvlookup=yes ; Enable DNS SRV lookups on outbound calls
; Note: Asterisk only uses the first host
; in SRV records
; Disabling DNS SRV lookups disables the
; ability to place SIP calls based on domain
; names to some other SIP users on the Internet
;pedantic=yes ; Enable checking of tags in headers,
; international character conversions in URIs
; and multiline formatted headers for strict
; SIP compatibility (defaults to "no")
; See qos.tex or Quality of Service section of asterisk.pdf
;tos_sip=cs3 ; Sets TOS for SIP packets.
;tos_audio=ef ; Sets TOS for RTP audio packets.
;tos_video=af41 ; Sets TOS for RTP video packets.
;tos_text=af41 ; Sets TOS for RTP text packets.
;cos_sip=3 ; Sets 802.1p priority for SIP packets.
;cos_audio=5 ; Sets 802.1p priority for RTP audio packets.
;cos_video=4 ; Sets 802.1p priority for RTP video packets.
;cos_text=3 ; Sets 802.1p priority for RTP text packets.
maxexpiry=3600 ; Maximum allowed time of incoming registrations
; and subscriptions (seconds)
minexpiry=60 ; Minimum length of registrations/subscriptions (default 60)
defaultexpiry=120 ; Default length of incoming/outgoing registration
mwiexpiry=3600 ; Expiry time for outgoing MWI subscriptions
qualifyfreq=60 ; Qualification: How often to check for the
; host to be up in seconds
; Set to low value if you use low timeout for
; NAT of UDP sessions
;qualifygap=100 ; Number of milliseconds between each group of peers being qualified
;qualifypeers=1 ; Number of peers in a group to be qualified at the same time
buggymwi=yes ; Cisco SIP firmware doesn't support the MWI RFC
; fully. Enable this option to not get error messages
; when sending MWI to phones with this bug.
vmexten=<DEIN KONTEXT f. ANRUFB. zBsp. "anrufbeantworter"> ; dialplan extension to reach mailbox sets the
; Message-Account in the MWI notify message
; defaults to "asterisk"
disallow=all ; First disallow all codecs
allow=ulaw ; Allow codecs in order of preference
allow=alaw ; Europaeischer Standard
mohinterpret=default ; Alle hoeren auf default - moh - eintrag
language=de
progressinband=never ; If we should generate in-band ringing always
; use 'never' to never use in-band signalling, even in cases
; where some buggy devices might not render it
; Valid values: yes, no, never Default: never
useragent=<WIE SOLL DEIN ASTERISK HEISSEN, bitte nicht ASTERISK> ; Allows you to change the user agent string
; The default user agent string also contains the Asterisk
; version. If you don't want to expose this, change the
; useragent string.
dtmfmode = rfc2833 ; Set default dtmfmode for sending DTMF. Default: rfc2833
; Other options:
; info : SIP INFO messages (application/dtmf-relay)
; shortinfo : SIP INFO messages (application/dtmf)
; inband : Inband audio (requires 64 kbit codec -alaw, ulaw)
; auto : Use rfc2833 if offered, inband otherwise
;compactheaders = yes ; send compact sip headers.
;regcontext=sipregistrations
;regextenonqualify=yes ; Default "no"
; If you have qualify on and the peer becomes unreachable
; this setting will enforce inactivation of the regexten
; extension for the peer
rtptimeout=60 ; Terminate call if 60 seconds of no RTP or RTCP activity
; on the audio channel
; when we're not on hold. This is to be able to hangup
; a call in the case of a phone disappearing from the net,
; like a powerloss or grandma tripping over a cable.
rtpholdtimeout=300 ; Terminate call if 300 seconds of no RTP or RTCP activity
; on the audio channel
; when we're on hold (must be > rtptimeout)
;rtpkeepalive=<secs> ; Send keepalives in the RTP stream to keep NAT open
; (default is off - zero)
allowsubscribe=yes ; Disable support for subscriptions. (Default is yes)
subscribecontext = sub_hints ; Set a specific context for SUBSCRIBE requests
; Useful to limit subscriptions to local extensions
; Settable per peer/user also
notifyringing = yes ; Control whether subscriptions already INUSE get sent
; RINGING when another call is sent (default: yes)
notifyhold = yes ; Notify subscriptions on HOLD state (default: no)
; Turning on notifyringing and notifyhold will add a lot
; more database transactions if you are using realtime.
notifycid = yes ; Control whether caller ID information is sent along with
; dialog-info+xml notifications (supported by snom phones).
; Note that this feature will only work properly when the
; incoming call is using the same extension and context that
; is being used as the hint for the called extension. This means
; that it won't work when using subscribecontext for your sip
; user or peer (if subscribecontext is different than context).
; This is also limited to a single caller, meaning that if an
; extension is ringing because multiple calls are incoming,
; only one will be used as the source of caller ID. Specify
; 'ignore-context' to ignore the called context when looking
; for the caller's channel. The default value is 'no.' Setting
; notifycid to 'ignore-context' also causes call-pickups attempted
; via SNOM's NOTIFY mechanism to set the context for the call pickup
; to PICKUPMARK.
sendcallinfo = yes
callcounter = yes ; Enable call counters on devices. This can be set per
; device too.
; T.38 faxing only works in SIP to SIP calls, with no local or agent channel being used.
t38pt_udptl = yes ; Default false
; Fax Detect will cause the SIP channel to jump to the 'fax' extension (if it exists)
; after T.38 is successfully negotiated.
; faxdetect = yes ; Default false
;registertimeout=20 ; retry registration calls every 20 seconds (default)
;registerattempts=10 ; Number of registration attempts before we give up
; 0 = continue forever, hammering the other server
; until it accepts the registration
; Default is 0 tries, continue forever
canreinvite=no ; Asterisk by default tries to redirect the
; RTP media stream (audio) to go directly from
; the caller to the callee. Some devices do not
; support this (especially if one of them is behind a NAT).
; The default setting is YES. If you have all clients
; behind a NAT, or for some other reason wants Asterisk to
; stay in the audio path, you may want to turn this off.
; This setting also affect direct RTP
; at call setup (a new feature in 1.4 - setting up the
; call directly between the endpoints instead of sending
; a re-INVITE).
;directrtpsetup=yes ; Enable the new experimental direct RTP setup. This sets up
; the call directly with media peer-2-peer without re-invites.
; Will not work for video and cases where the callee sends
; RTP payloads and fmtp headers in the 200 OK that does not match the
; callers INVITE. This will also fail if canreinvite is enabled when
; the device is actually behind NAT.
;canreinvite=nonat ; An additional option is to allow media path redirection
; (reinvite) but only when the peer where the media is being
; sent is known to not be behind a NAT (as the RTP core can
; determine it based on the apparent IP address the media
; arrives from).
;canreinvite=update ; Yet a third option... use UPDATE for media path redirection,
; instead of INVITE. This can be combined with 'nonat', as
; 'canreinvite=update,nonat'. It implies 'yes'.
fromdomain=<DEINE-IP>
; fromdomain=<DEINE TLD , also zBsp. www.google.de> ; When making outbound SIP INVITEs to
; non-peers, use your primary domain "identity"
; for From: headers instead of just your IP
; address. This is to be polite and
; it may be a mandatory requirement for some
; destinations which do not have a prior
; account relationship with your server.
;domain=1.2.3.4 ; Add IP address as local domain
; You can have several "domain" settings
; JITTERBUFFER SETTINGS
; jbenable = yes ; Enables the use of a jitterbuffer on the receiving side of a
; SIP channel. Defaults to "no". An enabled jitterbuffer will
; be used only if the sending side can create and the receiving
; side can not accept jitter. The SIP channel can accept jitter,
; thus a jitterbuffer on the receive SIP side will be used only
; if it is forced and enabled.
; jbforce = no ; Forces the use of a jitterbuffer on the receive side of a SIP
; channel. Defaults to "no".
; jbmaxsize = 200 ; Max length of the jitterbuffer in milliseconds.
; jbresyncthreshold = 1000 ; Jump in the frame timestamps over which the jitterbuffer is
; resynchronized. Useful to improve the quality of the voice, with
; big jumps in/broken timestamps, usually sent from exotic devices
; and programs. Defaults to 1000.
; jbimpl = fixed ; Jitterbuffer implementation, used on the receiving side of a SIP
; channel. Two implementations are currently available - "fixed"
; (with size always equals to jbmaxsize) and "adaptive" (with
; variable size, actually the new jb of IAX2). Defaults to fixed.
; jblog = no ; Enables jitterbuffer frame logging. Defaults to "no".
; Hier wäre RAUM um sich an einem Internet-Voice-Provider zBsp. SIPGATE zu registrieren
[30]
defaultuser=30
type=friend
secret=<geheim, aber nicht "30" ;) )
nat=never
host=dynamic
canreinvite=no
mailbox=30
vmexten=30
callgroup=1
pickupgroup=1
notifyringing=yes
useclientcode=yes
progressinband=yes
allowsubscribe=yes
subscribecontext=sub_hints
notifyhold=yes
limitonpeers=yes
;Sicherheitsaspekt
call-limit=3
sendcallinfo = yes
qualify=yes
;SicherheitsAspekt, von welcher IP kommt das Gerät?
;contactdeny=0.0.0.0/0.0.0.0
;contactpermit=10.0.0.0/255.255.0.0
callerid=<DEIN NAME> <30>
context=chef_tele
[31]
defaultuser=31
type=friend
secret=<geheim, aber nicht "31" ;) )
nat=never
host=dynamic
canreinvite=no
mailbox=30
vmexten=30
callgroup=1
pickupgroup=1
notifyringing=yes
useclientcode=yes
progressinband=yes
allowsubscribe=yes
subscribecontext=sub_hints
notifyhold=yes
limitonpeers=yes
;Sicherheitsaspekt
call-limit=3
sendcallinfo = yes
qualify=yes
;SicherheitsAspekt, von welcher IP kommt das Gerät?
;contactdeny=0.0.0.0/0.0.0.0
;contactpermit=10.0.0.0/255.255.0.0
callerid=<DEIN NAME> <31>
context=keinchef_tele
Du magst gerne dann noch mehr Benutzer einfügen, ich überlasse das mal Dir.
extensions.conf
Neu erstellen macht Sinn - das Sample ist SEHR voll
Code:
[general]
static=yes
writeprotect=no
autofallthrough=yes
extenpatternmatchnew=no
context=INVALID
extenpatternmatchnew=no
clearglobalvars=no
priorityjumping=yes
userscontext=default
[globals]
DYNAMIC_FEATURES=>automon
[echotest]
exten => 9902,1,Playback(demo-echotest) ; Echotest ausfuehren
exten => 9902,2,Echo ; # druecken um der Schleife zu entkommen
exten => 9902,3,Playback(demo-echodone)
exten => 9902,4,Wait(2)
exten => 9902,5,Hangup()
[sprachfile_aufnehmen]
exten => 9901,1,Wait(2)
exten => 9901,2,Record(/var/www/ansagen/1:gsm)
exten => 9901,3,Wait(2)
exten => 9901,4,Playback(/var/www/ansagen/1)
exten => 9901,5,Wait(2)
exten => 9901,6,Hangup()
[intern]
exten => 30,1,Dial(SIP/30,30,tTwW)
exten => 31,1,Dial(SIP/31,30,tTwW)
[default]
; Hier wird nichts angeboten ausser einer Sackgasse und einem Meldung fürs Logfile!!
exten => _X.,1,Answer ()
exten => _X.,n,Verbose(D E F A U L T ==> ${CALLERID(num)} kam um ${STRFTIME(${EPOCH},,%Y%m%d-%H%M%S)} in DEFAULT an als er versuchte die Nummer ${EXTEN} anzurufen.)
exten => _X.,n,Set(MIXMONITOR_FILENAME=${STRFTIME(${EPOCH},,%Y%m%d-%H%M%S)}-${EXTEN}-DEFAULT-REGEL-VON-${CALLERID(num)})
exten => _X.,n,Playback(/var/www/ansagen/keine_wahlregel)
exten => _X.,n,Hangup
[chef_tele] ; Deine Benutzerberechtigungsstufe (siehe sip.conf "context=chef_tele"
; Beispiel
include => echotest
include => sprachfile_aufnehmen
include => intern
[keinchef_tele] ; Deine Benutzerberechtigungsstufe (siehe sip.conf "context=chef_tele"
; Beispiel
; nun kannst Du Dinge erlauben oder verbieten
; include => echotest
; include => sprachfile_aufnehmen
include => intern
Somit solltest Du einen fertigen Asterisk haben, den Du nun nach belieben startest und reloadest.
Ahso! Folgendes fehlt noch :
Code:
cd /var
mkdir www
mkdir ansagen
mkdir anrufe
Das habe ich jetzt gerade mal so aus den Fingern gesaugt, sollte da was nicht stimmen (vorallem aber - sollte da was fehlen!) meld Dich eben!
OOPS ! Beachte bitte ! in der sip.conf kann es zu einem nötigen nat=yes kommen , ich bin jetzt gerade etwas durcheinander, beachte bitte den paramter nat=no/nat=yes in jeder einzelnen benutzerkontext
